Privacy policy
Updated: October 26, 2026
Data controller
The Last Commit, 11 rue du Fer à Cheval, 78120 Rambouillet. For any question about your data: contact@floweet.com.
Data collected
When you create a free workspace: your email address, your name, your company, your profile (fleet, sales rep, network, station, business) and the figures entered on the site (fleet breakdown, brand, prospect, network, station and operator's SIRET, business activity), as well as a passwordless login account. When you send a request or subscribe to news updates: your email address and, depending on the form, your name, your company and your message. We also keep a non-reversible fingerprint of your IP address to combat abuse. No data is collected when you simply browse the site, except for audience measurement you have accepted. When you use the application: your account (email address, first name, last name and, if you provide them, phone number, job title and photo), your organization, its members and invitations, and what you enter in it (followed companies, lists, notes, meetings, simulations, prospects, pitches). If you sign in with Google, Google sends us your Google identifier, your email address, your name and your profile picture. If your organization uses the public API: the technical contact's email address, the intended use and a log of calls (route, status, duration, without IP address or content); API keys are only kept as a hash. Finally, for security purposes, our servers keep a technical log of requests, including IP addresses.
Purposes and legal bases
Creating and operating your workspace, your account and the application, and signing you in with a code or with Google (performance of the contract or of the service you request); writing a pitch with AI when you ask for one (performance of the contract); responding to your requests (pre-contractual measures); sending you news updates if you have asked for them (consent); protecting the site and the application against abuse and diagnosing errors (legitimate interest); measuring audience, only with your agreement (consent).
Retention periods
Account, organization and what you enter in them: as long as they exist, then deletion on simple request, handled within one month. Free workspace: the same. Sign-in code: 15 minutes. Requests sent from the site: 3 years after our last exchange, then automatic deletion. Requests for access to the application: 3 years after our last exchange. News subscription: until you unsubscribe. Proof of your audience measurement choices: 13 months. Audience measurement data: 14 months in Google Analytics. API call log: 12 months. Technical server log: 14 days.
Recipients
The Floweet team at The Last Commit, the members of your organization for what you share with them, and our technical service providers: Vercel (hosting of the website and the application), Scaleway (servers and database in France), Cloudflare (domain names and routing of requests to our servers), Brevo (email sending, including sign-in codes), Google LLC for signing in with Google (if you choose it) and for the Gemini API (writing pitches), Google Ireland Ltd for Firebase Analytics (audience measurement, with your agreement). A simulation you share by link can be read by anyone who receives the link. Your data is neither sold nor rented. To monitor the activity of the service, an internal control screen of the team shows the latest accounts created and the latest active accounts: display name, email and date. This information is not stored by the screen, which refreshes every minute.
Transfers outside the European Union
Vercel, Google and Cloudflare may process data in the United States. These transfers are governed by the EU–US Data Privacy Framework and the standard contractual clauses of the European Commission.
Pitches written by AI
When you ask for a pitch and your plan includes AI, the facts of the simulation are sent to Google's Gemini API to produce the text: name and sector of the prospect company, SIREN number, area, coverage, stations and fuels and, if you entered them, the name and job title of your contact person. Your notes are never sent. Without AI, the pitch is written from a template, on our servers.
Signing in to the application
The application only places the cookies needed for your session (sign-in tokens), which do not require consent and are deleted when you sign out. The sign-in code is sent by email by Brevo; signing in with Google is only used if you choose it, and only asks Google for your email address and profile.
Company directory
The application and the public API reuse the INSEE SIRENE database (public data). If you are a sole trader, your name and the address of your establishment may appear in it. You can object to their reuse by Floweet by writing to contact@floweet.com, and ask INSEE for partial disclosure of your data.
Cookies and audience measurement
The site does not place any advertising cookies. Audience measurement (Google Analytics for Firebase) is only loaded after your agreement, and you can withdraw this agreement at any time via the "Manage cookies" link at the bottom of the page. Your choice is kept in your browser.
Your rights
You have the right of access, rectification, erasure, objection and restriction, the right to portability of the data you provided to us, as well as the right to withdraw your consent. Write to contact@floweet.com: we reply within one month. You may also lodge a complaint with the CNIL (cnil.fr).