Cookie Policy

Cookies are small text files placed on your browser or device when you visit a website. Cookies allow websites and online services to recognize your browser or device, remember your preferences, understand how you interact with a website, support security, and provide functionality.

Cookies may be:

• Session cookies, which expire when you close your browser; or
• Persistent cookies, which remain on your browser or device for a set period unless deleted earlier.

Cookies may also be:

• First-party cookies, which are set by Flowstates; or
• Third-party cookies, which are set by external providers such as analytics, advertising, payment, hosting, support, or security partners.

This Cookie Policy also applies to technologies similar to cookies, including:

• pixels;
• tags;
• web beacons;
• tracking scripts;
• local storage;
• session storage;
• device identifiers;
• software development kits;
• tracking URLs;
• embedded content;
• server-side analytics; and
• other technologies that store information on, or access information from, your browser or device.

In this Cookie Policy, we refer to these technologies collectively as "cookies" unless the context requires otherwise.

We use cookies for the following purposes:

• to make our website and services work;
• to keep our website, accounts, and services secure;
• to authenticate users and maintain sessions;
• to remember preferences;
• to understand website and service usage;
• to measure performance;
• to troubleshoot errors;
• to improve our website and services;
• to support customer support and diagnostics;
• to provide analytics;
• to measure advertising performance;
• to deliver, personalize, or measure marketing;
• to help prevent fraud, spam, abuse, DDoS attacks, and unauthorized access;
• to support plugin and integration functionality; and
• to comply with legal, contractual, security, and operational obligations.

4.1 Strictly Necessary Cookies

Strictly necessary cookies are required for the website or services to function. They may be used for security, authentication, session management, load balancing, fraud prevention, consent management, or account access.

These cookies cannot usually be disabled through our cookie banner because the website or services may not work properly without them. You can block them through your browser settings, but doing so may affect website or service functionality.

4.2 Functional Cookies

Functional cookies help remember your choices and improve your experience. These may include language preferences, region settings, interface preferences, or saved settings.

4.3 Analytics and Performance Cookies

Analytics and performance cookies help us understand how users interact with our website and services. They may tell us which pages are visited, how long users spend on pages, what features are used, where errors occur, and how users navigate through the website.

We use this information to improve our website, services, performance, usability, and customer experience. Examples may include:

We will keep this list current as additional analytics tools are deployed. If a cookie is set on your browser that is not listed above, you can inspect it through your browser developer tools and contact us for clarification.

4.4 Advertising and Marketing Cookies

Advertising and marketing cookies help us measure marketing campaigns, understand advertising effectiveness, build marketing audiences, perform attribution, and show relevant advertising.

These cookies may be set by Flowstates or third-party advertising partners. They may collect or infer information such as device identifiers, cookie IDs, IP address, pages visited, interactions, campaign source, and advertising engagement.

Where required by law, we will obtain your consent before setting advertising or marketing cookies.

For California residents and residents of other applicable U.S. states, our use of advertising cookies, pixels, or similar technologies may be considered a "sale," "sharing," or use for targeted advertising. You can opt out by using Your Privacy Choices.

4.5 Security and Fraud Prevention Cookies

Security cookies help us protect our website, services, customers, End Users, and systems. These cookies may be used to detect suspicious activity, prevent DDoS attacks, identify abuse, enforce security controls, and protect accounts.

4.6 Service and Plugin Cookies

The Flowstates Services may use cookies or similar technologies to support service functionality, message-related workflows, e-commerce integrations, cart recovery, consent recording, troubleshooting, compatibility, and analytics.

Where a Customer installs or uses Flowstates plugins, widgets, scripts, or integrations on the Customer's own website, the Customer is responsible for providing any required cookie notices, consent mechanisms, privacy disclosures, and opt-out mechanisms to its own website visitors or End Users.

Some cookies are set or controlled by third parties. These third parties may include:

• analytics providers;
• advertising partners;
• consent management platforms;
• hosting and infrastructure providers;
• security and fraud prevention providers;
• payment processors;
• customer support tools;
• messaging, carrier, telecommunications, or delivery providers;
• tag management platforms; and
• embedded content or integration providers.

These third parties may process information according to their own privacy policies, cookie policies, or contractual obligations.

We may use third-party providers such as:

Provider links are illustrative. We will keep this table updated as we add or remove third-party providers, and you can always inspect cookies set on your browser through your browser's developer tools.

Flowstates Customers may use the Flowstates Services widgets, or integrations on their own websites, storefronts, applications, or digital properties.

When a Customer uses Flowstates technology on its own digital property, the Customer is generally responsible for:

• deciding which cookies or similar technologies are deployed;
• providing legally required notices;
• obtaining legally required consent or authorization;
• explaining how End User data is collected and used;
• providing opt-out mechanisms;
• honouring applicable privacy rights; and
• ensuring that its use of Flowstates technology complies with applicable privacy, marketing, telecommunications, consumer protection, and cookie laws.

