Last updated: October 10, 2026
This policy explains how your personal data is processed when you visit the thinkingplatforms.com website (the “Site”) or use the FlowOS application, in accordance with Regulation (EU) 2016/679 of April 27, 2016 (the “GDPR”) and French Law No. 78-17 of January 6, 1978 on information technology, data files and civil liberties (the “French Data Protection Act”).
Data collected on the Site is processed by Laystone Group SAS, the data controller, a simplified joint-stock company registered with the Paris Trade and Companies Register under number 950 791 681, whose registered office is at 60 rue François Ier, 75008 Paris, France, and which operates Thinking Platforms.
When a client company uses FlowOS, it is the controller of the data that it and its employees entrust to the application. Laystone Group SAS then acts as a processor within the meaning of Article 28 of the GDPR, on behalf of and on the documented instructions of the client company, under the agreement and the data processing agreement (DPA) entered into with it (see section 10).
Laystone Group SAS remains the controller of the processing it carries out on its own behalf as part of its business relationship with its clients (contract management, invoicing, exchanges with the client's contacts).
For any question about your personal data or this policy, write to contact@thinkingplatforms.com or by post to Laystone Group SAS, 60 rue François Ier, 75008 Paris, France.
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| “Request a demo” form | First name, last name, business email, company, phone (optional), industry, company size, description of your needs, agreement to be contacted | Respond to your request, organize and deliver the demo | Pre-contractual measures taken at your request (Article 6(1)(b) GDPR) |
| Sales contact form | First name, last name, business email, company, team size, intended scope, description of the problem | Review your project and reply to you | Pre-contractual measures taken at your request (Article 6(1)(b) GDPR) |
| Demo request form on the FlowOS presentation | Email, company name | Contact you to arrange a demo | Pre-contractual measures taken at your request (Article 6(1)(b) GDPR) |
| Email exchanges | Data you send us (identity, contact details, content of the message) | Reply to your message and follow up on your request | Legitimate interest in responding to requests received (Article 6(1)(f) GDPR) |
| Prospect relationship follow-up | Data from the requests above, history of exchanges | Follow up commercially on your request and inform you about our offers related to your professional activity | Legitimate interest (Article 6(1)(f) GDPR); you can object at any time |
| Site preferences | Language, light or dark theme, acknowledgment of the information banner, temporary display filter (stored only in your browser) | Run the Site and remember your preferences | Storage strictly necessary for the service requested (Article 82 of the French Data Protection Act) |
| Hosting provider's technical logs | IP address, date and time of connection, page requested, browser type | Ensure the security and proper operation of the Site | Legitimate interest (Article 6(1)(f) GDPR) and the hosting provider's legal obligations |
The information requested in the forms is necessary to process your request, except where marked as optional. We do not add you to any mailing list without your agreement. The Site does not carry out any automated decision-making or profiling concerning you.
Your data can only be accessed by the people at Laystone Group SAS in charge of handling your request and of the business relationship. It is neither sold nor rented. It may be disclosed to the service providers below, who act on our behalf, and to the authorities where required by law.
| Provider | Role | Data concerned | Location |
|---|---|---|---|
| OVH SAS, 2 rue Kellermann, 59100 Roubaix, France | Hosting of the Site, domain name and the contact@thinkingplatforms.com mailbox | Technical logs, emails received | European Union (France) |
| FormSubmit (formsubmit.co) | Delivery of the Site's forms to our mailbox | Content of the forms, IP address | Outside the European Union (see section 5) |
| Google (Google Fonts service) | Supply of the Instrument Serif font on a few pages | IP address, technical browser information | Possibly outside the European Union (United States) |
| Provider | Role | Data concerned | Location |
|---|---|---|---|
| Application hosting provider | Hosting of the application and data, defined with each client before deployment | All application data | Defined in the agreement and the DPA |
| AI model providers, depending on the setup chosen by the client: Anthropic, OpenAI, Google, Mistral AI, or open-source models hosted in Europe | Processing of requests sent to agents | Content of the requests and documents sent to the model | Mistral AI and models hosted in Europe: European Union; other providers: possibly outside the European Union |
| Resend | Sending transactional emails (invitations, password resets, approvals, scheduled task notifications) | Email address, name, content of the message | Possibly outside the European Union; specified in the DPA |
| Nango | Management of connections to third-party tools authorized by users | Connection tokens, technical identifiers of connected accounts | Specified in the DPA |
The up-to-date list of FlowOS sub-processors, their location and the associated safeguards are set out in the data processing agreement entered into with each client, in accordance with Article 28 of the GDPR.
Some providers are established or process data outside the European Union, in particular in the United States: FormSubmit, Google for the Google Fonts service and, for the FlowOS application, depending on the setup chosen by the client, some AI model providers and technical service providers.
Where data is transferred to a country that does not benefit from an adequacy decision of the European Commission, the transfer is governed by the standard contractual clauses adopted by the European Commission (Article 46 GDPR) or, where the recipient has joined it, by the EU-U.S. Data Privacy Framework, which is the subject of the adequacy decision of July 10, 2023.
