Privacy Policy

1. Scope

This Privacy Policy applies to Anie - the enterprise AI agent governance platform operated by Lets Flo Limited - including the anie.io website, the Anie admin console, any mobile or desktop applications, and other interactions with us as a customer or authorised user.

By using the services or visiting our websites, you accept the privacy practices described here. If you disagree with them, please stop using the services. The services are not intended for children under 16, and we do not knowingly collect information from minors.

This Privacy Policy does not apply when we process data on behalf of a customer as a data processor - for example, when a customer's users interact with agents governed through their Anie deployment. In those cases, the customer's agreement with us (the Customer Terms and Data Processing Agreement) governs that processing, and the customer controls their own data. For questions about a specific deployment, contact the administrator of that deployment.

2. Data Controller

Under UK and EU data protection laws, the data controller is Lets Flo Limited, Kemp House, City Road, London EC1V 2NX, England.

3. Legal Basis for Processing

We rely on the following lawful bases:

• Performance of a contract with you or your organisation
• Legitimate interests necessary for business operations, security, and product improvement
• Legal obligations requiring us to use your data
• Your prior consent for purposes where consent is the appropriate basis

4. Information We Collect

We collect the following categories of personal data:

Account and Deployment Information

Identity data (name, email, phone), profile data (password, role, organisation), financial data (payment details for paid plans), and contact data (billing address, phone).

Usage Information

Transaction data showing how users interact with the platform, agents, tools, policies, and channels; technical data including IP address, browser type, timestamps, and cookie data; device data including operating system and device identifiers; approximate location data derived from business addresses or IP addresses; and aggregated statistical data that doesn't identify individuals.

Third-Party Service Data

When you connect third-party tools (e.g., Slack, Microsoft Teams, Salesforce, identity providers), those services may share usernames, email addresses, OAuth tokens, and other information needed for the integration. Passwords are never stored.

Marketing and Communication Preferences

Your preferences regarding marketing communications and how you'd like to be contacted.

Information from Other Sources

Data we receive from corporate affiliates, partners, or vendors about organisations, industries, and marketing performance.

Support and Community Interactions

Data you submit through support requests, sales conversations, onboarding calls, job applications, or social media interactions.

Generally, no statutory obligation requires you to provide your data, but certain information (e.g., deployment setup details) is required for us to provide the service.

5. Cookies and Similar Technologies

We use cookies, pixel tags, and web beacons to operate the website and understand how it's used. Pixel tags track page views and email opens; web beacons measure campaign effectiveness without carrying personal data. We respect Do Not Track browser settings.

6. How We Use Your Information

We process personal data on the legal bases above to:

• Provide and improve the Anie services
• Secure the platform and detect fraud or abuse
• Understand how customers use the product and where it can be improved
• Conduct research and measure marketing performance
• Meet our legal, regulatory, and contractual obligations

We do not sell or rent your personal data to anyone.

We use your data only for the original purposes we collected it for, or purposes reasonably compatible with those. Processing may occur without your knowledge or consent where required by law.

7. Information Sharing and Disclosure

We share your information:

• According to customer instructions and applicable agreements
• With other authorised users in the same deployment, where the product surfaces that data (e.g., audit logs, admin views)
• With customer administrators who have governance responsibility
• With third-party service providers listed in our Sub-Processor List (see section 14)
• With third-party services you choose to connect to your deployment
• With corporate affiliates and subsidiaries of Lets Flo Limited
• With professional advisors (lawyers, accountants, auditors, insurers)
• With tax authorities and regulators when required
• During business changes (mergers, acquisitions, asset sales)
• In aggregated or anonymised form
• When required by law, legal process, or to enforce our rights and prevent harm
• With your consent (for corporate deployments, this comes from the primary owner; for individual accounts, from you directly)

All third-party service providers are bound by contract to respect data security and process information only as instructed.

8. Data Retention

We retain personal data only as long as reasonably necessary for the original purposes, legal compliance, or regulatory requirements.

Under UK law, basic customer information (contact, identity, financial, and transaction data) must be retained for 6 years after the customer relationship ends, for tax purposes.

Retention continues while your account remains open or as specified in the relevant contract. After account closure, data may be anonymised for research or statistical purposes without further notice.

Customers can configure retention policies inside the product at the deployment, channel, tool, or object level. Deleting customer-controlled content may also delete or de-identify associated personal data.

