Privacy Policy

Your privacy's important, so please, take some time to read this.

Last Updated: June 1, 2026

Fluint, Inc. ("Fluint," "we," "us," or "our") builds AI infrastructure for B2B revenue teams. This Privacy Policy describes how we collect, use, disclose, and protect personal data in connection with:

  • Our websites, including fluint.io and its subdomains (the "Sites");
  • Our products and services, including Agent, Loop, and the Model API for Olli Mesa, together with any other products, features, tools, or services we make available now or in the future (collectively, the "Services"); and
  • Our marketing, sales, events, and support activities.

A note on scope. This Privacy Policy applies where Fluint acts as a "controller" of personal data — meaning we determine how and why data is processed. When we process data on behalf of a business customer as part of delivering the Services (for example, deal records, communications, or other content our customers connect to or submit through the Services), we act as a "processor" or "service provider" under the customer's instructions. That processing is governed by our agreement with the customer, including any Data Processing Agreement ("DPA") in place. If you are an employee, contractor, prospect, or contact of one of our customers and have questions about how your information is handled within their Fluint environment, please contact that customer directly — their privacy practices, not this Policy, govern that data.

1. Information We Collect

The categories of personal data we collect depend on how you interact with us.

1.1 Information you provide to us

  • Account and profile information. Name, business email address, job title, company name, password or authentication credentials, and preferences you set when you register for or administer an account.
  • Customer Content. Information you or your organization submit to, connect to, or generate within the Services, such as deal documents, business cases, briefs, emails, meeting notes, CRM records, and prompts or instructions provided to our models and agents ("Customer Content"). Customer Content may incidentally contain personal data about you, your colleagues, or your business contacts.
  • Payment and billing information. If you purchase a subscription, our third-party payment processor collects payment card details and billing information. Fluint does not store full payment card numbers.
  • Communications. Information you provide when you contact support, respond to surveys, register for webinars or events, subscribe to our newsletter, or otherwise communicate with us.
  • Recruiting information. If you apply for a role at Fluint, we collect the information in your application and any information you authorize third parties (such as references) to share.

1.2 Information we collect automatically

  • Usage data. Interactions with the Sites and Services, including features used, pages viewed, queries and API calls made, session duration, and performance and diagnostic data.
  • Device and connection data. IP address, approximate location derived from IP address, browser type and version, operating system, device identifiers, and language settings.
  • Cookies and similar technologies. We and our providers use cookies, pixels, and similar technologies as described in Section 9.

1.3 Information from other sources

  • Business and contact enrichment. We may receive business contact information from publicly available sources, data providers, event partners, and our customers (for example, when a customer connects a CRM or invites teammates).
  • Integrations. When you or your organization connect third-party services (such as a CRM, email, or calendar provider) to the Services, we receive the data you authorize those services to share.

We do not intentionally collect sensitive personal data (such as government identifiers, health information, biometric data, or precise geolocation) through the Sites, and we ask that you not submit sensitive or specially regulated data through the Services unless expressly agreed in writing with Fluint.

2. How We Use Information

We use personal data to:

  1. Provide and operate the Services — creating and administering accounts, processing Customer Content to generate outputs, powering agents and workflows, syncing authorized integrations, and providing customer support;
  2. Secure the Services — authenticating users, detecting and preventing fraud, abuse, security incidents, and violations of our terms;
  3. Improve and develop the Services — analyzing usage to fix bugs, improve performance, develop new features, and, as described in Section 3, train and fine-tune Fluint's proprietary in-house models;
  4. Bill and manage accounts — processing payments, managing subscriptions and usage-based credits, and sending transactional communications;
  5. Communicate and market — sending service announcements, and, consistent with your choices and applicable law, sending newsletters, product updates, and marketing communications, and measuring their effectiveness;
  6. Comply with law — meeting our legal, regulatory, tax, and audit obligations, enforcing our agreements, and protecting the rights, safety, and property of Fluint, our customers, and others.

