How Fluso
handles your data.

PREM SA

PREM SA ("PREM", "we", "us", "our") is a company incorporated under Swiss law at Contrada di Sassello 5, 6900 Lugano, Switzerland (CHE-371.240.335). We operate Fluso, an AI-powered workplace productivity service.

EU Representative (GDPR Art. 27): PREM AI S.r.l., Via Giuseppe Verdi 6, 70017, Putignano (BA), Italy — designated as PREM SA's EU representative for the purposes of GDPR Art. 27. EU/EEA-based Users and Organizations may contact PREM AI S.r.l. on all matters relating to GDPR compliance, in addition to contacting PREM SA directly. PREM AI S.r.l. does not independently process Integration Content or Account Data as part of the Fluso service.

Data protection contact: privacy@premai.io. Security disclosures: security@premai.io.

What this policy covers

This Privacy Policy applies to all personal data we collect when you register for, connect integrations to, or use the Fluso service (the "Service"). It covers two distinct categories of data:

1. Account Data: information you provide at registration and operational data about your use of the Service. Stored in PREM's EU infrastructure. Described in full below.
2. Integration Content: the content of emails, calendar entries, messages, and other data read from the workplace tools you connect to Fluso. Processed transiently by the AI during each session and not stored by PREM after processing.

Where you are an employee using Fluso under an enterprise account, your employer is the Data Controller and PREM processes your data as Data Processor on your employer's behalf. That relationship is governed by the Fluso Data Processing Agreement (DPA) executed between PREM and your employer.

Where you are an individual subscriber, you are the Data Subject and PREM is the Data Controller for Account Data, and Data Processor for Integration Content processed on your behalf.

Laws this policy complies with

1. Swiss FADP (nDSG): we are established in Switzerland.
2. EU GDPR: our infrastructure is in the EU and we process personal data of EU/EEA residents.
3. GDPR Art. 6 / Art. 9: Fluso processes workplace communications that may incidentally contain special-category data. Our processing is not directed at special-category data, but we recognize the heightened obligations where such data appears in connected content.

Where multiple laws apply, we apply the stricter standard.

Two categories of data

4.1 — Account Data: what PREM stores

The following data is stored in PREM's EU infrastructure for the duration of your account.

4.2 — Integration Content: what Fluso reads but does not store

The following content is read from each connected integration and processed transiently:

Scope of reading: Fluso reads full content from all connected integrations. Within an integration, you cannot currently restrict Fluso to specific folders, channels, or projects — the full scope of the connected service is accessible to the AI. You control which integrations are connected; disconnecting an integration immediately removes Fluso's access to that service.

4.3 — Skills: user-installed third-party extensions

Fluso supports user-installed "Skills" — custom logic and integrations provided by you or third parties that extend Fluso's capabilities. PREM is not responsible for the data practices of Skills you install. When you install a Skill:

1. The Skill may read integration content processed by Fluso and may have its own data storage or transmission practices.
2. You are responsible for reviewing and accepting the terms and privacy practices of any Skill before installation.
3. PREM does not audit or endorse third-party Skills.

Where a Skill is developed by PREM, it is covered by this Privacy Policy. Third-party Skills are subject to their own privacy policies.

Processing activities and legal bases

We do not: use Integration Content to train AI models; use Integration Content for analytics, model improvement, or any secondary purpose — this prohibition extends to anonymized or aggregated patterns derived from Integration Content sessions; store Integration Content after processing; sell your personal data; share your personal information for cross-context behavioral advertising; or serve advertising.

Session memory: Fluso does not retain memory of Integration Content between sessions. Each session starts fresh. PREM does not use content from previous sessions to inform AI responses in future sessions.

Google Workspace data — Limited Use

This commitment governs everything PREM does with data received from Google Workspace integrations — Gmail, Google Calendar, and Google Drive — and applies in addition to the rest of this Privacy Policy. In practice:

• No model training on Google Workspace data. Data received from Google Workspace APIs is never used to develop, improve, or train generalized or non-personalized AI/ML models, whether by PREM or by any sub-processor that participates in providing the integration — including the AI inference providers listed in Section 7. Sub-processors that do not contractually accept this restriction are not used to process Google Workspace data.
• Only for user-facing features. Google Workspace data is used solely to provide or improve user-facing features that are visible to the requesting user in their own session. It is not transferred to others except (i) as necessary to provide those features, (ii) to comply with applicable law, or (iii) as part of a merger, acquisition, or sale of assets with user notice and explicit affirmative consent.
• No advertising. Google Workspace data is never used for serving advertisements, including retargeted, personalized, or interest-based advertising.
• No human reading. Humans do not read Google Workspace data unless (a) the user has given affirmative consent for the specific content, (b) it is necessary for security purposes such as investigating abuse, (c) it is required by law, or (d) the data has been aggregated and anonymized for internal operations.
• Transient processing applies. As described in Section 4.2, Google Workspace content is processed transiently by the AI for the requesting user's session and discarded after inference completes. PREM does not retain a copy of Google Workspace content in persistent storage.

These restrictions apply to every PREM sub-processor that participates in providing Google Workspace integrations. Users may revoke Fluso's access to any Google service at any time from myaccount.google.com/permissions or from within Fluso's settings; revocation immediately stops Fluso from reading new data from that service.

