Privacy Policy

Natural Language Labs Inc. d/b/a Flashpoint.AI

Last Updated: February 2026

Natural Language Labs Inc. d/b/a Flashpoint.AI ("Flashpoint.AI," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at flashpoint.aiand any subdomains (the "Website"), use our mobile application (the "App"), or use any content, functionality, and services offered through our platform (collectively, the "Platform").

This Privacy Policy applies to all users worldwide, including residents of the European Union ("EU"), European Economic Area ("EEA"), United Kingdom ("UK"), and the United States. Where applicable, this policy is designed to comply with the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act ("CCPA"), and other applicable data protection laws.

If you have questions about this Privacy Policy, please contact us at info@flashpoint.ai.

1. Data Controller

The data controller responsible for your personal data is:

Natural Language Labs Inc. d/b/a Flashpoint.AI

228 Park Ave S. #65771

New York, NY 10003

United States

Email: info@flashpoint.ai

Telephone: 347-931-6225

For EU/EEA/UK-specific inquiries regarding your data protection rights, please contact our Data Protection Officer at dpo@flashpoint.ai.

2. Personal Data We Collect

2.1 Information You Provide to Us

We collect personal data that you voluntarily provide when using our Platform, including:

  • Account Information: Name, email address, phone number, company name, and job title.
  • Payment Information: Billing address, payment card details (processed by Stripe; we do not store full card numbers).
  • Communications: Information you provide when contacting us, including support requests, feedback, and survey responses.
  • Survey and Research Data: Responses, behavioral data, and other information collected through our research platform.

2.2 Information We Collect Automatically

When you access our Platform, we automatically collect:

  • Device and Browser Information: IP address, browser type and version, operating system, device type, unique device identifiers.
  • Usage Data: Pages visited, features used, clickstream data, session duration, referring URLs.
  • Location Data: Approximate location derived from IP address. We do not collect precise GPS location without your explicit consent.
  • Cookies and Similar Technologies: See our separate Cookie Policy for details.

2.3 Information from Third Parties

We may receive personal data from third parties, including authentication providers (Auth0), analytics services, and business partners.

3. Legal Bases for Processing (EU/EEA/UK Users)

Under the GDPR, we process your personal data only when we have a valid legal basis. The legal bases we rely on include:

  • Consent (Art. 6(1)(a) GDPR): Where you have given clear consent for us to process your personal data for a specific purpose, such as receiving marketing communications or the use of non-essential cookies.
  • Performance of a Contract (Art. 6(1)(b) GDPR): Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract, such as providing our Platform services.
  • Legitimate Interests (Art. 6(1)(f) GDPR): Where processing is necessary for our legitimate interests or those of a third party, provided your rights do not override those interests. This includes improving our Platform, ensuring security, and conducting analytics.
  • Legal Obligation (Art. 6(1)(c) GDPR): Where processing is necessary to comply with a legal obligation to which we are subject.

You may withdraw your consent at any time by contacting us at info@flashpoint.ai or dpo@flashpoint.ai. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

  • Providing and Maintaining the Platform: Operating, maintaining, and improving our services, features, and functionality.
  • Authentication and Security: Verifying your identity, detecting fraud, and ensuring the safety and security of our Platform.
  • Research and Development: Developing, testing, and improving our AI and machine learning models, including algorithm development. Where possible, we employ data anonymization and pseudonymization techniques.
  • Communications: Sending transactional messages, responding to inquiries, and providing customer support.
  • Marketing: With your consent (where required), sending promotional communications about our services. You may opt out at any time.
  • Analytics: Understanding how our Platform is used to optimize performance and user experience.
  • Legal Compliance: Complying with applicable laws, regulations, legal processes, or enforceable governmental requests.

