Your data at Flaynn
Flaynn collects only the strict minimum needed to analyse the dossiers submitted by investors and founders. This page details what we collect, why, for how long, and how to exercise your rights.
1. Data controller
The controller of your personal data is Flaynn, which can be contacted at contact@flaynn.fr. The detailed contact details of the publisher are available on the legal notice page Legal notice.
2. Data collected
2.1 Identification data
When you create an account, we collect: first name, last name, email address, password (hashed, never stored in plain text), role (founder, investor, analyst).
2.2 Data submitted in forms
Depending on your role:
- Founders: information about your startup (name, sector, traction, team, deck), answers to the scoring questions, and optionally your SIREN or SIRET number to allow automatic enrichment of your dossier via the public RNCS and INSEE databases (share capital, directors, legal form, NAF codes). Providing this number is optional and is not a condition of using the platform.
- business angels: investment preferences (ticket sizes, sectors, geographies), notes and votes on the deals you have viewed.
2.3 Technical data
IP address (for security), user agent (browser, OS), URLs visited, timestamp. See the cookie policy for details.
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Account creation and management, authentication | Performance of the contract (GDPR 6.1.b) | Duration of the contractual relationship + 3 years (civil limitation period) |
| Evaluation of dossiers (founder scoring) | Performance of the contract (GDPR 6.1.b) | Duration of the contractual relationship |
| RCS enrichment via the declared SIREN or SIRET (public RNCS and INSEE data) | Performance of the contract (GDPR 6.1.b) upon the founder's voluntary declaration | Duration of the contractual relationship |
| Dossier sharing initiated by its owner (revocable link) | Performance of the contract (GDPR 6.1.b) | Duration of the contractual relationship |
| Invitation to submit a dossier, issued by Flaynn or by an investor: the founder's email address, first and last name, and startup name, entered by the issuer | Legitimate interest (GDPR 6.1.f) | Unused invitation: 30 days after it expires. Used invitation: as long as the submitted dossier exists |
| Follow-up of a dossier's progress by the investor who invited its founder | Consent (GDPR 6.1.a), optional, and may be withdrawn at any time from the Atelier | Until consent is withdrawn, the follow-up is stopped or the dossier is deleted, whichever comes first |
| Named invitation of a co-investor to read a dossier: the co-investor's name and email address, entered by the investor who invites them | Legitimate interest (GDPR 6.1.f) | 30 days after access ends (link expiry or removal by the investor), then anonymisation |
| Submitting a deck by forwarding an email, at an investor's initiative: addresses of the investor and of the original sender, email subject, attached PDFs, and the name, pitch, sector, stage, country, city and website read from the deck. Flaynn does not keep the body of the email. | Performance of the contract (GDPR 6.1.b) towards the investor; legitimate interest (GDPR 6.1.f) for the original sender's data | Deck not launched: 30 days, then deleted with its files and metadata. Deck ignored: files deleted at once, the rest the following night. Deck launched: it becomes a file, kept like the others |
| Security, fraud prevention, access logs | Legitimate interest (GDPR 6.1.f) | 13 months (connection logs) |
| Transactional communication (service emails) | Performance of the contract (GDPR 6.1.b) | Duration of the contractual relationship |
| Audience measurement (optional, with consent) | Consent (GDPR 6.1.a) | 13 months max (CNIL) |
4. Recipients and processors
Your data is accessible to the Flaynn teams strictly within the scope of their duties. To provide the service, we use the following providers, presented by category:
- Stripe (Stripe Payments Europe Ltd): payment processing (audits, subscriptions). This provider may process data outside the European Union. Stripe privacy policy.
- Host: application and database in the Frankfurt region (Germany). See the legal notice.
- Service emails: email provider, which receives the recipient's address and the content of the message.
- Internal alerts: notifications to the Flaynn team (event, reference and startup name, link to the internal console), through a self-hosted automation tool and an instant messaging service.
