Privacy Policy

1. Who we are and what this covers

Yusuf UYAR, an individual trading as Florgin ("Florgin", "we", "us") is the controller of personal information processed through the Florgin website, studio and related services (the "Services"). We can be reached at 1florginai@gmail.com, which is monitored for privacy and legal correspondence and is the address to use for any request under this Policy.

This Policy explains what we collect, why, who we share it with, how long we keep it and the rights you can exercise. It does not apply to third-party services you connect to Florgin, or to products you build and operate yourself — when your product collects data from your own users, you are the controller of that data and you are responsible for your own privacy notice.

2. Information we collect

We do not collect special category data, and the Acceptable Use Policy prohibits you from submitting it. Health and medical records, genetic and biometric data, full payment card numbers, government identity numbers and other regulated data must not be placed in prompts, uploaded files, seed data or test fixtures. Prompts are stored in your project history and sent to model providers so a build can run, so anything pasted into one leaves systems we alone control. Build against synthetic or anonymised data and connect the real source from your own infrastructure.

We do not knowingly collect personal information from children under 13, or under 16 where local law sets that threshold. If you believe a child has given us personal information, contact us and we will delete it.

3. How we use information, and our legal bases

4. How your prompts reach AI model providers

To run a build, Florgin sends the relevant portions of your Input — and, where necessary, the current state of your project — to the model provider that serves the model you or the auto-router selected. These providers act as our processors (sub-processors to you) and are contractually restricted to processing the data only to return a response.

We select providers that offer zero-retention or short-retention terms for API traffic and that do not use API inputs to train their models by default. A provider may retain data briefly for abuse monitoring as described in its own terms. If you need a specific provider excluded from processing, choose a model explicitly rather than leaving the workspace on autonomous routing.

5. Third-party services and who we share information with

Florgin is built on third-party software, infrastructure and integrations, which we use to deliver the Services, keep them available and improve their quality. We do not operate our own foundation models: the generation that produces your project is carried out by third-party model providers. Some of your information is therefore processed outside our own systems by necessity, not by choice.

Those third parties fall into two groups, and our responsibility differs between them:

• Sub-processors we appoint act on our instructions under a written contract that restricts what they may do with your information. We select them, we hold them to that contract, and we remain accountable for them under data protection law. They are listed in the table below.
• Independent third parties act on their own account under their own terms and privacy policies. This includes the Merchant of Record for payment, tax and fraud purposes, any service you connect to your Workspace, any provider a product you deploy calls at runtime, and a model provider's own abuse monitoring. We do not control these services, we are not responsible for how they process data, and their handling of your information is a matter between you and them.

We do not sell your personal information. We share it only in these circumstances:

• Service providers and sub-processors who host, secure and operate the Services on our behalf under written contract — see the table below.
• Members of your workspace, to the extent the workspace's roles allow. A workspace owner can see the projects in their workspace.
• Third-party services you explicitly connect, within the scope you authorise.
• Professional advisers — lawyers, accountants and auditors — under duties of confidentiality.
• Acquirers, in a merger, acquisition, financing or sale of assets, subject to this Policy continuing to apply to the transferred information.
• Authorities and other parties where we are legally required to, or where necessary to protect our rights, users or the public — we review each request and push back on ones that are overbroad.

We may add, replace or remove a provider as the infrastructure changes, and a replacement is held to the same contractual restrictions as the provider it succeeds. Email 1florginai@gmail.com to be notified of changes to our sub-processors.

6. International transfers

We operate internationally, and information may be processed in the United States and other countries whose data protection laws differ from those where you live. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on an appropriate safeguard — usually the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum. Where another country's law requires a specific transfer basis, we rely on the one that law provides.

7. How long we keep information

We may keep information longer where necessary to comply with a legal obligation, resolve a dispute, investigate abuse or enforce our agreements.

8. Your privacy rights

Depending on where you live, you may have some or all of the following rights. We honour these requests for everyone where we reasonably can, not only where the law requires it.

• Know and access — a copy of the personal information we hold about you and the categories we collect, use and disclose.
• Correct — fix information that is inaccurate.
• Delete — ask us to erase your personal information, subject to legal retention obligations.
• Portability — receive your data in a portable format. You can export your projects at any time from Settings → Data & privacy.
• Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.
• Limit use of sensitive personal information — we do not collect sensitive personal information for the purposes that trigger this right.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Object or restrict — object to processing based on legitimate interests, or ask us to restrict processing while a dispute is resolved.
• Non-discrimination — we will not deny service, charge a different price or provide a lower quality of service because you exercised a privacy right.
• Complain — lodge a complaint with your data protection authority. In the EEA this is your national supervisory authority; in the UK it is the ICO; elsewhere it is the regulator for the country you live in.

To exercise a right, email 1florginai@gmail.com from the address on your account, or use the controls in Settings. We verify requests by confirming control of the account email; for high-risk requests we may ask for additional verification. We respond within 45 days, extendable once by a further 45 days where permitted, or sooner where the law that applies to you requires it. An authorised agent may submit a request on your behalf with written proof of authorisation.

9. Notice for United States residents

This section supplements the rest of this Policy for residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws.

In the 12 months before the effective date of this Policy, we collected the categories of personal information described in Section 2 — identifiers, commercial information, internet or network activity, professional information, and content you submit — for the business purposes described in Section 3, and disclosed them to the categories of recipients described in Section 5.

• We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding 12 months, including personal information of consumers under 16.
• We do not use or disclose sensitive personal information for purposes that require the right to limit under the CCPA as amended by the CPRA.
• We do not use personal information for profiling that produces legal or similarly significant effects.
• California residents may request the categories and specific pieces of personal information collected, the sources, the business purpose, and the categories of third parties to whom it was disclosed.
• Where a state law provides an appeal process for a denied request, you may appeal by replying to our decision; we will respond in writing within the statutory period and tell you how to contact your state attorney general.

We do not sell or share personal information for cross-context behavioural advertising, and we set no advertising or analytics storage on your device. An opt-out preference signal such as Global Privacy Control therefore has no processing to switch off: there is nothing here that it would change. If we ever begin any processing a signal would apply to, we will honour the signal and say so in this Policy before we start.

Nevada residents may submit a verified request that we not sell their covered information. We do not sell covered information, but we will record your request.

10. How we protect information

• Encryption in transit (TLS), and encryption at rest applied by our storage provider to stored project data and credentials.
• Server-side authorisation checks on every workspace and project read and write, with the acting account taken from your session rather than from the request.
• A session cookie that scripts cannot read and that browsers do not send on cross-site requests.
• Automated screening of submitted text for payment card and national identity numbers, which are refused before they are stored or forwarded. The check is a pattern match, involves no human review, and retains nothing from a refused submission.
• Integration credentials held in a separate store from your project content, and never written into project files or generated output.
• Least-privilege internal access, with access to production data limited to staff who need it.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law and without undue delay. Report a vulnerability to 1florginai@gmail.com.

11. Cookies and similar technologies

We use a small number of cookies and similar technologies, described in full in the Cookie Policy — including what each one does, how long it lasts and how to withdraw consent.

12. Changes to this Policy

We will update this Policy as the Services change. For material changes we will give notice by email or in-product at least 30 days before they take effect, and we will update the effective date at the top. Continued use after the effective date means you accept the updated Policy.

13. Contact us

• Privacy requests and questions: 1florginai@gmail.com
• Security reports: 1florginai@gmail.com