On this page
1. What Pilot is
Flok Pilot is a set of AI-assisted features inside Flok. It drafts, suggests and summarises. It does not act on its own: nothing Pilot produces is sent, charged, published or applied to a record until a human at your organisation approves it.
2. Provider and product
Pilot is powered by open-weight language models hosted by Infomaniak Network SA (Geneva, Switzerland) on its own AI platform. Infomaniak acts as a sub-processor to Flok for this processing, under Infomaniak's Data Processing Agreement, which is framed under the Swiss Federal Act on Data Protection (nDSG) and Article 28 GDPR.
3. Training
Flok does not use Customer data or member data to train any model — neither our own models nor a third party's. We do not train, fine-tune or build models on Customer or member data at all.
For the AI provider: Infomaniak states that requests to its AI platform are processed without being stored or logged. No copy of a prompt or response is kept once the reply is returned, so there is none that could enter model training.
4. Retention
- Flok does not store Pilot prompt or response text by default. Capture is gated behind an off-by-default setting used only for debugging. We do record non-content usage metadata — model name, token counts, cost estimate, which organisation and which feature — to operate and bill the service.
- Infomaniak does not store or log prompts and responses, per its published description of the service.
5. Where processing happens
Pilot requests are processed by Infomaniak in Switzerland, in its own data centres. Like everything else in Flok — the database, backups, static assets and email — Pilot stays in Switzerland or the EU, and no transfer outside Switzerland or the EEA takes place for it.
6. What is actually sent, feature by feature
Pilot is not one pipe. Different features send materially different things, and if you are assessing risk you need the difference.
| Feature | What leaves Flok |
|---|---|
| Churn-risk detection | Pseudonymous member identifiers and three behavioural numbers only — events attended in 180 days, newsletter open-rate percentage, overdue-invoice ratio. No name, no email address, no contact detail. |
| Newsletter, event and reminder drafting | Your own brief and the context you supply for the draft |
| Duplicate detection, import mapping, tag suggestions | The member fields being compared or mapped |
| Bank reconciliation | Transaction descriptions and amounts being matched to invoices |
| Receipt reading (Finanzen) | The photograph of the receipt itself — an image, not text. Receipts carry a vendor, a date and a total; they are not member data. Sent only when the club has this feature on, and never written to our AI usage log. Flok reads the date, amount and vendor back as a suggestion; the treasurer confirms or overrules it. |
| Questions about your figures (Finanzen) | The question as typed, and the club's chart of accounts as numbers and names. No balances, no entries and no member data are sent. The model only classifies the question into one of a fixed list of intents; every figure is computed from your own journal and no model is ever asked to state one. |
| Reading an emailed application | The subject and text of a membership application that arrived by email — only when the rule-based reader found no name or no email address in it. The result is shown to the board marked as read by the assistant; the assistant never approves or rejects. |
| Ask the Pilot (staff assistant) | The staff user's question and the running conversation, together with the help-centre articles retrieved to answer it. When the club has questions about members and events switched on, also the titles and dates of the club's events and a description of the kinds of data Flok holds (subject and field names such as "members", "joined"), so the model can say what to look up. No member data and no figures are sent: the model only describes the question as a structured request; Flok checks it, builds the query itself, runs it with the reader's own permissions and shows the result. |
| Translating your email wording | The Customer's own correspondence and onboarding copy, when the Customer asks for a translation. No member data. |
| Public support assistant | The visitor's typed message, with email addresses, phone numbers, IBANs and card-shaped numbers stripped before storage. It can read and explain; it cannot book, cancel, refund or send. |
7. Turning Pilot off
Every Pilot capability can be disabled individually, by you, in Settings. The thirteen independently-toggleable features are: newsletter drafting, event drafting, reminder drafting, optimal send time, dashboard alerts, insight narration, churn risk, smart import, auto-tagging, bank reconciliation, duplicate detection, receipt reading (Finanzen), and questions about your figures (Finanzen). The public support assistant has its own switch under Support agent.
Three uses are not toggles. The staff assistant (Ask the Pilot) answers from help articles and never receives club records; reading an emailed application runs only when the rule-based reader finds no name or no email address; and translation runs only when you ask for one.
Disabling a feature removes it from the dashboard and stops the calls it would have made. A Pilot feature runs only when someone at your organisation triggers it, never on a schedule. No data is sent to the AI provider for a disabled feature.
8. Automated decision-making and profiling (GDPR Art. 22)
The churn-risk feature scores members on how likely they are to lapse. Our position:
No decision producing legal effects or similarly significant effects is taken by Pilot. Churn risk produces a ranked list of suggestions shown to an administrator. The administrator decides what, if anything, to do — typically sending an invitation to an event. No membership is ended, no price is changed, no service is withheld, and nothing is sent, automatically or as a consequence of a score.
Accordingly our position is that Art. 22(1) GDPR is not engaged, because there is no decision "based solely on automated processing". Supporting facts:
- the model receives pseudonymous identifiers and three aggregate behavioural counts, not a member profile;
- members who joined less than three months ago are excluded;
- output is advisory text plus a score, surfaced for a human to act on or ignore;
- the whole feature is off if you toggle it off.
You remain the controller for any action you take on the basis of a Pilot suggestion, including the obligation to inform your members about profiling under Art. 13/14 GDPR where applicable.