Where the EU or UK General Data Protection Regulation ("GDPR") applies, our legal bases are: performance of a contract (items 1 and 4), legitimate interests (items 2, 3, and 5, balanced against your rights and interests), consent where required (for example, certain cookies and marketing), and legal obligation (item 6).

3. How We Use Data for AI Model Training

This section describes our model training practices plainly, because we think you should not have to hunt for them.

What we train. Fluint develops proprietary, in-house AI models purpose-built for B2B revenue work, including Olli Mesa. We train and fine-tune these models to improve their accuracy, safety, and usefulness for revenue teams.

Whose data is used. If your organization uses the Services under a standard (non-enterprise) plan, we may use Customer Content and usage data from your organization's use of the Services — in aggregated and de-identified form — to train and fine-tune our in-house models. Before any such use, we apply technical measures designed to remove or obscure information that identifies individuals or specific customer organizations, and we combine data across many customers so that patterns, not any one customer's content, inform the model.

Whose data is not used. We do not use Customer Content for model training where:

  • Your organization is an enterprise customer operating under a Master Services Agreement, DPA, or private or dedicated model deployment whose terms exclude training use — those agreements govern and take precedence; or
  • Your data has been designated as excluded from training under a written agreement with Fluint.

What we never do. We do not sell Customer Content. We do not contribute Customer Content — in any form — to the training of third-party or publicly available foundation models. Where the Services use third-party foundation models to process Customer Content, our agreements with those providers prohibit them from training their models on that content. Our training is limited to Fluint's own proprietary models used to deliver the Services.

De-identified data commitments. Where we rely on de-identified or aggregated data, we (a) maintain and use it only in de-identified form, (b) do not attempt to re-identify it, except as permitted by law to test the effectiveness of our de-identification, and (c) contractually require any recipients to do the same.

Changes to these practices. We will not materially expand how we use previously collected data for model training without providing prominent notice and, where required by law, obtaining consent. We will not apply materially more permissive training practices retroactively through quiet policy updates.

4. How We Disclose Information

We disclose personal data only as described below. We do not sell personal data, and we do not disclose Customer Content to third parties for their own independent use.

  • Subprocessors and service providers. We use vetted providers who process data on our behalf and under contract, in categories including: cloud hosting and infrastructure; third-party AI model providers used to deliver certain features (contractually barred from training on Customer Content); analytics; payment processing; customer relationship management and communications; and customer support tooling. The master list of our subprocessors is maintained in the Fluint Trust Center at https://app.vanta.com/fluint.io/trust/yey8utqedmkol775itjhze.
  • Within a customer's organization. Account administrators and authorized users within your organization may access information associated with your organization's account.
  • Professional advisors. Lawyers, auditors, accountants, and insurers, where reasonably necessary.
  • Corporate transactions. In connection with a merger, acquisition, financing, reorganization, or sale of assets, personal data may be disclosed to counterparties and their advisors under confidentiality obligations, and transferred as part of the transaction. We will provide notice of any resulting change in control or use of personal data.
  • Legal requirements. Where required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect rights, safety, or property, or to investigate fraud or security issues. Where legally permitted, we will direct governmental requests for Customer Content to the relevant customer and notify the customer before disclosure.
  • Aggregated and de-identified data. We may use and disclose aggregated or de-identified data — which does not identify you or any customer — for any lawful purpose, including benchmarking, research, and industry publications, subject to the commitments in Section 3.
  • With your direction or consent. For example, when you connect a third-party integration or ask us to share information.

5. Data Retention

We retain personal data for as long as needed to provide the Services and fulfill the purposes described in this Policy, and afterward as required for legitimate business purposes (such as billing records, dispute resolution, and security logs) or legal compliance. Customer Content is retained per the controlling customer agreement; upon termination of a customer relationship, Customer Content is deleted or returned in accordance with that agreement and our standard deletion schedules, except for limited backup copies that are deleted in the ordinary course. Retention periods vary by data category; criteria include the nature and sensitivity of the data, the purposes of processing, and applicable legal requirements.