- Automated analysis of the dossier: to produce the pre-diligence, the uploaded documents and the form are sent to the analysis engine provider, and the form to the public-information search provider. When document reading is active, the text extracted from the documents is also sent to the provider that draws a company profile from it and to the counter-analysis provider, and the search relies on items from that profile. Other providers orchestrate the steps and generate the report from the form and the results, without the uploaded files. To check the quality of the analysis, a dossier may also be sent, during control runs, to other technical providers that we compare; these runs change neither the analysis served nor the report. These data may contain personal data of the founder and of persons named in the documents. A copy of the report is kept in an online document attached to a Flaynn account for as long as the dossier exists. These providers may process data outside the European Union, notably in the United States.
- Idea pre-score: on the « Test my idea » page, the text you enter (one or two sentences) is sent to a technical analysis provider to compute an indicative pre-score. Flaynn does not store it. Do not enter any confidential information.
- Receiving forwarded emails: when an investor forwards an email to their submission address, an email reception provider receives it (addresses, subject, body and attachments) and keeps it for at most 30 days. Flaynn keeps only the subject, the addresses and the attached PDFs.
Each investor whose follow-up you have accepted, by ticking the box when submitting or from your Atelier: startup name, date of each published analysis you have opened and, if your agreement states it, its completeness, number of missions by status. Never the score, the reading signal, the report, the documents or the content of the missions.
No data is sold to commercial third parties. Some providers may process data outside the European Union, notably in the United States. The safeguards that apply to these transfers are available on request at contact@flaynn.fr.
5. Your rights
In accordance with the GDPR (art. 15 to 22), you have the following rights at any time:
- Access: obtain a copy of your data.
- Rectification: correct inaccurate data.
- Erasure ("right to be forgotten", art. 17): delete your account and your data from your My account area. Deletion erases your account, your dossiers and their documents, including those you had withdrawn from your space, the analyses, the reports and your notes; your address is removed from our usage logs and invitation registers. You receive a dated confirmation. Only the following remain: our audit log, which cannot be modified, with the record of the deletion, for five years, so that we can prove it, and the record of actions already logged on your account and your dossiers (for a submission, for example: its date, the account address and the startup name); our analysis cost register, which keeps only the dossier reference, a numeric account identifier and the costs, without the content of the dossier; any invoices held by our payment provider, for ten years, as required by accounting law. Copies held by our providers, including any backups kept by our host, are deleted according to their own retention periods. An investor can also withdraw a dossier from their space at any time: the dossier no longer appears there, but it is not erased; to have it permanently deleted, documents included, write to contact@flaynn.fr.
- Portability (art. 20): receive your data in a structured, machine-readable format.
- Restriction (art. 18) and objection (art. 21) to processing.
- Withdrawal of consent at any time (optional cookies).
To exercise your rights: contact@flaynn.fr. Response within 1 month (extendable by 2 months for complex requests, art. 12.3).
If you believe your rights are not being respected, you may lodge a complaint with the CNIL: cnil.fr/fr/plaintes.
6. Security
The application and the database are hosted in the Frankfurt region (Germany) of our host. Passwords are hashed with a suitable algorithm (Argon2 or bcrypt). Communications are encrypted in transit (TLS 1.2+). Sensitive actions (administrator login, impersonation, account deletion, password change) are recorded in a time-stamped audit log.
If a personal data breach occurs (loss, leak, unauthorised access): we contain it as soon as it is discovered and assess the risk at once; we notify the CNIL within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people (GDPR, art. 33); if the risk is high, we inform each person concerned by email without undue delay: what happened, the data involved, the likely consequences, the measures taken and what they can do (art. 34). Every breach, notified or not, is recorded in our internal register (art. 33.5). Our processors must notify us without delay of any breach affecting them.
7. Updates to this policy
This page will be updated whenever there is a significant change in processing. The date below indicates the latest revision.
