Consault Privacy Policy

Effective date: 9 October 2026
Last updated: 21 October 2026

This Privacy Policy explains how Flvxtract Technologies Limited ("Consault", "we", "us" or "our") collects, uses, shares and protects personal data when you use Consault's websites, applications, AI assistants, workspaces, communications, billing services and related services (together, the "Services").

It also explains the choices and rights available to you. If you use Consault for an organisation, that organisation may control some of the data processed through its workspace. In that case, you should also read the organisation's privacy information.

1. Who is responsible for your data

Flvxtract Technologies Limited, company registration number 9469183, based in Lagos, Nigeria, is the data controller for account administration, platform security, billing, product operation and our direct relationship with you.

When a customer uses Consault to process personal data belonging to its staff, customers, app users or other people, that customer generally decides why and how the data is used. The customer is the controller and Consault acts as its processor or service provider under the customer's instructions. Customers must have a lawful basis for placing that data in Consault and for instructing Consault and its agents to act on it.

Questions or requests can be sent to [email protected]. Our Privacy Lead, Adetoye Olamisegbe, is responsible for coordinating data-protection requests.

2. Data we collect

The data we process depends on the features you use and the permissions you give Consault.

Account and organisation data

We may collect your name, email address, profile photo, biography, location, website, birthday month and day, login method, organisation, role, team memberships, invitations and preferences. If you sign in through Google or Microsoft, we receive the profile and authentication information you authorise that provider to share.

Content and work data

We process the content you and your organisation place in Consault, including:

• conversations with your personal assistant and workspace agents;
• instructions, prompts, responses, reactions, decisions and approvals;
• work items, documents, files, images, audio, video and generated media;
• source code, repository data, branches, commits, build output and test results;
• screenshots, browser output, terminal output and other task evidence;
• app configuration, deployment details, domains, logs, metrics, incidents and operational records; and
• data from a live app when you authorise Consault to help operate that app.

This content may include personal data about you or other people. You decide what you submit and what systems you connect.

Connected service data

When you connect a service such as GitHub, Bitbucket, Jira, Confluence, Telegram, WhatsApp, a hosting provider, analytics provider or another third-party application, we process the identifiers, configuration, content and credentials needed to provide the connection. Credentials and secrets are encrypted or sealed at rest and access is restricted, but you remain responsible for granting only the permissions Consault needs.

Google user data (Gmail and Google Calendar)

If you connect a Google account to Consault, we ask Google for permission to:

• read and search the messages in your Gmail (gmail.readonly);
• create drafts, and send an email only after you approve that email (gmail.compose);
• view, create and change events in your Google Calendar, a change only after you approve it (calendar.events); and
• know the email address of the Google account you connected (openid, email).

How we use it. We use Google user data only to carry out what you ask your assistant or agents to do with your mail and calendar, and to show you the result: for example, finding an email, summarising a thread, drafting a reply, checking when you are free or adding an event. We do not use it for any other purpose.

What we keep. The access Google grants is stored sealed (encrypted at rest). We do not keep a copy of your mailbox or calendar. Mail and events are fetched from Google when a task needs them. What your assistant reads or writes for you stays in that conversation's history, like anything else you share with it, and is deleted when you delete that conversation or your account.

AI processing. To carry out a task, the content involved is processed by the AI model running your assistant: your own Claude or ChatGPT account if you connected one, or Consault's AI-provider accounts. Google user data is never used to develop, improve or train generalised AI or machine-learning models, by Consault or by those providers. Model training is switched off on Consault's AI-provider accounts, and before you connect Google while using your own AI account, you confirm that model training is switched off in that account.

Sharing. We do not sell Google user data, use it for advertising, or use it to determine creditworthiness or for lending. We transfer it only as needed to provide the feature you asked for (to the AI provider running the task, and to the hosting and storage providers that run Consault), to keep the Services secure, to comply with the law, or as part of a merger or acquisition with your data protected under terms at least as strict as these.

People. No one at Consault reads your Google user data unless you ask us to for a specific item (for example, in a support request), it is necessary for security (such as investigating abuse), or the law requires it.

Removing access. Disconnect Google in Consault's connectors settings at any time. We then delete the stored access and revoke it with Google. You can also remove Consault's access at myaccount.google.com/permissions.

Consault's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meetings, calls and voice data

If you ask your assistant to join a call or meeting, or speak with it by voice, we may process:

• the meeting link, title, description, time and platform;
• participant display names and active-speaker information exposed by the meeting service;
• live audio, voice notes, transcriptions, assistant responses and meeting notes;
• the assistant name and voice you select; and
• diagnostic data needed to connect, hear, speak, mute and leave.

