Privacy Policy

This Privacy Policy explains how Flmnt LLC collects, uses, discloses, and protects your information when you use the Flmnt dashboard, command-line interface (CLI), and Model Context Protocol (MCP) services (collectively, the “Service”). It also describes the rights you have over your information and how to exercise them. The Service is currently offered only to users in the United States.

1. Who we are

Flmnt LLC, a California limited liability company located at 27790 Starfall Way, Murrieta, CA 92563 (“Flmnt,” “we,” “us”), is the controller (and, under U.S. state laws, the “business”) responsible for the personal information processed through the Service. Flmnt is an independent organization. You can reach our privacy team at privacy@flmnt.ai.

2. Information we collect

• Account data — email, display name, locale, timezone, MFA preferences, and login history.
• Workspace content — streams, events, keyframes, decisions, and any text or data you ingest.
• Operational & device data — IP address, browser/user-agent and device information, request logs, and error reports.
• Cookies — a strictly-necessary authentication cookie that keeps you signed in (see §6). We do not use advertising or cross-site tracking cookies.
• Information from identity providers — if you sign in through a third-party identity provider, we receive basic profile information (such as your email and name) from that provider.
• Inferences — limited derived data (e.g., approximate location from IP) used to operate and secure the Service.

For California (CCPA/CPRA) purposes, these correspond to the statutory categories: identifiers; customer records; commercial information; internet/network activity; approximate geolocation; and the contents of communications and files you provide. Sources are you, your devices, and any identity provider you choose. We do not collect sensitive personal information for the purpose of inferring characteristics.

3. How we use your information

• To operate the Service — store, index, and retrieve your workspace content.
• To secure your account — detect and prevent abuse, enforce MFA, and manage sessions.
• To answer your questions — when you invoke ask, your prompt and the relevant retrieved context are sent to the AI inference provider you configure under your own API key (a “bring your own key” model) to generate a response. You choose the provider and model. We do not currently use your workspace content to train models; if that ever changes, we will update this policy and notify you before it takes effect.
• To communicate with you — service, security, and transactional messages.
• To comply with law and enforce our agreements.

4. Who receives your information

We disclose personal information only to the categories of recipients below, each for a limited business purpose. To protect the integrity of the Service, we describe recipients by category rather than naming individual vendors. Every processor is bound by a written agreement that prohibits using your data for its own purposes.

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months. If that ever changes, this section will be updated before the change takes effect and you will be notified by email.

5. Where we operate

The Service is currently offered only to users in the United States, and we store and process personal information in the United States. We do not target or knowingly offer the Service to individuals in the EEA, the UK, or other regions outside the United States.

6. Cookies & similar technologies

We use a single strictly-necessary cookie to store your authenticated session so you stay signed in. We do not use analytics, advertising, or cross-site tracking cookies, and we honor the Global Privacy Control signal (see §8). Because our cookie is essential to providing the Service, it cannot be disabled without signing out.

7. Your rights

Under the CCPA/CPRA and other U.S. state privacy laws, you have the right to:

• Know & access the personal information we hold about you (§1798.110 CCPA).
• Export it in a portable format (§1798.130 CCPA).
• Correct inaccurate information (§1798.106 CCPA).
• Delete it (§1798.105 CCPA).
• Opt out of any sale or sharing for cross-context behavioral advertising (§1798.120 CCPA).
• Withdraw consent where processing is based on consent, without affecting prior processing.
• Non-discrimination for exercising any of these rights (§1798.125 CCPA).
• Complain to the California Privacy Protection Agency or California Attorney General (or your state regulator).

Exercise these rights from your privacy settings page. In-product requests are logged, machine-verified against your authenticated identity, and (where relevant) confirmed by email. You may use an authorized agent where the law permits; we may need to verify your identity first.

8. Global Privacy Control

We honor the Global Privacy Control (Sec-GPC: 1) signal. If your browser sends it on a request to this site, we treat it as a verified opt-out of sale and share for that authenticated user. Verification appears immediately on your privacy settings page.

9. Data sharing audit (opt-in)

You can opt in to record every outbound use of your data through a classified channel — including allowed and blocked attempts. Recording is off by default and only begins after you enable it on your privacy settings page; nothing is logged retroactively. Once enabled, the most recent 20 entries are shown on that page and the full audit history is available on request.

10. Security

We protect your information with encryption in transit (TLS) and at rest, optional multi-factor authentication, least-privilege access controls, network isolation, and ongoing monitoring. No method of transmission or storage is 100% secure, but we work to protect your information and to notify you and regulators of incidents as required by law.

11. Retention

• Workspace content: retained until you delete it or delete your account.
• Account + login history: retained for the life of the account plus 30 days.
• Audit + security logs: retained for 1 year.
• After deletion, residual copies in encrypted backups are purged within 90 days.

12. Automated decision-making

We do not use your personal information to make decisions that produce legal or similarly significant effects without human involvement. Answers from the ask feature are generated by the AI provider you configure, at your request, and are not used by us to evaluate or profile you.

13. Age requirement

You must be at least 18 years old at the time of registration to use the Service. The Service is not directed to anyone under 18, and we do not knowingly collect their personal information. If we learn that we have collected information from a person under 18, we will delete it.

14. Third-party links

The Service may link to third-party websites or services we do not control. This policy does not apply to them; please review their privacy policies.

15. Changes

Substantive changes to this policy are announced by email and on this page at least 14 days before they take effect. Editorial corrections (typos, clarification) may be made without notice. The effective date at the top of this page is always current.

16. Contact & governing law

Questions, complaints, or requests under any privacy law: privacy@flmnt.ai, or by mail to Flmnt LLC, 27790 Starfall Way, Murrieta, CA 92563, USA. This policy and any dispute relating to it are governed by the laws of the State of California, without regard to its conflict-of-laws rules.