Get the app

Privacy policy

Flowers processes the data needed to run the app: your account, your projects, your videos and their analyses. We do not sell your data, and your videos are not used to train any AI model. The marketing website collects no personal data and sets no cookies. This policy details each processing activity and your rights under the GDPR.

Current version · Last updated: October 21, 2026

Data controller

The data controller is AVEC TROIS E, a French société par actions simplifiée, 47 quai Carnot, 92210 Saint-Cloud, France, registered with the Nanterre Trade and Companies Register under number 914 595 657, represented by its president, Alexendre Obli.

For any question about your data or to exercise your rights: contact@getflowers.app, or by post to the address above. We have not appointed a data protection officer; the president is the point of contact for these matters.

Data we process

Account and sign-in

  • Email sign-in: your email address and a six-digit one-time code, valid for five minutes, that we send you by email. The code is stored only in protected form (a fingerprint computed with a secret key), then consumed.
  • Sign in with Apple or Google, if you choose it: the identifier the service assigns you for Flowers, the email address it shares (for Apple, possibly a relay address) and, if you agree, your name.
  • Display name, language, time zone and notification preferences, account creation date.
  • Sessions: a session identifier stored on our server and a token stored in your phone’s secure storage (Keychain or Keystore).

Creator profile and editorial memory

  • What you declare: topics, goals, formats, tone, constraints (for example creating without showing your face).
  • The preferences Flowers suggests based on what you declared. They remain suggestions until you confirm them, and you can edit, reject or revoke them at any time.

Imported and created content

  • Videos and other media you import, and their derived files: thumbnails, extracted frames, audio track, playback version.
  • Projects, briefs, concepts, scripts and their versions, shooting plans, tasks in your plan, collections, followed creators and adapted inspirations.
  • Analyses produced from your content: timestamped transcripts, observations, interpretations and suggestions.
  • Conversations with the AI coach and the suggested actions you confirmed or rejected.

Connected social accounts (optional, coming soon)

When connecting TikTok, Instagram or YouTube becomes available, and only if you authorise it, we will process: the access tokens issued by the platform, the profile information and list of your posts it makes available, the metrics of your posts it provides (views, likes, comments, depending on the permissions granted) and the status of each post sent or scheduled from Flowers.

Subscription

The subscription is sold and collected by Apple (App Store) or Google (Google Play). We only receive the information needed to open your access: purchase identifier, product, period start and end dates, renewal, status (active, expired, revoked, refunded). We never receive your payment card details.

Support and notifications

The content of your help requests and any information you choose to include; the notifications shown in your Flowers inbox (for example “concepts ready” or “coach replied”).

Technical and security data

Technical logs (date and time, IP address, device type, app and OS version, technical identifiers, errors) and security events (sign-in attempts, code sending limits), used to run the service, diagnose incidents and prevent abuse.

  • Creating and managing your account, signing you in, providing the features (ideas, idea tests, scripts, video analysis, coach, plan, export and deletion): performance of the contract (Article 6(1)(b) GDPR).
  • Opening and verifying subscription access from the information sent by the stores: performance of the contract.
  • Connecting your social accounts, publishing on your behalf after your approval and retrieving your results, once available: consent (Article 6(1)(a)), which you can withdraw at any time by disconnecting the account in the app or in the platform’s settings.
  • Sending push notifications, once available: consent, collected by your phone’s operating system and revocable in its settings.
  • Answering your support requests: performance of the contract.
  • Securing the service, preventing fraud and abuse, diagnosing errors: legitimate interest (Article 6(1)(f)) in protecting the service and its users.
  • Building Discover’s library of public references (see below): legitimate interest in analysing publicly published content to help creators understand formats.
  • Producing aggregate statistics and editorial insights from public metadata of TikTok posts (see below): legitimate interest.
  • Meeting our accounting, tax and legal obligations, and responding to requests from authorities: legal obligation (Article 6(1)(c)).

Artificial intelligence

To analyse your videos and draft suggestions, Flowers sends the AI providers below only what the requested task needs: depending on the case, frames extracted from the video, its audio track or transcript, the relevant texts (brief, concept, script) and the creator profile context you confirmed.

  • OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland: transcription of the audio track of your videos (whisper-1 model).
  • Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland: analysis of frames extracted from your videos and of texts, generation of concepts, advice and coach replies.