6. Security

We maintain a security program aligned with industry standards, and Fluint has achieved SOC 2 Type II attestation. Our practices follow ISO/IEC 27001-aligned controls and include encryption of data in transit and at rest, role-based access controls and least-privilege access, single sign-on and multi-factor authentication support, logging and monitoring, vendor security review, and regular third-party penetration testing. No system is perfectly secure, and we cannot guarantee absolute security; we encourage you to use strong authentication and to notify us immediately at security@fluint.io of any suspected unauthorized access.

7. International Data Transfers

Fluint is headquartered in the United States, and personal data is processed in the United States and other locations where we or our subprocessors operate. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to countries not deemed adequate, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement, as applicable), together with supplementary measures where appropriate.

8. Your Rights and Choices

8.1 Rights available in many jurisdictions

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; delete your data; receive a portable copy of your data; object to or restrict certain processing; opt out of targeted advertising, sale of personal data, or profiling in furtherance of decisions with legal or similarly significant effects; and withdraw consent where processing is based on consent (without affecting prior processing).

To exercise these rights, contact us at hello@fluint.io. We will verify your request (typically via your account email) and respond within the timeframe required by applicable law. Authorized agents may submit requests where permitted by law. We will not discriminate against you for exercising your rights.

Requests concerning Customer Content. If your data was submitted to Fluint by or on behalf of one of our customers, we may direct your request to that customer or notify them, since they control that data.

Appeals. If we decline your request, you may appeal by replying to our decision or contacting hello@fluint.io with the subject line "Appeal." If your appeal is unsuccessful, you may contact your state Attorney General or, in the EEA/UK, your data protection authority.

8.2 US state-specific disclosures

Residents of California, Colorado, Connecticut, Texas, Virginia, and other states with comprehensive privacy laws have the rights described in Section 8.1 to the extent provided by their state's law. In addition:

  • Categories of personal information. In the preceding 12 months, we have collected the categories of personal information described in Section 1 (identifiers; commercial information; internet or network activity; professional or employment-related information; inferences; and audio/electronic information where communications are processed through the Services) from the sources described in Section 1, for the purposes described in Sections 2 and 3, and disclosed them to the categories of recipients described in Section 4.
  • Sale and sharing. We do not sell personal information for money. We do use advertising cookies and pixels on our Sites, which may constitute "sharing" of personal information for cross-context behavioral advertising, or processing for "targeted advertising," under applicable state laws. You may opt out at any time via the "Cookie Preferences" / "Your Privacy Choices" link on our Sites, and we honor opt-out preference signals such as Global Privacy Control.
  • Sensitive personal information. We do not use or disclose sensitive personal information for purposes requiring a right to limit under California law.

8.3 EEA, UK, and Swiss residents

You may also lodge a complaint with your data protection supervisory authority.

8.4 Marketing choices

You may opt out of marketing emails via the unsubscribe link in any message or by contacting us. We will continue to send transactional and service communications related to your account.

9. Cookies and Similar Technologies

We use strictly necessary cookies (authentication, security, load balancing), functional cookies (preferences), analytics cookies (understanding Site and Service usage), and, on our Sites, advertising cookies that help us measure and reach relevant business audiences. You can manage non-essential cookies through the cookie preferences link on our Sites and your browser settings. Where required by law, non-essential cookies are set only with your consent, and we honor Global Privacy Control signals.

10. Children

The Sites and Services are designed for business use and are not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us at hello@fluint.io and we will delete it.

11. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide prominent notice — such as by email to account holders or a notice within the Services — before the changes take effect, and we will update the "Last Updated" date above.

12. Contact Us

Fluint, Inc. 1905 Sherman Street, Ste 200 #1793 Denver, CO 80203, USA

Privacy & Security Officer: Jon Crawley, CTO — security@fluint.ioGeneral inquiries:hello@fluint.io

If you have an unresolved privacy concern that we have not addressed satisfactorily, please contact us and we will work to resolve it.

