Effective September 18, 2026.
What we collect
Account details: your name, email address, company name, and role (insured, agent, carrier, or Flora team). Company-file details: legal and trade names, address, phone, state, trade class, a description of the work, policy dates, declared payroll, employee information, coverage information, and the carrier named on the policy.
Documents you upload or otherwise provide for your file, including insurance, payroll, employee, coverage, and audit-supporting documents; the checklist item and period they cover; and results of Flora’s readability and consistency checks. Verification records: when Flora called or texted, whether the call was answered, what was said about the application, and any discrepancies. Usage records: sign-in time, the address and browser a session came from, and an append-only audit log of every change to a file and who made it.
Why
To run the service you signed up for: build the checklist, check the documents, compute the readiness score, run verification, raise growth signals, and show the file to the people you attach to it. To keep accounts secure, to answer your messages, and to keep the record the audit itself will ask for.
Flora does not sell personal information and does not use your file for advertising.
Who sees it
The agent and carrier contacts attached to a company file see that file. The Flora team sees every file in order to run the service and answer the exception queue. We use Railway to host the application and managed Postgres database in the United States (currently the San Francisco/SFO region). Stripe processes card payments; Flora does not receive or store card numbers. Each provider receives only what it needs for its service.
If transactional email delivery is enabled, Flora may provide account, password-reset, invite, or service messages through a configured email provider. If an optional AI feature is enabled for your workspace or you ask Flora to use it, the data needed for that feature may be sent to its configured AI processor. Flora does not use customer documents to train its own or a third party’s general-purpose AI models. If the feature is not enabled, Flora does not send your document content to an AI processor.
We disclose data when the law requires it, and we tell you when we are allowed to.
Cookies
Flora currently uses only cookies needed to run the service: a session cookie (flora_session) to keep you signed in and a CSRF cookie (flora_csrf) to protect form submissions. If you switch the visual theme in the footer, one more cookie (flora_theme) remembers the choice; it is not set otherwise. Flora does not use analytics or advertising cookies as of this effective date.
Calls and texts
Calls and texts are about the insured’s own policy. Anyone who replies STOP is never texted again; with no recorded consent Flora places live human calls only.
How long we keep it
Retention is described item by item on the data page.
Your choices
You can see and update your account on the account page. You can ask for a copy of your company file or for its removal through the contact page or the account page; a person confirms the request with you by email. You can reply STOP to any text and we never text that number again.
Security
How we protect data is described on the security page.
Who this is for
Flora is a business tool for adults acting for a business. It is not directed at anyone under eighteen and we do not knowingly collect their information.
Changes and contact
When this page changes in substance we update the effective date. Questions or requests go through the contact page.