These providers act as processors. Used through their API, they do not use this data to train their models, and we have not enabled any data-sharing option. They may retain requests for up to 30 days to detect abuse, unless required by law or in case of a breach of their usage policies.

  • Neither Flowers nor its providers use your videos to train models, and no fine-tuning is performed on your content.
  • The preferences Flowers suggests are visible, editable and revocable in the app.
  • No decision producing legal effects concerning you or similarly significantly affecting you is based solely on automated processing.

The AI transparency page details where AI is used and its limits.

Recipients and processors

Your data is accessible only to authorised staff of AVEC TROIS E, as their duties require; administrative access is protected by two-factor authentication. It is entrusted to the following processors, bound by a contract compliant with Article 28 GDPR:

  • Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States: delivery of the website and the admin interface, DNS and firewall, and private object storage for your media and exports (Cloudflare R2, European Union jurisdiction).
  • Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, United States: hosting of the API, background processing and job queue (Redis). Deployment region: European Union (Amsterdam, Netherlands).
  • Databricks, Inc. (Neon service, with its subsidiary Neon, LLC), 160 Spear Street, Suite 1300, San Francisco, CA 94105, United States: hosting of the PostgreSQL database on Amazon Web Services infrastructure, Europe region (Frankfurt, Germany).
  • Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, United States: sending sign-in and service emails.
  • OpenAI Ireland Limited and Anthropic Ireland, Limited: the artificial intelligence processing described above.

Some recipients act on their own behalf and under their own privacy policy: Apple Distribution International Ltd (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) for the App Store, Google Commerce Limited (70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland) for Google Play, Apple and Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for signing in with their accounts, and, once you publish through Flowers, the platform you choose, which will receive the content you approved.

We do not sell or rent your data to anyone. It may be disclosed to authorities where the law requires it.

Transfers outside the European Union

Some processing may take place outside the European Union, in particular in the United States: requests served by Cloudflare’s global network and its technical logs, Railway’s technical logs, operations and support access by Databricks for the Neon service, email delivery by Resend, and AI processing, which the Irish entities of OpenAI and Anthropic may entrust to their US companies. These transfers are covered by the European Commission’s adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework) for certified companies (Cloudflare, Railway, Databricks and Neon, Resend), and by the standard contractual clauses adopted by the European Commission (Decision 2021/914) included in our providers’ data processing agreements. You can obtain a copy of these safeguards by writing to contact@getflowers.app.

Discover: public content from third-party creators

To illustrate formats and explain why a piece of content works, Flowers builds a library of references from publicly published content. If you are a creator whose public content appears in it, this section informs you in accordance with Article 14 GDPR.

  • Data: public name or handle, channel or account address, content address, public metadata (title, description, publication date, duration, public statistics, public chapters or captions) and the editorial analysis we derive from it (format, structure, type of hook).
  • Sources: the YouTube API Services (public metadata), references cited through a link to their original page, licensed public datasets (for example YouTube-Commons, CC-BY) and references added by our team.
  • Legal basis: the legitimate interest of AVEC TROIS E in analysing content its authors made public. We exclude private accounts and do not seek any sensitive data.
  • Display: Flowers does not store or rehost any third-party video. A video is only shown through the platform’s official embedded player (for example the YouTube player), which streams it directly from the platform; otherwise it is only cited through a link.
  • Retention: metadata from the YouTube API Services is refreshed or deleted no later than 30 days after it is obtained; other references are kept as long as they remain public and relevant, and removed as soon as we learn they were deleted.
  • Rights: you can object to this processing at any time, and request access or erasure, by writing to contact@getflowers.app with the link to your account. We then remove your content from the library and its indexes.

Public reference data on TikTok posts

To produce aggregate statistics and editorial insights (formats, patterns, trends), Flowers analyses public metadata of TikTok posts from third-party datasets. If you post on TikTok, this section informs you in accordance with Article 14 GDPR.

