Privacy Policy | Florence AI
F
Florence AI

Privacy Policy

We respect your privacy. Here's exactly what we collect, why we collect it, and what you can do about it.

Background

Florence AI (a product of Nightingale HQ Ltd) understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone who visits florence.nightingalehq.ai and our related applications ("our Service"), and will only collect and use personal data in ways described here, consistent with our obligations and your rights under the law.

1. Definitions

  • "Account" means an account required to access and use the Service.
  • "Cookie" means a small text file placed on your device when you visit the Service.
  • "UK GDPR" means the UK General Data Protection Regulation as incorporated by the Data Protection Act 2018.

2. Information About Us

The Service is owned and operated by Nightingale HQ Ltd, a limited company registered in England and Wales under company number 11725529.

  • Registered address: Ty Merlin Caerphilly Business Park, Van Road, Caerphilly, Wales, CF83 3GS
  • Email: TalkToUs@GoSmarter.ai

3. What This Policy Covers

This Privacy Policy applies to your use of the Service. Our Service may link to third-party websites; we have no control over how those sites collect, store or use your data.

4. What Is Personal Data

Under UK GDPR, personal data is any information about an identifiable person who can be directly or indirectly identified, particularly by reference to an identifier such as a name, an identification number, location data, or an online identifier.

5. Your Rights

  1. Right to be informed — this Policy tells you how we use your data.
  2. Right of access — request a copy of the data we hold about you.
  3. Right to rectification — ask us to correct inaccurate or incomplete data.
  4. Right to erasure — ask us to delete your personal data.
  5. Right to restrict processing — ask us to limit how we use your data.
  6. Right to object — object to us using your data for particular purposes.
  7. Right to withdraw consent — where we rely on consent, you can withdraw it at any time.
  8. Right to data portability — request a copy of your data in a machine-readable format.
  9. Rights relating to automated decision-making — we do not use automated decision-making that produces legal or similarly significant effects.

Contact us using the details in section 15 to exercise any of these rights. We will respond within one month. Further information is available from the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113.

6. What Data We Collect and How

  • Account data — name, email address, authentication provider (email or Google) — collected when you register.
  • Content data — organisation details, canvas entries, assessments, strategies, projects, briefs and chat messages you create in the app.
  • Technical interaction data — anonymous analytics data (only with your consent).

We do not collect special category data, data relating to children, or data relating to criminal convictions.

7. How We Use Your Personal Data

Under UK GDPR, we must always have a lawful basis for using personal data.

  • Provide the Service — account data and content data are used to deliver Florence's features to you (contract).
  • AI processing — your content is sent to AI providers to generate suggestions and outputs on your behalf (contract). Providers do not use your data to train their models under our agreements.
  • Support & enquiries — name and email (legitimate interest / contract).
  • Marketing communications — only if you opt in (consent). You may opt out at any time.
  • Aggregate analytics & benchmarking — anonymised, aggregated data only (legitimate interest).

We will not send you unsolicited marketing. Individual strategy or company data is never sold or shared beyond those you explicitly grant access to.

8. How Long We Keep Your Personal Data

  • Account & content data — for the life of your account. You may delete strategies or your account at any time.
  • Analytics data — aggregated indefinitely; individual session data up to 90 days.
  • Cookie consent records — 1 year.

9. How and Where We Store or Transfer Your Personal Data

We use the service providers ("processors") listed in section 10 to run Florence. Where each of them stores or processes data is chosen when a Florence service is set up, and may be outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as adequacy decisions or Standard Contractual Clauses (SCCs).

10. Do We Share Your Personal Data

We do not sell your personal data. We share it with the following kinds of processor, only so they can do the job described, and may share it with the other recipients below:

  • Database, sign-in and server functions — Supabase stores your account and content data and runs the back-end code.
  • Website hosting — Netlify serves the Florence web app.
  • AI providers — Microsoft Azure OpenAI generates suggestions and outputs from your content. Your prompts are sent to the Azure OpenAI service configured for the Florence service you use. PDF documents you upload as context are first read by Azure AI Document Intelligence, using the resource configured for the Florence service you use, and the extracted text is then summarised by Azure OpenAI. Word and PowerPoint documents are read within Florence and then summarised by Azure OpenAI.
  • Email delivery — Resend sends account, invitation and notification emails, so it receives recipient addresses and message content.
  • Payments — Stripe handles card payments and subscriptions. We do not store your card details.
  • Website research — Firecrawl fetches public web pages when you ask Florence to research an organisation.
  • Sign-in providers — Google or Apple, only if you choose to sign in with them.
  • Collaborators you invite — according to the role you assign (Owner, Editor or Viewer).
  • Third-party MCP clients — only after you explicitly authorise them via OAuth.
  • Legal and regulatory authorities — where required by law.

Organisations that run their own Florence service may use their own accounts with these providers. For the current list of processors, what each one receives and where it is configured, contact us using the details in section 15.

11. How You Can Control Your Personal Data

  • Update or delete your data via the Profile page.
  • Revoke sharing or MCP integrations at any time.
  • Opt out of marketing emails using the unsubscribe link.
  • Contact us to request access, rectification, or erasure.
  • Raise a complaint with the ICO at ico.org.uk.

12. Cookies

We use only essential cookies required for authentication and core functionality. We do not use marketing or advertising cookies on the Service.

13. How Can I Access My Personal Data

Submit a Subject Access Request (SAR) in writing to the email or postal address in section 15. There is no charge for most SARs. We will respond within one month.

14. Security

We apply industry-standard security measures: encryption in transit and at rest, Row-Level Security on all tenant data, and scoped access tokens for third-party integrations.

15. How to Contact Us

  • Email: TalkToUs@GoSmarter.ai
  • Post: Nightingale HQ Ltd, Ty Merlin Caerphilly Business Park, Van Road, Caerphilly, Wales, CF83 3GS

16. Changes to This Policy

We may update this Policy from time to time. Changes will be published on this page with an updated date. We recommend checking this page periodically.

Last updated: October 2026