Live meeting audio may be sent to an AI speech provider so the assistant can understand and respond. The assistant may not reliably identify a speaker unless the meeting platform supplies usable speaker information. You must tell participants that an AI assistant is present and obtain any consent required to record, transcribe or process their voices.

Billing and transaction data

We process your plan, Consault Credit balance, usage, invoices, tax location, currency, payment status and transaction references. Payments are handled by our payment provider. We may receive a reusable payment authorisation or token, card brand, masked card details and related billing metadata. We do not intend to store your full card number or security code.

Device, usage and security data

We collect information needed to operate and secure the Services, including IP address, browser and device type, operating system, app version, session identifiers, authentication events, actions taken, error reports, service logs, performance information and suspected abuse or security events.

Communications

We process messages you send to support, security, privacy or sales, and notices sent through email, web notifications, Telegram, WhatsApp or other channels you connect.

3. Where the data comes from

We obtain data:

• directly from you and other members of your organisation;
• from the devices, repositories, apps and services you connect;
• from people who communicate with an app or channel you operate through Consault;
• automatically when you use the Services; and
• from sign-in, payment, infrastructure and communications providers.

4. Why we use data and our lawful bases

We process personal data only where we have a lawful basis. Depending on the context, we use data to:

Where we rely on legitimate interests, we consider the effect on your rights and expectations. Where consent is required, you may withdraw it at any time, although withdrawal does not affect earlier lawful processing.

5. How AI processing works

Consault uses AI models to understand instructions, generate content and code, operate tools, assist with live apps, remember relevant context and support voice interactions.

You may connect your own Anthropic Claude or OpenAI ChatGPT account or subscription. In that case, content sent through that connection is also governed by your agreement and settings with that provider. Consault may use its own commercial AI-provider subscription accounts for paid-plan workspace agents and for the personal assistant's managed usage. Workspace-agent turns are not sent through Consault's API-key account. Consault may use commercial API accounts for paid personal-assistant overage, media generation, meetings, voice or other features disclosed in the product.

Consault does not currently train a general-purpose foundation model on Customer Content. However, third-party AI providers process data under their own terms, account type, retention settings and contractual arrangements. We do not promise that every third-party service has the same retention or model-training treatment. Google user data is the exception: it is never used to train AI models (see "Google user data" in section 2). The current providers and purposes are listed in our Subprocessor and Third-Party Provider List.

AI output can be inaccurate. Consault may ask for approval before higher-impact actions, but you and your organisation remain responsible for reviewing decisions, outputs and actions appropriate to the context.

6. When we share data

We may share data with:

• service providers and subprocessors that host, secure, analyse or deliver the Services;
• AI and media providers that process prompts, files, audio or other content needed for a requested feature;
• services you connect or direct us to use, such as repositories, ticketing systems, communication channels, meeting platforms and deployment providers;
• members and administrators of your organisation, according to roles, permissions and workspace settings;
• professional advisers and transaction participants, where reasonably necessary for legal, accounting, financing, insurance, acquisition or restructuring work; and
• public authorities or other parties, where disclosure is legally required or reasonably necessary to protect people, rights, property or the Services.

We do not sell personal data for money. We do not share personal data for targeted advertising across unrelated services unless we first provide any notice and choice required by applicable law.

7. International data transfers and hosting location

Consault's primary TechBeaver infrastructure and PostgreSQL database are hosted in Europe. Consault and its other providers may also process data in countries other than the country where you live. Those countries may have different data-protection laws. Where required, we use contractual protections or another lawful transfer mechanism.

Consault does not currently promise that all Customer Content remains in a user-selected country or region. A customer's deployed app may have its own selected region, while Consault account data, prompts, runner copies, logs, artifacts, media and provider processing may occur elsewhere. Enterprise data-location commitments apply only when stated in a signed agreement.

8. Data retention

We keep personal data only as long as reasonably needed for the purposes described here, including providing the Services, maintaining security, resolving disputes and meeting legal, accounting and tax obligations.

Retention depends on the type of data and the customer's configuration:

• account, organisation and billing records are kept while the account is active and afterward where required for legal or operational reasons;
• workspace content, code, chats and operational records are kept while the workspace or account remains active, unless deleted, archived or covered by another agreed schedule;
• unselected or draft generated-media variations may be deleted after 30 days, while media you keep may remain until you delete it or close the relevant service;
• some test artifacts may use a 30-day default where that retention setting is enabled;
• short-lived authentication codes expire quickly and related records are removed on a limited schedule;
• security and agent-action audit logs are normally kept for 90 days, and routine diagnostic logs for up to 30 days;
• individual visit records are kept for 90 days, and daily visit totals and the first-touch source of new accounts for 400 days (section 12);
• support records are normally kept for 24 months after the issue is resolved;
• transaction, invoice and accounting records are kept for at least six years where required by Nigerian law;
• production backups are kept on a rolling 30-day cycle once the production backup service is enabled; and
• after termination, we normally provide a 30-day export period and then remove Customer Content from active systems within 30 days, unless law, security or a dispute requires longer retention.