5. How We Share Your Personal Data

We do not sell your personal data. We may share your personal data with the following categories of recipients:

  • Subprocessors and Service Providers: Third-party vendors who process data on our behalf to help operate and improve our Platform. All subprocessors are bound by Data Processing Agreements. See our Subprocessor List at flashpoint.ai/subprocessors.
  • Affiliates: Our subsidiaries and affiliates for purposes consistent with this Privacy Policy.
  • Professional Advisors: Lawyers, auditors, and accountants as necessary for our business operations.
  • Legal and Regulatory Authorities: When required by law, regulation, legal process, or governmental request.
  • Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, in which case you will be notified of any change in controller.
  • With Your Consent: For any other purpose disclosed to you with your consent.

6. International Data Transfers

Your personal data may be transferred to and processed in the United States, where our servers and primary operations are located. For EU/EEA/UK users, we ensure that international transfers of personal data are protected by appropriate safeguards, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Data Processing Agreements with all subprocessors.
  • Technical and organizational security measures to protect your data in transit and at rest.

You may request a copy of the safeguards in place by contacting dpo@flashpoint.ai.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Specific retention periods include:

  • Account Data: Retained for the duration of your account and up to 30 days after account deletion.
  • Transaction Records: Retained for up to 7 years as required by tax and financial regulations.
  • Usage and Analytics Data: Retained for up to 26 months, then anonymized or deleted.
  • Marketing Consent Records: Retained for the duration of consent plus 3 years.
  • Survey and Research Data: Retained as necessary for the applicable research purpose, then anonymized or deleted.

When personal data is no longer required, we will securely delete or anonymize it.

8. Your Rights

8.1 Rights of EU/EEA/UK Residents

Under the GDPR, you have the following rights regarding your personal data:

  • Right of Access (Art. 15): You have the right to request a copy of the personal data we hold about you.
  • Right to Rectification (Art. 16): You have the right to request correction of inaccurate or incomplete personal data.
  • Right to Erasure (Art. 17): You have the right to request deletion of your personal data, subject to certain exceptions.
  • Right to Restriction of Processing (Art. 18): You have the right to request that we restrict the processing of your personal data in certain circumstances.
  • Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format.
  • Right to Object (Art. 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes.
  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence. A list of EU data protection authorities is available at https://edpb.europa.eu.

To exercise any of these rights, please contact us at dpo@flashpoint.ai. We will respond to your request within 30 days.

8.2 Rights of U.S. Residents

Depending on your state of residence, you may have additional rights under state privacy laws, including the CCPA. These may include the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell your personal information. To exercise your rights, contact us at info@flashpoint.ai.

9. Cookies and Similar Technologies

We use cookies and similar technologies on our Platform. For detailed information about the cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy available at flashpoint.ai/cookies.

EU/EEA/UK users: We will obtain your consent before placing non-essential cookies on your device, through our cookie consent banner. You may withdraw consent at any time through the cookie settings on our Website.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS) and at rest, access controls, regular security assessments, and employee training. However, no method of transmission over the Internet or electronic storage is 100% secure. If you become aware of any security breach, please contact us immediately at info@flashpoint.ai.

11. Children's Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe we may have collected data from a child, please contact us at info@flashpoint.ai.

12. Automated Decision-Making

Our Platform may use automated processing, including AI and machine learning, to improve our services and analyze data. These technologies do not make decisions that produce legal effects or similarly significantly affect you based solely on automated processing. Where automated decision-making is used, it is subject to human review. You have the right to request human intervention, express your point of view, and contest any automated decision by contacting us at dpo@flashpoint.ai.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting a prominent notice on our Platform and, where required by law, by email. The date this policy was last updated is indicated at the top of this page. We encourage you to review this Privacy Policy periodically.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

General Inquiries:

Natural Language Labs Inc. d/b/a Flashpoint.AI

228 Park Ave S. #65771

New York, NY 10003

Email: info@flashpoint.ai

Telephone: 347-931-6225

Data Protection Officer (EU/EEA/UK Inquiries):

Email: dpo@flashpoint.ai

Representative:

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/16685315399

We will endeavor to respond to all requests within 30 days.