Appendix: Data Processing Agreement (Self-Serve)

This Data Processing Agreement ("DPA") is incorporated into the Fluint Terms of Service or other agreement between Fluint, Inc. ("Fluint") and the customer identified in the applicable account ("Customer") governing Customer's use of the Services (the "Agreement"). This DPA applies where and to the extent Fluint Processes Personal Data contained in Customer Content on Customer's behalf. If Customer has executed a separate data processing agreement with Fluint, that executed agreement governs and this DPA does not apply.

1. Definitions

  • "Data Protection Laws" means all laws applicable to the Processing of Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as incorporated into UK law ("UK GDPR"), the Swiss Federal Act on Data Protection, and US federal and state privacy laws including the California Consumer Privacy Act as amended ("CCPA").
  • "Personal Data" means information relating to an identified or identifiable natural person contained in Customer Content that Fluint Processes on Customer's behalf. Personal Data does not include data that has been aggregated or de-identified such that it cannot reasonably be linked to an individual or Customer.
  • "Processing," "Controller," "Processor," "Data Subject," "Personal Data Breach," and similar terms have the meanings given in applicable Data Protection Laws; "Service Provider," "Sell," and "Share" have the meanings given in the CCPA.
  • "Subprocessor" means a third party engaged by Fluint to Process Personal Data on Fluint's behalf in delivering the Services.
  • "Standard Contractual Clauses" or "SCCs" means the clauses approved by European Commission Implementing Decision (EU) 2021/914 (Module Two: controller-to-processor), as supplemented by the UK International Data Transfer Addendum and adapted for Switzerland as described in Section 10.

Capitalized terms not defined here have the meanings in the Agreement.

2. Roles and Scope

Customer is the Controller (or, where Customer acts on behalf of its own customers, a Processor) of Personal Data, and Fluint is Customer's Processor (or Subprocessor). Each party will comply with its obligations under applicable Data Protection Laws. Customer is responsible for the accuracy and lawfulness of Personal Data, for its instructions to Fluint, and for providing all notices and obtaining all consents and rights required for Fluint's Processing described in this DPA and the Agreement — including any notices or consents required from individuals whose communications, records, or other data Customer connects to or submits through the Services.

3. Processing Instructions

Fluint will Process Personal Data only on Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law (in which case Fluint will inform Customer unless legally prohibited). Customer instructs Fluint to Process Personal Data: (a) to provide, secure, support, and maintain the Services; (b) as configured and initiated by Customer and its users through the Services, including through connected integrations, prompts, and agent instructions; (c) to create aggregated and de-identified data as described in Section 5; and (d) as otherwise documented in the Agreement and this DPA. Fluint will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected Processing until instructions are clarified. The subject matter, duration, nature, and purposes of Processing and the categories of Personal Data and Data Subjects are described in Annex 1.

4. Confidentiality and Personnel

Fluint ensures that personnel authorized to Process Personal Data are subject to binding confidentiality obligations and receive appropriate privacy and security training, and that access is limited to personnel who need it to perform under the Agreement.

5. De-Identified and Aggregated Data; Model Training

Customer instructs and authorizes Fluint to create aggregated and de-identified data from Customer Content and usage data, using technical measures designed to remove or obscure information identifying individuals and Customer's organization, and to combine such data across customers, for the purposes described in the Agreement — including training, fine-tuning, evaluating, and improving Fluint's proprietary in-house AI models. Data that has been de-identified in accordance with applicable Data Protection Laws is not Personal Data and is not subject to this DPA. With respect to de-identified data, Fluint will: (a) maintain and use it only in de-identified form; (b) not attempt to re-identify it, except as permitted by law solely to test the effectiveness of de-identification; and (c) contractually obligate any recipients to comply with the foregoing. For clarity, Fluint does not use Customer Content to train third-party or publicly available foundation models, and does not Sell or Share Personal Data.