9. Data Security

We take the security of your data seriously. We apply appropriate technical and organisational measures to prevent unauthorised access, loss, misuse, or disclosure:

• Data is stored on secure infrastructure, with single-tenant deployments isolated at the database level
• Payment details are encrypted in transit using TLS
• Access is limited to employees and contractors with a business need, under confidentiality obligations
• We maintain documented procedures for personal data breaches, including notification to users and regulators where legally required

You are responsible for keeping your login credentials confidential. We cannot guarantee absolute protection against internet-based intrusions during transmission or storage.

10. Third-Party Links

Our websites and services contain links to partner networks, advertisers, integrations, and affiliates. Those third-party sites have their own privacy policies. We are not responsible for their practices.

11. Age Limitations

The services and websites are not permitted for anyone under 16 years old. If you believe a minor has given us personal data, please contact us and we will delete it.

12. International Data Transfers

Your information may be stored and processed globally, wherever Lets Flo Limited operates or engages sub-processors. Transfers within our group may involve moving personal data to offices outside the UK or EEA (including the USA).

For UK, EU, or Swiss personal data transferred to countries without equivalent protection, we rely on one or more of the following safeguards:

UK Personal Data

• Transfer to countries the Information Commissioner's Office deems adequate, or
• Standard contractual terms approved by the ICO (e.g., International Data Transfer Addendum), or
• US entities certified under the UK Extension to the EU-U.S. Data Privacy Framework, or
• Other ICO-approved transfer mechanisms

EU Personal Data

• Transfer to countries the European Commission deems adequate, or
• Standard Contractual Clauses approved by the EU, or
• US entities certified under the EU-U.S. Data Privacy Framework, or
• Other Commission-approved transfer mechanisms

Swiss Personal Data

• Transfer to countries the Swiss Federal Data Protection and Information Commissioner deems adequate, or
• Standard contractual clauses approved by Switzerland, or
• US entities certified under the Swiss-U.S. Data Privacy Framework, or
• Other FDPIC-approved transfer mechanisms

Contact us for copies of the contractual safeguards we apply.

13. Your Legal Rights

Under applicable data protection law, you have the right to:

• Access the personal data we hold about you
• Correct incomplete or inaccurate data (we may ask for verification)
• Erase your data in certain circumstances, for example where processing is unlawful or where you've exercised the right to object (legal reasons may prevent deletion)
• Restrict processing while we verify accuracy, where use is unlawful but you don't want deletion, where you need the data for legal claims, or where you've objected pending verification
• Object to processing based on legitimate interests, including profiling
• Data portability in a structured, commonly used, machine-readable format (for automated data you provided with consent or under a contract)
• Object to direct marketing at any time
• Withdraw consent where consent is the legal basis (doesn't affect prior lawful processing)

Send requests to the contact details in section 16. We respond within 30 days, though complex requests may take longer - we'll notify you if so.

There's no fee for access requests or exercising other rights, though unreasonably repetitive or excessive requests may incur a fee or be refused. We may ask for identity verification to prevent unauthorised disclosure.

14. Sub-Processors

We engage the following third-party service providers to deliver the Anie service. Each is bound by contract to protect your data and process it only as instructed.

15. Marketing Communications

We use identity, contact, technical, usage, and profile data to decide what marketing is relevant to you. We send marketing emails if you opted in during registration, or after a service inquiry or purchase (unless you've opted out).

Before we share your personal data with third parties for their own direct marketing, we obtain your express consent.

You can opt out any time by clicking "unsubscribe" in any marketing email. Service-related communications (orders, billing, product updates, support) continue after opting out of marketing.

Push notifications about product updates, events, and promotions can be disabled in your device settings.

16. Complaints and Contact

We aim to meet the highest standards for data collection and use. If you think we've handled your data unfairly, please tell us first so we can fix it.

Email: privacy@anie.io
Post: Lets Flo Limited, Kemp House, City Road, London EC1V 2NX, England

You may also complain to your local data protection authority:

• UK: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Phone: 0303 123 1113.
• EU representative: Data Rep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Email: contact@datarep.uk

17. Changes to This Policy

We may update this Privacy Policy as laws, standards, and our services evolve. Changes are posted on this page. Material changes will be notified by email or in-product notification.

If you disagree with a change, you can deactivate your account. For personal data held under a customer's deployment, contact that customer directly to have your data removed.

18. Your Duty to Keep Information Current

Please keep your personal data accurate and up to date. Let us know during your relationship with us if your contact details change.