The Site's forms are delivered by FormSubmit, a service established outside the European Union. This transfer, limited to the content of the form and the technical data of the submission, is necessary to deliver the request you send us (Article 49(1)(b) GDPR). If you prefer that no data leaves the European Union, write to us directly at contact@thinkingplatforms.com, an address whose mailbox is managed by OVH SAS.
You can obtain information about the applicable safeguards by writing to the same address.
In accordance with the GDPR and the French Data Protection Act, you have the following rights over your data:
For data processed in the FlowOS application, please first send your request to your employer or to the client company concerned, which is the data controller. Laystone Group SAS assists it in responding, in accordance with the DPA. If you write to us directly, we will forward your request to the company concerned.
To exercise your rights, write to contact@thinkingplatforms.com or by post to Laystone Group SAS, 60 rue François Ier, 75008 Paris, France, stating the right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information to verify it.
We reply within one month of receiving your request. This period may be extended by two months, taking into account the complexity or number of requests; in that case you will be informed within the first month.
If, after contacting us, you consider that your rights have not been respected, you can lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at www.cnil.fr.
Laystone Group SAS implements appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure or alteration, including an encrypted connection to the Site (HTTPS), a content security policy that restricts the scripts allowed to run, and access to data limited to the people who need it.
For the FlowOS application, security measures are presented on the Security page and specified in the DPA entered into with each client.
The Site sets no advertising cookies and uses no audience measurement tool, pixel or third-party tracker. It only uses the browser storage that is strictly necessary for it to work:
| Key | Type | Purpose | Duration |
|---|---|---|---|
| tp-theme | Local storage (localStorage) | Remember the light or dark theme you chose | Until you erase it |
| tp-lang | Local storage (localStorage) | Remember the language you chose | Until you erase it |
| tp-consent | Local storage (localStorage) | Remember that you have seen the information banner | Until you erase it |
| fos-filter | Session storage (sessionStorage) | Pass the agent category chosen in the menu to the home page | Erased as soon as it is read or when the tab is closed |
In accordance with Article 82 of the French Data Protection Act and the CNIL guidelines, this storage, being strictly necessary for the service you request, does not require your consent. A banner informs you of it on your first visit. You can display it again at any time (show the information banner) and erase this data from your browser settings.
A few pages of the Site load the Instrument Serif font from the Google Fonts service. This sends your IP address and technical information about your browser to Google. The other fonts are hosted directly on the Site.
If an audience measurement tool or any other tracker requiring consent were added, it would only be activated after your agreement, collected through a banner that lets you accept or refuse just as easily, and this policy would be updated.
The FlowOS application uses your browser's storage for the session and your preferences; it contains no advertising and no third-party audience measurement tool.
Data that client companies and their employees entrust to FlowOS (user accounts, documents, requests sent to agents, connections to tools) is processed by Laystone Group SAS as a processor, on behalf of the client company and according to its instructions. The purposes, data categories, retention periods, sub-processors and security measures are set in the agreement and the data processing agreement entered into with each client. The information below describes how the product works.
Employee accounts (name, business email, role) are created by the client company or at its initiative. Transactional emails (invitations, password resets, approvals, scheduled task notifications) are sent through the Resend service.
Connections to third-party tools authorized by the company or the user are managed through the Nango service. Connection tokens stay on the server and are never passed to the browser.
When an employee connects their mailbox (Outlook or Gmail) or calendar (Outlook or Google), FlowOS accesses it through an OAuth connection they authorize themselves and can revoke at any time. Emails and events are read at the user's request, for the task they start. FlowOS can create draft replies; it never sends an email automatically. Connection tokens stay on the server and are never passed to the browser.
Microsoft Teams and Zoom meeting transcripts are read at the user's request, to produce minutes, a list of decisions and actions, or a summary. They are not stored by FlowOS: only the minutes the user chooses to save become a document in FlowOS, private by default.
When the company installs the FlowOS app in Slack or Teams, only messages addressed to FlowOS (mention, command or direct message) and the earlier messages in the same thread are processed, to answer the request. The server keeps the audit log, usage and saved deliverables, not the conversations. Files attached in Slack or Teams are not read.
The FlowOS Companion browser extension only reads a page, a selection or an open email when the user starts an action, and never on domains excluded by the user or the company. Data is sent only to the company's FlowOS server. Details in the Companion privacy policy.
Depending on the setup agreed with each client, requests are processed by models from Anthropic, OpenAI, Google or Mistral, or by open-source models hosted in Europe. Data sent is processed under these providers' terms for their professional offerings, reviewed with the client. Thinking Platforms does not train models on its clients' data.
FlowOS hosting and data location are defined with each client before deployment.
A data processing agreement compliant with Article 28 of the GDPR is entered into with each client. It sets out the purposes, data categories, sub-processors, retention periods and security measures.
The Site and the FlowOS application are intended for professionals and not for minors. We do not knowingly collect data concerning them. If you believe a minor has sent us data, write to us so that we can delete it.
We may change this policy to reflect legal or technical developments or changes to our services. The current version is published on this page with its update date.
See also the legal notice and the website terms of use.