6. Security

Fluint maintains appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described in Annex 2, including measures validated through Fluint's SOC 2 Type II attestation and aligned with ISO/IEC 27001 practices. Fluint may update these measures from time to time, provided updates do not materially reduce the overall protection of Personal Data.

7. Subprocessors

Customer provides general authorization for Fluint to engage Subprocessors. The current list of Subprocessors is maintained in the Fluint Trust Center at https://app.vanta.com/fluint.io/trust/yey8utqedmkol775itjhze, where Customer may subscribe to notifications of changes. Fluint will provide notice of new Subprocessors at least 15 days before granting them access to Personal Data. Customer may object on reasonable data protection grounds within that notice period; if the parties cannot resolve the objection in good faith, Customer may terminate the affected Services and receive a pro-rata refund of prepaid, unused fees for those Services. Fluint will impose data protection obligations on Subprocessors that are no less protective than those in this DPA and remains liable for its Subprocessors' performance.

8. Assistance

Data Subject requests. Taking into account the nature of the Processing, Fluint will provide reasonable assistance (including through the functionality of the Services) to help Customer respond to Data Subject requests to exercise rights under Data Protection Laws. If Fluint receives a request directly from a Data Subject relating to Customer's Personal Data, Fluint will direct the Data Subject to Customer, unless legally required to respond.

DPIAs and consultations. Fluint will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities, to the extent required of Fluint by Data Protection Laws and taking into account the information available to Fluint.

9. Personal Data Breach

Fluint will notify Customer without undue delay, and in any event within 72 hours, after confirming a Personal Data Breach affecting Customer's Personal Data, and will provide information reasonably available to Fluint about the nature of the breach, the categories and approximate number of Data Subjects and records concerned, likely consequences, and measures taken or proposed. Fluint will take reasonable steps to contain and remediate the breach. Fluint's notification is not an acknowledgment of fault or liability. Customer is responsible for any notifications to Data Subjects or regulators that Customer is required to make.

10. International Transfers

Fluint Processes Personal Data in the United States and other locations where Fluint or its Subprocessors operate. Where Processing involves a transfer of Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties enter into the SCCs, which are incorporated into this DPA by reference, with Customer as data exporter and Fluint as data importer, completed as follows: Module Two applies; Clause 7 (docking) is included; Clause 9(a) Option 2 (general authorization) applies with the notice period in Section 7; Clause 11 optional language is not included; Clause 17 is governed by Irish law and Clause 18 designates the courts of Ireland; Annexes I and II to the SCCs are populated by Annexes 1 and 2 to this DPA. For UK transfers, the UK International Data Transfer Addendum applies with tables deemed completed by the details in this DPA; for Swiss transfers, the SCCs are adapted as required by the Swiss Federal Data Protection and Information Commissioner. In case of conflict between the SCCs and this DPA or the Agreement, the SCCs prevail with respect to the transfers they govern.

11. US State Privacy Law Terms

To the extent Fluint Processes Personal Data subject to US state privacy laws, Fluint acts as Customer's Service Provider or Processor and will: (a) not Sell or Share Personal Data; (b) not retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Agreement and this DPA (including the creation and use of de-identified data as described in Section 5), or as otherwise permitted by applicable law; (c) not retain, use, or disclose Personal Data outside the direct business relationship between the parties, except as permitted by applicable law; (d) not combine Personal Data with personal data from other sources except as permitted by applicable law for Service Providers; (e) comply with applicable obligations under such laws and provide the same level of privacy protection as required of Customer; (f) notify Customer if it determines it can no longer meet these obligations, in which case Customer may take reasonable and appropriate steps to stop and remediate unauthorized use; and (g) certify that it understands and will comply with the restrictions in this Section.

12. Deletion and Return

Upon termination or expiration of the Agreement, Fluint will delete or return Personal Data as described in the Agreement (including the export window and backup deletion schedules), except where retention is required by law. Upon written request, Fluint will confirm deletion in writing.