Integration permissions and your control

Fluso accesses your connected services using OAuth or equivalent authorization mechanisms. This means:

1. You authorize Fluso's access via your service provider's own authentication flow (Google, Microsoft, Slack, etc.). PREM does not receive your passwords for those services.
2. You can revoke Fluso's access to any integration at any time, either from within Fluso's settings or from the connected service's own authorization settings.
3. Revoking access immediately stops Fluso from reading new data from that integration. It does not affect Account Data stored by PREM.
4. Disconnecting Fluso entirely and closing your account results in deletion of Account Data per the retention schedule in Section 9.

Sub-processors and data sharing

We do not share Integration Content with any third party. In providing the Service, we work with the following sub-processors:

A current sub-processor list is available at privacy@premai.io. We will provide at least 30 days' notice of any material change to sub-processors.

Government and law enforcement access

Where PREM receives any government or law enforcement request relating to Account Data:

1. PREM will assess the legal validity of the request before complying.
2. PREM will notify the affected User or Organization before producing any Account Data in response to such a request, unless prohibited from doing so by law or court order.
3. Where notification is prohibited, PREM will seek to challenge the prohibition and disclose only the minimum data required to comply.
4. PREM will not voluntarily produce Account Data to any government authority without a binding legal order.

International data transfers

EU infrastructure by default: Account Data is stored in PREM's EU infrastructure. PREM SA is in Switzerland, which has an EU adequacy decision — transfers from Switzerland to EU infrastructure are compliant without additional transfer mechanisms.

Integration Content: processed transiently during AI inference and discarded. It may transit EU infrastructure during processing but is not transferred internationally in persistent form.

CH→US (where applicable): where US-based infrastructure sub-processors are involved in Account Data processing, transfers from PREM SA to US entities are governed by Standard Contractual Clauses. Integration Content is not transferred to the US in persistent form.

Third-party integrations: when you connect Fluso to Gmail, Slack, or other services, those services process your data under their own privacy policies and transfer mechanisms. PREM does not control those flows.

Data retention

Anonymization: usage data retained beyond 12 months is anonymized by removal of all direct and indirect identifiers (account ID, organisation ID, IP address, integration type references) rendering re-identification impossible. Anonymized data does not constitute personal data under FADP or GDPR and is retained for service improvement only.

Your rights under FADP and GDPR

10.1 — Rights under FADP and GDPR

Under the Swiss FADP and GDPR, you may:

1. Access: confirm whether PREM holds personal data about you and receive a copy.
2. Rectification: correct inaccurate Account Data.
3. Erasure: request deletion of Account Data where PREM no longer has a legal basis to retain it.
4. Restriction: restrict processing of Account Data in certain circumstances.
5. Portability: receive your Account Data in a structured, machine-readable format.
6. Objection: object to processing of Account Data based on legitimate interest.
7. Disconnect integrations: you may at any time disconnect any integration via Fluso settings or via the connected service's own authorization management.

To exercise any right: privacy@premai.io. Response within 30 days.

To lodge a complaint: Switzerland — FDPIC: www.edoeb.admin.ch · +41 58 462 43 95. EU: your local supervisory authority (GDPR Art. 77).

10.2 — Developers located in the United States

Account Data protections under Section 10.1 apply regardless of your location. PREM does not sell personal data and does not use it for targeted advertising. To the extent any applicable US state privacy law applies to PREM's processing of your Account Data, you may exercise your rights at privacy@premai.io.

Security

• Encryption in transit: all connections use TLS 1.2 or higher.
• Encryption at rest: Account Data is stored encrypted at rest in EU infrastructure.
• Integration Content: processed in isolated compute environments; not written to persistent storage. Discarded after each inference session.
• Password hashing: stored as cryptographic hashes using OWASP-compliant algorithms. Plaintext passwords are never stored or recoverable.
• Access controls: MFA and RBAC on all PREM production systems.
• OAuth credentials: access tokens for connected integrations are stored encrypted and used only for API calls to the relevant service.
• SOC 2 alignment: PREM's security controls are aligned with SOC 2 requirements.

Security disclosures: security@premai.io (subject: "Security Disclosure").

Data breach notification

If PREM becomes aware of a personal data breach affecting Account Data:

1. We notify relevant supervisory authorities within 72 hours (FADP Art. 24 / GDPR Art. 33).
2. Where the breach poses high risk to your rights and freedoms, we notify you without undue delay.

Note on Integration Content: because Integration Content is not stored by PREM, a breach of PREM's infrastructure does not expose your emails, messages, or calendar content — there is nothing to breach. The source data remains in your connected services.

Cookies

Fluso uses only strictly necessary cookies for authentication and session management. We do not use analytics cookies, advertising trackers, or third-party tracking scripts on the Fluso service itself.

Children

Fluso is a professional workplace service and is not intended for individuals under 16. We do not knowingly collect personal data from children. Contact privacy@premai.io if you believe a child has provided data.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-service notification at least 30 days before taking effect. Continued use after a material change constitutes acceptance.

Contact

This Privacy Policy is provided in English. In case of conflict between translated versions and the English version, the English version prevails.