Deletion from active systems may not immediately remove information from encrypted backups. Backup copies are isolated from ordinary use and removed according to the backup cycle.

9. Security

We use administrative, technical and organisational safeguards designed to protect data. These include access controls, server-side permissions, authentication protections, encrypted or sealed credential storage, logging, environment boundaries and approval controls for certain agent actions.

No system is completely secure. You should protect your account, review connected-service permissions, keep secrets out of ordinary chat where a vault or secret field is available, and promptly report suspected compromise to [email protected].

10. Your rights and choices

Depending on where you live and the context, you may have the right to:

• receive information about how we use your data;
• access a copy of your personal data;
• correct inaccurate or incomplete data;
• ask us to delete data;
• restrict or object to certain processing;
• withdraw consent;
• receive portable data in an appropriate format;
• object to certain direct marketing;
• ask for human review of a decision based solely on automated processing where applicable; and
• complain to a data-protection authority.

To exercise a right, contact [email protected]. We may need to verify your identity and authority. If an organisation controls the data, we may direct your request to that organisation or help it respond. Rights can be limited by law, the rights of others, security needs and valid retention obligations.

You may complain to the Nigeria Data Protection Commission through its published channels. If you live elsewhere, you may also have the right to contact your local supervisory authority.

11. Organisation administrators

If you use an account provided by an organisation, its owners and administrators may be able to access and control your account, workspace content, activity, connected services and retention settings. They may suspend access or export content. Contact your organisation if you have questions about its instructions or policies.

12. Cookies, local storage and visit counting

Consault uses cookies, local storage and similar technologies needed for sign-in, security, preferences and core service operation. We do not use advertising or tracking cookies.

Visit counting

We count visits to Consault's website and web app so we know how many people visit, where they come from and which pages they open. We do this ourselves, without cookies and without identifying you:

• Nothing is stored on your device for counting: no cookie, no local or session storage, no identifier and no device fingerprint.
• When a page opens, your browser sends us the page's address with account, document and other identifiers removed; the name of the website that linked to it (for example x.com, never the full link); any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content and utm_term); a rough screen size (phone, tablet, laptop or desktop); whether the screen is a touch screen, which we use only to tell tablets from computers and do not keep; and whether you are signed in, as a yes or no only, never who you are.
• To count each visitor once a day, our server combines your IP address, your browser's details and the site with a random value that changes every day, and turns them into a code that cannot be turned back into any of them. The random value is held only in memory and deleted at the end of each day, so your visits cannot be linked from one day to the next. Consault does not store your IP address for visit counting or write it to our logs for these requests. To stop floods of fake visits, a scrambled form of the IP address is held in memory for one minute and then discarded.
• We also keep the country of the visit, as provided by our network provider, Cloudflare (never your city), and the general type of device, browser and operating system (for example phone, Chrome, Android).
• We do not count visits from browsers that send a Do Not Track or Global Privacy Control signal, from automated tools and search engine crawlers, from pages a browser loads in advance, or from Consault's own administration pages.
• When you create an account, we note where you first came from on that visit (the linking website's name and any campaign tags) against your new account, so we can count which sources bring sign-ups. We use this only in totals and never show it about any individual. It is not sent if your browser sends a Do Not Track or Global Privacy Control signal, and it is deleted when your account is deleted or after 400 days, whichever comes first.
• Individual visit records are kept for 90 days, and daily totals for 400 days, in Consault's own database. They are not shared with any third party or analytics provider and are not used for advertising.

We rely on our legitimate interest in understanding how our website and app are used. Because the counting does not store anything on your device or identify you, it is not the optional product analytics described below.

Optional product analytics

Optional product analytics is off at launch. If we later offer internally built analytics to understand product use, first-party analytics records will be stored with Consault's other product data and will not be shared for unrelated advertising. Where law requires it, optional analytics will remain off until you make a choice, and you will be able to change that choice later.

13. Children

The Services are intended for people aged 18 or older and are not directed to children. We do not knowingly allow a child to create an account. If you believe a child has provided personal data, contact [email protected]. This section does not prevent an authorised customer from using Consault to build a service intended for younger users; that customer remains responsible for the additional safeguards, notices and consents its service requires.

14. Changes to this policy

We may update this Policy as the Services or law changes. We will post the updated version and revise the date above. If a change materially affects how we use personal data, we will provide reasonable advance notice through the Services or another appropriate channel and request consent where required.

15. Contact us

Flvxtract Technologies Limited
Company registration number: 9469183
Lagos, Nigeria
Privacy: [email protected]
Security: [email protected]
Support: [email protected]