FloQast

FloQast explicitly states that Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models. This clear disclaimer provides enterprise-friendly protection against AI training on user data.

“[Privacy] "To the extent that FloQast's products leverage Google Workspace APIs, such APIs are not used to develop, improve, or train generalized AI and/or ML models"”

The documents do not explicitly address the scope of content licenses granted by users to FloQast. While the privacy policy describes data collection and use for service improvement and marketing, there is no clear statement limiting the license to service delivery only or addressing sublicensing rights. This absence of explicit protection warrants a moderate concern score.

“Not found in documents — scored conservatively”

FloQast shares data with service providers, affiliates, and third-party analytics/advertising companies. While some controls exist (e.g., opt-out mechanisms for cookies), the policy permits broad sharing with 'third-party business partners' and 'analytics, advertising, and other similar marketing partners' without explicit DPA requirements listed. The sharing is permitted but not comprehensively restricted.

“[Privacy] "We may also share (or permit third parties to collect) certain information, such as Usage Information, aggregated, de-identified, or hashed information with these third parties for similar purposes... third-party analytics, advertising, and other similar marketing partners may have access to your identifiers, commercial information, internet or other electronic network activity"”

FloQast states data is retained 'for only as long as it is reasonably necessary' and 'while you have an account with us, or while you are using the Site or our services or continuing to interact with us.' This is vague regarding specific retention periods and does not clearly define what 'reasonably necessary' means or provide automatic purge timelines upon account termination.

“[Privacy] "We retain Personal Information for only as long as it is reasonably necessary for the purposes set out in this Notice and our privacy policy... Except where we have otherwise disclosed or agreed, we retain your personal information while you have an account with us, or while you are using the Site or our services or continuing to interact with us."”

The documents do not explicitly address IP ownership of outputs or content generated through FloQast's service. The absence of a clear statement that users retain all IP rights to generated content, or conversely that FloQast claims no rights, creates ambiguity and warrants a moderate concern score.

“Not found in documents — scored conservatively”

FloQast mentions self-certification with the EU-U.S. Data Privacy Framework and UK/Swiss extensions, but does not explicitly reference SOC 2 Type II, ISO 27001, HIPAA, or other standard security certifications. The policy states 'commercially reasonable security methods' but lacks comprehensive compliance documentation.

“[Privacy] "FloQast has self-certified compliance with the EU-U.S. Data Privacy Framework, the UK extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce"”