Flora

Users retain ownership of everything they submit; Flora takes only a service-provision license. Inputs are expressly defined as User Data and remain the user's property, with the license limited to operating the Services.

Flora assigns all rights in AI-generated Output to the user. The one caveat is that Output may not be unique and users have no rights to similar materials generated for other users, which is inherent to generative AI rather than a vendor land-grab.

The Terms explicitly state Flora does not train its own AI systems on User Data and does not permit third-party model providers to train on it either. This is an unusually clear no-training commitment for consumer terms, though Flora may still use Aggregated De-Identified Data for improving its products.

The Privacy Notice describes retention only in open-ended, purpose-based terms with no fixed schedules or deletion SLAs. Deletion is possible by contacting support, but account termination may destroy Content and recovery is not guaranteed, so users bear the risk of data loss.

Flora discloses Personal Data to service providers (hosting, AI/ML providers, analytics, security), other users, and third-party services, and acknowledges some disclosures may constitute a 'sale' under state law. Sharing is disclosed and largely tied to service delivery, but the acknowledgment of a 'sale' and business-transfer clause warrant caution.

The policy provides some opt-out mechanisms: cookie/analytics opt-out, session replay opt-out, Google Analytics opt-out, and an arbitration opt-out within 30 days. However, there is no described mechanism to opt out of core data collection or the 'sale' of data beyond cookie settings, and DNT is not honored.

The consumer Terms and Privacy Notice name no certifications and cite only GDPR lawful bases and COPPA/CCPA-style 'sale' concepts. No SOC 2, ISO, or attestation is claimed in the consumer documents themselves (the SOC 2 Type 1/2 claim appears only in enterprise marketing copy, and even there GDPR is described as forthcoming). Against the universal baseline plus marketing/adtech frameworks, the consumer documents are largely silent.

The documents provide no transparency into model behavior, no explainability commitments, and no enterprise auditing capability. They only warn users that AI output may be inaccurate or biased and must be independently verified.

The Privacy Notice describes generic 'appropriate physical, technical, organisational and administrative' safeguards but no specifics (encryption, pen testing, bug bounty) in the consumer documents. A Trust Center and Status page are referenced. No breach history is disclosed.

The consumer Terms distinguish free vs. paid use (free users limited to internal purposes; certain content rights depend on plan) and the Privacy Notice notes B2B users' employer is the controller with Flora acting as processor. Enterprise-specific protections are not detailed in the consumer documents themselves, leaving the delta partly ambiguous.

No explicit blanket right to have staff read prompts is asserted, but Flora reserves broad rights to remove Content and reserves access for support, security, debugging, and legal purposes. For B2B users, Flora may share account contents (including communications) with the customer organization.

The Privacy Notice describes cooperation with government and law enforcement to meet legal requirements, and the Terms impose binding arbitration and a class-action waiver. No active litigation is disclosed. The arbitration/class-waiver structure limits user remedies.

Flora collects a defined set of PII: name, email, username, payment/transaction data, device/IP data, web analytics, ZIP code, job title, and IP-based geolocation, with disclosed purposes and GDPR lawful bases. No sensitive categories are intentionally solicited, but users may voluntarily upload any content (free-form Inputs) that could include SPI, and precise geolocation is limited to IP-based data.

The Privacy Notice is dated June 1, 2026 and the Terms November 17, 2025 — both within 12 months of the August 2026 analysis date. The Terms substantively address the product's AI-first nature, including generative Output, Third-Party AI Systems, and training data, matching the product surface (multi-model image/video generation). Coverage of the visible AI capabilities is demonstrated.

Two consumer documents were supplied (Terms of Service and Privacy Notice) and no contradictions were found between them. The no-training commitment, ownership terms, and data-sharing descriptions are consistent across both documents.