Privacy Policy
Agent Workspace service · version 2026-10-22 · last updated 22 October 2026
1. Who we are
Agent Workspace (team.flaistudio.de) is operated by FLAI Studio, a sole proprietorship under German law, which is the controller for the data described in 3b. Legal details: Imprint. Contact for all privacy matters: office@flaistudio.de.
This policy covers the Agent Workspace service (connector, admin console and API). The website flaistudio.de has its own privacy notice.
2. Our role: processor for business customers
Agent Workspace is a business-to-business service. The company that creates a workspace (the “customer”) decides which people, files and tasks go into it. For that content we act as a processor under Art. 28 GDPR, on the customer's documented instructions. The data processing agreement is section 6 of our Terms of Service & Data Processing, accepted by the company owner when the workspace is created. Requests from employees of a customer about workspace content are forwarded to that customer.
We act as a controller only for account and billing data we need to run the service (see 3b).
3. Data we process
a) Workspace content (as processor): member names and email addresses, roles and permissions, folders, files and their versions, tasks, approval requests, company playbooks, and the audit log of actions taken by people and their AI agents.
b) Account and operational data (as controller):
| Data | Purpose · legal basis | Kept |
|---|---|---|
| Name, login email, password hash, acceptance of the terms (version, time) | Providing your account · Art. 6(1)(b) GDPR (contract) | Until the account is deleted |
| Sessions, OAuth connection records (which AI client is connected), sign-in and security events; IP addresses stored only as hashes in the audit log | Security and abuse prevention · Art. 6(1)(f) GDPR (our legitimate interest in a secure service) | Sessions until sign-out or expiry; security records as long as the company exists |
| Web server logs (IP address, time, requested address) | Operation and attack detection · Art. 6(1)(f) GDPR | Short-term, no longer than 30 days |
| Emails you send us; billing records once paid plans start | Support, invoicing · Art. 6(1)(b) and (c) GDPR (tax and commercial law) | Support: until resolved; invoices: up to 10 years (§ 147 AO, § 257 HGB) |
Providing this data is required to use the Service. We make no automated decisions with legal effect about you.
Cookies: no tracking, analytics or advertising cookies, no third-party fonts or scripts. We set only what the Service needs: the sign-in session cookie, a security (CSRF) cookie and your language choice (aw_lang, one year). These are strictly necessary (§ 25(2) TDDDG), so no consent banner is shown.
4. AI assistants
Each person connects their own AI assistant (for example Claude or ChatGPT) under their own subscription. Content that the assistant reads from or writes to the workspace is also processed by that assistant's provider under the person's or the customer's own agreement with that provider. We recommend business plans of those providers with model training disabled when personal data is involved.
We do not train any AI models on customer content, and we do not sell or share customer content.
5. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | Server hosting (application, database, encrypted file storage, backups) | EU data centre (Germany) |
| Zoho Corporation B.V. (Zoho Europe) | Transactional and support email | EU data centres |
| Stripe Payments Europe, Ltd. | Payment processing (paid plans only) | Ireland / EU; transfers under SCCs where applicable |
We inform customers before adding or replacing a sub-processor.
6. Security
Hosting in the EU; files encrypted at rest with a per-company key; row-level isolation of each company's data; append-only audit log; TLS for all connections; least-privilege access for staff.
7. Retention
Workspace content is kept for as long as the customer's workspace exists. Deleted files are purged after a grace period. When a workspace is closed, its content is deleted within 30 days, and backups are overwritten in their regular rotation. Account and billing data: see the table in section 3.
8. Your rights
You have the right of access, rectification, erasure, restriction and data portability (Art. 15–20 GDPR), and the right to object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your situation (Art. 21 GDPR). You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. For workspace content, please contact the company that invited you; for everything else, write to office@flaistudio.de.
9. Changes
We will update this page when the service changes and notify customers of material changes by email.