  • Data: post identifier, caption, hashtags, music used, duration, publication date, country and language given by the platform, and public counters (views, likes, comments, shares) recorded at a given date. No author name and no video, image or sound is imported.
  • Minimisation: before import, we remove mentioned accounts, as well as email addresses, phone numbers and @handles found in captions. Posts we can establish concern a minor are excluded. The post identifier makes it possible to find the post on TikTok, so we treat it as pseudonymous personal data.
  • Sources: the public dataset “TikTok Videos (5.6 billion)” published by datasocial on Hugging Face under the CC BY-NC 4.0 licence and, where applicable, a data provider bound to us by contract. This data was not collected by Flowers.
  • Use: aggregate statistical calculations and editorial insights only. A post is never redisplayed, shown individually to users or linked to a named creator. The CC BY-NC dataset is used for analysis and research purposes, within the limits of its licence.
  • Legal basis: the legitimate interest of AVEC TROIS E (Article 6(1)(f) GDPR) in understanding short-video formats from posts made public, balanced against your interests through the measures above.
  • Retention: each post’s metadata is kept for at most 12 months after import; only aggregate results, which do not identify you, are kept beyond that.
  • Rights: you can object to this processing at any time, and request access or erasure, by writing to contact@getflowers.app with the link or identifier of the post or of your account. We then delete the corresponding data and exclude it from future imports. You can also complain to the CNIL.

YouTube API Services

Flowers uses the YouTube API Services. By using the features that rely on them, you agree to the YouTube Terms of Service (youtube.com/t/terms). The data concerned is also subject to the Google Privacy Policy (policies.google.com/privacy). YouTube videos are played with YouTube’s official embedded player. If you connect your YouTube account in the future, you will be able to revoke Flowers’ access from your Google Account permissions page (myaccount.google.com/permissions).

Retention periods

  • Account, profile, memory, projects and content: as long as your account is active.
  • Account deletion: your access is cut off as soon as you request it, then the account data is purged 7 days later, including media, derived files, indexes and caches. Only opaque technical identifiers, with no content or email address, are kept to trace operations.
  • Data export: the archive remains available for 7 days, then it is deleted.
  • Sign-in code: 5 minutes. Session: 7 days, renewed while you use the app.
  • Purchase information sent by the stores: for the duration of the subscription, then 5 years as evidence, kept separately with restricted access; accounting records are kept for 10 years.
  • Support requests: until your account is deleted, and at most 3 years after the last request.
  • Hosts’ technical logs: at most 30 days. App security logs: at most 12 months.
  • Data sent to AI providers: at most 30 days with those providers, unless required by law or in case of a breach of their usage policies.
  • Public metadata of TikTok posts: at most 12 months after import; only aggregate results are kept beyond that.

Security

Communications are encrypted (HTTPS). Your media and export archives are kept in private storage that is not publicly accessible; they are accessed through temporary links that expire after a few minutes. Sign-in codes are limited in attempts and sends, session tokens are kept in your phone’s secure storage, and internal access is limited to the people who need it, with two-factor authentication for administration.

Your rights

Under the GDPR and the French Data Protection Act, you have the following rights:

  • Access: obtain confirmation that your data is processed and receive a copy.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: have your data deleted, within the limits set by law.
  • Restriction: ask for processing to be temporarily frozen.
  • Objection: object to processing based on legitimate interest.
  • Portability: receive the data you provided in a structured, machine-readable format (the in-app export is a JSON file).
  • Withdrawal of consent: at any time, without affecting processing already carried out.
  • Post-mortem instructions: decide what happens to your data after your death.

Exercising your rights

  • In the app: open your profile (tap your avatar), then the data screen to request an export or account deletion; your editorial memory and preferences can be edited from your profile.
  • By email to contact@getflowers.app, from the address linked to your account. If there is doubt about your identity, we may ask for additional information.

We reply within one month of receiving the request, which may be extended by two months for complex requests; in that case, we will let you know.

Complaints

If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr, or with the data protection authority of your country of residence.

Minors

Flowers is reserved for people aged 15 or over. In France, a minor can consent alone to the processing of their data for an online service from the age of 15. If you are under 18, the subscription must be purchased with the agreement of your legal guardian, for example through your store’s family sharing. If you learn that a child under 15 has sent us data, write to us so that we can delete it.

Marketing website

The Flowers marketing website sets no cookies, uses no trackers or audience measurement tools and contains no forms. Its fonts are served from the website itself, without calling any third-party service. The interactive demo runs entirely in your browser: nothing you type is saved or sent. Only the technical logs of our host Cloudflare are generated, as for any website (see the cookie policy).

Changes to this policy

We may change this policy to reflect changes to the service, our providers or the law. If there is a significant change, you will be informed in the app or by email before it takes effect. The date of the last update is shown at the top of this page.