Privacy policy

This policy explains how we process your personal data when you visit moflet.ai, request a demo, subscribe to our communications, or use the Moflet AI platform (chat, agents, connectors, credentials, and the rest of the modules), or when we contact you as a professional at a company that may be interested in our services.

1. Controller

Data controller: Moflet AI S.L. (trade name: Moflet AI).

NIF: B73210072

Address: Paseo de la Castellana, 91, 28046 Madrid

Privacy contact: [email protected]

We are not required to appoint a Data Protection Officer. For any privacy matter, write to [email protected].

Data your organisation processes on the platform. If you access as a member of an organisation, that organisation is normally the controller of the data it puts into its tenant, and Moflet AI processes it as a processor to provide the service, under the contract with your organisation and, where one exists, a data processing agreement (DPA). Moflet AI is the controller of account data, billing, service security, web/newsletter marketing, B2B sales prospecting, and the logs needed to operate the platform.

2. What data we process

If you visit the website or contact us

• Demo or contact request: name, email, company, and the message you send us.
• Communications subscription: email and language, the signup channel and page, UTM parameters, and proof of your consent (accepted text, date, and form).
• Use of our emails and website: opens and clicks on the newsletter, if you subscribe (part of your newsletter consent); pages visited and visit source (for example, UTM parameters), only if you accept analytics cookies (see the Cookie policy).

If you use the platform

• Identity and session: subject, name or email from the identity provider (Zitadel or another IdP configured by the operator), tenant, roles, and access token.
• Platform use: agents, connectors, invitations, runs, steps, and messages you send to the assistant.
• Operational secrets: credentials you store for connectors or models. We treat them as confidential tenant data and they do not enter the model context.

We do not sell personal data or share it with third parties for commercial purposes.

3. Why we use it and on what legal basis

If you are already a customer of Moflet AI S.L., we may use the email address you gave us when you contracted with us to send you commercial communications about Moflet AI products or services similar to those you have contracted. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR and Art. 21.2 LSSI). You can object to receiving them at any time, simply and free of charge: when we collect your data, via the unsubscribe link included in every email, or by writing to [email protected]. If you subscribe to the newsletter or request a demo on our website without being a customer, through that route we only send you commercial communications if you give us your consent, as described above.

B2B sales prospecting. If you work at a company in one of the sectors we target, we may process your professional contact details to get in touch and present Moflet AI's services. The controller is Moflet AI S.L. (details in section 1). We process your name, role, company, work email, work phone if available, and the URL of your public professional profile (for example, LinkedIn). We obtain them from publicly accessible professional sources (your company's website, LinkedIn, press releases and industry media) and from professional email search and verification tools such as Hunter.io (Hunter Web Services, Inc.), which is an independent controller of its own database and may infer your email from the format your company uses. The legal basis is our legitimate interest in presenting our services to other businesses (Art. 6(1)(f) and Recital 47 GDPR). We use HubSpot (CRM), Google Workspace (email) and Hunter.io (email verification and contact lists we keep in our account) as data processors; if any of them involves transfers outside the EEA, we apply appropriate safeguards (adequacy decision, EU-US Data Privacy Framework and/or standard contractual clauses). We keep this data for 12 months from when we obtain it if you do not reply, or until you object. You can object at any time by replying to our email or writing to [email protected]: we will stop contacting you and keep your email on a suppression list for 3 years so we do not write to you again. You can also exercise the other rights in section 6 and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). We give you this information at first contact and, in any case, within one month of obtaining your data.

4. How long we keep it

• Platform: while your account or tenant is active, and afterwards for as long as needed for legal obligations, security, or incident resolution.
• Demo or contact requests: 12 months from the last contact if there is no commercial relationship.
• Newsletter and communications: until you unsubscribe or withdraw consent. Afterwards we keep proof of consent and of the unsubscribe, blocked, for 3 years so we can evidence them if there is a claim, and we keep your email on a suppression list so we do not write to you again.
• Customer communications: while you are a customer and until you object. When you cease to be a customer we stop sending them. Proof of the objection is kept for 3 years on a suppression list.
• B2B sales prospecting: 12 months from when we obtain your data if you do not reply, or until you object. Proof of the objection is kept for 3 years on a suppression list.
• Website measurement data (cookies): the retention periods in the Cookie policy.

5. Who we share it with

These providers process data on our behalf (processors), under contract and only on our instructions:

• HubSpot: CRM, forms, newsletter sending, and measurement. Data is hosted in its EU data centre (EU1).
• Google Workspace: sending/receiving demo-request and sales-prospecting emails in our mailbox.
• Hunter.io (Hunter Web Services, Inc., USA; servers in Belgium): professional email verification and management of the contact lists we keep in our account, for B2B sales prospecting. For information from its own database that we use as a source, Hunter is an independent controller. Transfers to the USA rely on standard contractual clauses.
• OVH Cloud: hosting of the website and the platform.
• Identity: Zitadel or another IdP configured by the operator.
• Platform deployment infrastructure: database, authorisation, and models/LLMs according to your tenant configuration.

International transfers: Some processors may involve transfers outside the EEA. In that case we apply appropriate safeguards (adequacy decision, EU-US Data Privacy Framework and/or standard contractual clauses).

If an agent or connector calls an external service that you configure, the data you send goes to that destination under your responsibility. The customer is responsible for the content (including third-party data) it puts into its tenant.

6. Your rights

You can ask us for access, rectification, erasure, objection, restriction of processing, and portability of your data by writing to [email protected]. We may ask you to prove your identity.

• Communications: you can object or unsubscribe at any time via the link at the foot of each email, or by writing to us. Withdrawing consent does not affect sends already made.
• Platform data: if your organisation is the controller, we handle your request through your tenant administrator.
• Complaint: if you believe we have not processed your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Cookies

We use technical session cookies, necessary for the platform to work. Only if you accept them do we also use measurement cookies (e.g. HubSpot) to measure website use and know which channel contacts come from. Detail and settings in the Cookie policy.

8. Changes to this policy

If we change this policy, we will update the date above. If the change is material, we will notify by email anyone who has a relationship with us.

Details in the cookie policy.