This Privacy Policy explains how Flourish Public Benefit LLC ("Flourish", "we", "us") collects, uses and shares information when you use our website, the Flourish Dashboard, Greenhouse, our AI agents, our Salesforce applications and our other products and services (together, the "Services"). It also covers people who use an agent, web app or form that one of our customers has opened to the public. Our Terms of Service govern the use of the Services, and our Data Processing Addendum governs the information we process for the organizations we serve.
Many of our Services are provided to organizations, such as nonprofits and public agencies, for use by their staff, members or clients. When we provide the Services to an organization, that organization decides what information is collected and how it is used, and we process that information on its behalf under our agreement with it. If you use the Services through an organization, please contact that organization with questions about its use of your information.
Information we collect
Information you give us. This includes your name, email address, organization and role when you sign up, are invited or contact us, and the messages, files and other content you send to our agents or enter in our Services.
Accounts you connect. Some Services let you connect an account you hold with another service, such as Microsoft 365, Google Workspace or Salesforce, so that agents and products you choose can work in it for you. When you connect an account, that service gives us an authorization to act on your behalf and basic information that identifies the account, such as its name and email address. For some services you give us an API key instead.
Information from accounts you connect. When you, or your organization, set an agent or product to use a connected account, it reads or changes information in that account only as needed to do what was asked, for example reading a document, looking up a record or sending an email you asked it to send.
Usage and technical information. We keep logs of how the Services are used, such as requests made, errors and usage counts for billing, along with technical information like browser type and IP address. We use cookies and similar browser storage to keep you signed in and remember your settings. Our website does not use advertising cookies.
How we use information
- To provide and operate the Services, and to do what you or your organization ask of them.
- To keep the Services secure, fix problems and improve them.
- To help keep people safe. Some Services use AI to check what people write for signs that someone may be in danger, so they can be pointed to help and, where the organization providing the Service has turned it on, so a person it has named can be told. That person is told who and why, never what was written.
- To bill for the Services and to communicate with you about them.
- To comply with the law and enforce our agreements.
We do not sell personal information or share it for targeted advertising. We do not use information from your connected accounts for advertising, and we do not use it to train AI models.
AI processing
Our agents use AI models from third-party providers, such as Anthropic's Claude models through Amazon Web Services, to read and respond to messages and content. These providers act as our service providers. We make commercially reasonable efforts to use only providers whose terms do not allow them to train their models on that content, and we never allow it ourselves. Agents may keep notes from your conversations so they can help you later; where a Service shows you what it remembers, you can correct or delete it. If your organization chooses to use its own account with an AI provider, content is sent to that provider under your organization's agreement with it.
Who can see what you write
Some content in the Services can be opened by people your organization chooses, such as records in its systems, or agents and files it shares with its staff. Your organization decides who can see these.
Other Services keep what you write private from people. In Spark, for example, your journal, check-ins and conversations with the Mediator are not shown to anyone at your organization, or to other members. AI reads them, to respond to you, to remember what helps, and to notice if you may be in danger. People see only what AI draws from many members together, such as themes a group shares, never your words, and only if you allow yours to count. If your group has turned on safety alerts, the person it has named is told who may be in danger and why, never what was written.
Flourish's staff do not read content kept private this way, except where needed to keep a Service working or secure, or where the law requires it.
How we share information
- Service providers who host and run the Services for us, such as Amazon Web Services, Cloudflare and Salesforce, and AI providers as described above, only as needed to provide the Services. We will tell an organization we serve which providers we use for its information, if it asks.
- Your organization, when you use the Services through it, including its administrators where our Services allow them to manage its accounts and connections.
- The services you connect, when an agent or product acts in them at your or your organization's direction.
- For legal reasons, when required by law or to protect the rights, safety or property of Flourish, our users or others.
- In a business transfer, such as a merger or acquisition, subject to this Policy.
Connected accounts
You can disconnect an account at any time on the Connections page of the Flourish Dashboard, and we then delete the authorization we stored for it and, where the other service allows, cancel it there too. You can also remove Flourish's access from the other service's own account settings.
Flourish's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Security
We encrypt information in transit and at rest. The authorizations and keys for connected accounts are encrypted with keys that only the parts of our system that need them can use, and where the other service supports it, the parts of the Services that act in your account receive only short-lived access. Access by our staff is limited to what their work requires. No system is perfectly secure, so we cannot guarantee the security of information.
How long we keep information
We keep information for as long as your account is active or as needed to provide the Services, and after that only as long as needed to comply with the law, resolve disputes and enforce our agreements. We then delete it or make it so it no longer identifies you.
Your choices and rights
You can ask us to access, correct, export or delete your personal information by contacting us below. We may need to confirm your identity first. If we hold your information on behalf of an organization, we will refer your request to that organization. Depending on where you live, you may have additional rights under local law, and we will honor them as that law requires.
Children
The Services are not directed to children under 13, and we do not knowingly collect personal information from them. An organization that gives people under 18 access to the Services is responsible for obtaining any consent the law requires from a parent or guardian.
Where information is processed
Flourish is based in the United States and hosts the Services there. Some of our service providers may process information in other countries.
Changes to this Policy
We may update this Policy from time to time. We will post the new version here and change the date above, and if the changes are significant, we will let you know.
Contact us
Flourish Public Benefit LLC
8409 Hempstead Road, Unit D, Houston, TX 77008
Email: privacy@toflourish.org
Our other terms and policies are in our legal center.