In Caflou, you can use optional features based on artificial intelligence to help you work with the content, data and processes in your account.

These features include, for example, the AI Agent, including voice interaction, data analysis and predictions, summaries of information and communications, document data extraction, speech-to-text conversion, voice commands, text suggestions, translations, work planning and the creation of other content. We continuously expand the range of available AI features.

For an up-to-date overview, visit the Artificial Intelligence in Caflou page.

The use of AI features is optional. Data is transferred to the AI provider only in connection with the use of a specific AI feature, for example when you launch the feature, submit a request, upload a file, or schedule the feature to run automatically or at regular intervals.

What You Need to Know

1. You Are Interacting with Artificial Intelligence

Responses and content identified as AI-generated output are created by an artificial intelligence system, not by a human.

AI-generated output may be incomplete, inaccurate or unsuitable for your particular purpose. AI may misinterpret the information provided or generate statements that are not contained in the source data.

You should therefore always review AI-generated output as appropriate before using it, particularly if it may affect your customers, employees, contractual relationships, finances, accounting or other important decisions. AI-generated output does not replace legal, accounting, tax, HR or other professional advice or assessment.

2. Data from Your Account May Be Used for Processing

To enable an AI feature to fulfil your request, we may transfer data required for the relevant task to the AI provider.

Depending on the feature used, this may include, for example:

  • the text of your request;
  • previous messages within the relevant AI conversation;
  • relevant data and context from your Caflou account;
  • the content of selected projects, tasks, companies, contacts, emails or comments;
  • financial and operational data required for the requested analysis;
  • the content of documents, accounting documents or other files;
  • voice or audio input;
  • technical information required to process your request securely and correctly.

The scope of the data processed depends on the specific AI feature, your request, the selected context and your permissions. We aim to transfer only the data required to fulfil the relevant request.

We do not automatically send the entire content of your account. For example, if you ask the AI Agent to summarise a specific project, the data from that project required to create the summary may be transferred to the AI provider. If you upload a document for data extraction, the content of that document will be transferred for processing.

3. AI Features Respect Your Caflou Permissions

AI features work only with the data and operations available to you under your user permissions in Caflou.

Using AI does not, in itself, extend your access rights. For example, if you do not have permission to view a particular project or its financial data, the AI Agent should not make this information available to you either.

If the AI Agent can suggest or perform a particular action in Caflou, that action is subject to the same permissions and restrictions as if it were performed directly by the user. The AI Agent’s access to data and use of user permissions are described in more detail in the Caflou Help Centre: How to Work with the AI Agent in Caflou.

4. Some AI Features May Perform Actions

The AI Agent and other AI features may do more than generate responses or recommendations. Depending on the available functionality and your instructions, they may also prepare or perform an action in Caflou, such as creating a task, company, contact or comment.

Before submitting a request, consider its intended outcome. If Caflou asks you for additional confirmation before performing an important operation, check in particular the target object, the scope of the action and the data being used.

The AI Agent in Caflou can analyse data and perform actions. It can also work on the basis of templates that are run once or at regular intervals. More information is available in the Caflou Help Centre: How to Work with the AI Agent in Caflou.

AI Service Provider

We primarily use services provided through the OpenAI API to operate our AI features.

For customers in the European Economic Area, the contracting entity is OpenAI Ireland Ltd. OpenAI processes customer data on our behalf for the purpose of providing the relevant AI service, in accordance with its contractual terms and Data Processing Addendum: OpenAI Data Processing Addendum.

We may also use other providers for certain features. An up-to-date overview of these providers is available in our Privacy Policy, or in the current list of processors and subprocessors, as applicable.

If you connect Caflou to your own external AI assistant or another service, for example through an MCP server, the processing of data may also be subject to the terms and policies of that external provider.

How Data Is Handled

Use of Data for Model Training

Data sent through the OpenAI API is not used by default to train or improve OpenAI models unless the customer expressly permits the data to be shared for this purpose.

Caflou does not enable the voluntary sharing of customer content for the training of OpenAI models. OpenAI states that content submitted through its API is not used to train its models unless the customer explicitly opts in to sharing data for this purpose. For more information, see How OpenAI Uses Your Data.

Data Retention by the AI Provider

We have enabled Zero Data Retention for supported services and API endpoints. This mode excludes customer content from logs used for abuse monitoring and prevents it from being retained as application state by supported endpoints.

However, Zero Data Retention may not apply to every endpoint, tool or technical operation. Some features may require the temporary processing or storage of data in order to function, and some endpoints are not compatible with Zero Data Retention. OpenAI distinguishes between supported endpoints and features that may retain application state even when Zero Data Retention is enabled. For more information, see How OpenAI Uses Your Data.

The specific way in which data is processed therefore also depends on the feature used and its technical configuration.

Location of Processing and Transfers Outside the EEA

Depending on the configuration and the AI service used, data may also be processed outside the European Economic Area, particularly in the United States of America.

Where personal data is transferred outside the European Economic Area, appropriate safeguards under the GDPR are used, in particular the Standard Contractual Clauses approved by the European Commission or, where applicable, an adequacy decision issued by the European Commission.

OpenAI’s Data Processing Addendum provides that where data is transferred from the European Economic Area to a location outside the EEA, the Standard Contractual Clauses or an applicable adequacy decision issued by the European Commission must be used: OpenAI Data Processing Addendum.

For more information about the processing of personal data, the processors involved and the safeguards used, please see our Privacy Policy.

Information You Should Not Enter into AI Features

Do not enter data into AI features unless it is necessary to fulfil your request.

In particular, do not enter:

  • passwords;
  • API keys or access tokens;
  • private keys or other security-related data;
  • complete payment card details;
  • data that you are not authorised to process or transfer;
  • special categories of personal data, such as detailed health information, unless its use is necessary and you have an appropriate legal basis for processing it;
  • other highly confidential or secret information, unless its use is necessary to fulfil your request.

Before using an AI feature, consider whether personal or confidential data can be removed, limited, pseudonymised or replaced with anonymised data.

Responsibilities of the Customer and User

When using AI features, work only with data that you are authorised to process in Caflou.

If you store the personal data of employees, customers, suppliers or other individuals in Caflou, you are responsible for ensuring that you have an appropriate legal basis for processing the data, that you comply with the applicable transparency obligations, and that you use AI features in accordance with applicable law, your contractual obligations and your internal policies.

When processing customer data, Caflou generally acts as a processor acting on the customer’s instructions. The specific allocation of roles is governed by the agreement, the terms of the service, the Data Processing Agreement and the circumstances of the specific processing activity.

Human Oversight and Important Decisions

Caflou’s AI features are intended to serve as supporting tools.

Do not use their output without appropriate human oversight to make decisions that may have legal, financial, employment-related or other significant consequences for an individual.

If you use AI-generated output as a basis for such a decision, you are responsible for assessing its accuracy, lawfulness and appropriateness, and for ensuring the necessary human oversight.

Identification of AI Features

Features in which you interact directly with AI are identified in a way that makes it clear that the response or potential action is generated by an artificial intelligence system.

From 2 August 2026, the European AI Act requires people interacting directly with an AI system to be informed that they are interacting with artificial intelligence:

Further Information

If you have any questions, please contact us at support@caflou.com.