13. Audits

Fluint will make available information reasonably necessary to demonstrate compliance with this DPA, including its then-current SOC 2 Type II report, security documentation available through the Fluint Trust Center, and written responses to reasonable security questionnaires (no more than once per year). Where Data Protection Laws grant Customer a mandatory audit right that cannot be satisfied by the foregoing, Customer may conduct (directly or through an independent auditor bound by confidentiality) an audit of Fluint's relevant controls, no more than once per year, on at least 30 days' notice, during business hours, at Customer's expense, in a manner that does not disrupt Fluint's operations or compromise other customers' data.

14. Liability and Order of Precedence

Each party's liability arising out of or relating to this DPA (including the SCCs, to the extent permitted) is subject to the limitations and exclusions of liability in the Agreement, and liability under the Agreement and this DPA is aggregated, not additive. In case of conflict: (1) the SCCs (for the transfers they govern), (2) this DPA (for Processing of Personal Data), (3) the Agreement.

15. Term

This DPA is effective as of the effective date of the Agreement and continues for as long as Fluint Processes Personal Data on Customer's behalf.

Annex 1 — Details of Processing

A. List of parties. Data exporter: Customer (contact details per Customer's account); role: Controller (or Processor). Data importer: Fluint, Inc., 1905 Sherman Street, Ste 200 #1793, Denver, CO 80203, USA; contact: security@fluint.io; role: Processor.

B. Description of transfer/Processing.

  • Categories of Data Subjects: Customer's authorized users and personnel; Customer's prospects, customers, and business contacts; other individuals whose Personal Data is contained in Customer Content submitted to or connected with the Services.
  • Categories of Personal Data: Identification and business contact data (name, business email, phone, title, employer); professional and commercial data (deal records, account and opportunity information); communications content and metadata (emails, meeting notes, documents, messages) that Customer connects to or submits through the Services; user account data; usage and device data.
  • Sensitive data: None intended. Customer is instructed not to submit special categories of data or specially regulated data (e.g., health or payment card data) except as expressly agreed in writing.
  • Frequency: Continuous, for the duration of the Agreement.
  • Nature and purpose of Processing: Hosting, storage, transmission, analysis, generation of Outputs, and related Processing to provide, secure, support, and improve the Services as described in the Agreement, including creation of aggregated and de-identified data as described in Section 5 of this DPA.
  • Retention: For the duration of the Agreement plus the export and deletion periods described in the Agreement.
  • Subprocessor transfers: As listed in the Fluint Trust Center; nature and duration consistent with the above.

C. Competent supervisory authority. The supervisory authority of the EU member state in which the data exporter is established or, where the exporter is not established in the EU, the Irish Data Protection Commission as identified per Clause 13 of the SCCs.

Annex 2 — Technical and Organizational Measures

Fluint maintains a written information security program, validated through SOC 2 Type II attestation and aligned with ISO/IEC 27001 practices, including:

  • Encryption of Personal Data in transit (TLS 1.2+) and at rest;
  • Access control: role-based access, least privilege, unique credentials, multi-factor authentication, SSO support, and prompt deprovisioning;
  • Network and infrastructure security: hardened cloud infrastructure, segregation of environments, vulnerability management, and regular third-party penetration testing;
  • Logging and monitoring of production systems with alerting and incident response procedures, including a documented incident response plan tested periodically;
  • Data governance: logical tenant separation, data minimization practices, and defined retention and deletion procedures;
  • Personnel security: background checks where permitted by law, confidentiality obligations, and security and privacy training;
  • Vendor management: risk-based security review of Subprocessors and contractual flow-down of data protection obligations;
  • Business continuity and disaster recovery: backups, redundancy, and tested recovery procedures;
  • Secure development: code review, change management, and separation of duties.

Current details, certifications, and reports are available in the Fluint Trust Center at https://app.vanta.com/fluint.io/trust/yey8utqedmkol775itjhze.