Flowstates processes Customer-controlled data as described in our Privacy Policy, Data Processing Agreement, and applicable Customer agreements.

Where GDPR, UK GDPR, EU cookie rules, UK PECR, or similar laws apply, we rely on consent for non-essential cookies where required.

Strictly necessary cookies may be used without consent where they are required to provide a service you request, maintain security, authenticate users, or make the website or service function.

Where cookies involve Personal Data, we process that Personal Data under the legal bases described in our Privacy Policy, which may include consent, performance of a contract, legitimate interests, or legal obligations, depending on the context.

You can withdraw or change your cookie consent at any time using our Cookie Settings.

Withdrawing consent does not affect processing carried out before withdrawal.

We do not sell Personal Information for money.

However, our use of certain advertising cookies, pixels, tags, or similar technologies may be considered a "sale," "sharing," or use of Personal Information for targeted advertising under California and other U.S. state privacy laws.

The categories of Personal Information that may be sold, shared, or used for targeted advertising through cookies include:

• identifiers, such as cookie IDs, device identifiers, advertising identifiers, IP address, or similar online identifiers;
• internet or network activity information, such as pages visited, interactions, referring URLs, and browsing activity on our website; and
• inferences, such as marketing interests or advertising audience information.

These categories may be disclosed to advertising, analytics, and marketing partners.

You may opt out of sale, sharing, or targeted advertising by using Your Privacy Choices in our Privacy Policy or by adjusting your Cookie Settings.

We also process recognized opt-out preference signals, such as Global Privacy Control, where required by law. Where your browser or device sends a valid opt-out preference signal, we will treat it as a request to opt out of sale or sharing for that browser or device. If you are logged into your account and we can reasonably associate the signal with your account, we may apply the opt-out to your account as required by law.

We do not have actual knowledge that we sell or share Personal Information of consumers under 16 years of age.

For Colombian data subjects, cookie data may be treated as Personal Data where it is linked or reasonably linkable to an identified or identifiable person.

Where Colombian data protection law applies, we process cookie-related Personal Data in accordance with our Privacy Policy and applicable authorization requirements.

Colombian data subjects may have the right to know, update, rectify, access, request proof of authorization, be informed about use, revoke authorization, request deletion where applicable, and file complaints with the Superintendencia de Industria y Comercio after completing the required process with Flowstates.

To exercise Colombian privacy rights, contact dataprotectionofficer@flowstates.net.

You can manage cookies in several ways.

10.1 Cookie Banner or Cookie Settings

You can accept, reject, or customize non-essential cookies through our Cookie Settings.

10.2 Browser Settings

Most browsers allow you to block, delete, or manage cookies. Browser settings vary, but they commonly allow you to:

• delete existing cookies;
• block all cookies;
• block third-party cookies;
• block cookies from specific websites;
• receive alerts before cookies are set; or
• clear cookies when you close your browser.

Blocking all cookies may affect website functionality, account access, security features, and service performance.

10.3 Advertising Choices

You may be able to manage advertising cookies and interest-based advertising through advertising industry opt-out tools, browser settings, platform settings, or provider-specific controls.

10.4 Global Privacy Control

Where required by law, we honour recognized opt-out preference signals such as Global Privacy Control.

A Global Privacy Control signal may apply only to the browser or device from which it is sent unless we can reasonably associate it with your account.

10.5 Mobile Device Settings

Mobile devices may allow you to manage advertising identifiers, tracking permissions, app permissions, and location settings. These settings are controlled by your device operating system.

We may keep records of your cookie choices, including your consent, withdrawal, opt-out, or preference settings. These records help us honour your choices and demonstrate compliance with applicable law.

Consent records may include:

• consent status;
• consent date and time;
• cookie category preferences;
• browser or device information;
• IP address or truncated IP address;
• consent banner version; and
• related technical logs.

Cookies remain on your browser or device for different periods depending on their purpose and configuration.

Some cookies expire when you close your browser. Others remain for a fixed period or until you delete them.

We retain cookie-related Personal Data only for as long as reasonably necessary for the purposes described in this Cookie Policy and our Privacy Policy, unless a longer period is required or permitted by law.

The specific retention period for each cookie is listed in the cookie table above or in our cookie settings tool.

Cookie-related Personal Data may be processed in the United States, the European Economic Area, the United Kingdom, Colombia, and other countries where Flowstates or our service providers operate.

Where required, we use appropriate safeguards for international transfers as described in our Privacy Policy.

Some browsers provide "Do Not Track" settings. Because there is no uniform industry standard for responding to Do Not Track signals, our response may vary.

Where legally required, we process recognized opt-out preference signals, such as Global Privacy Control, as described above.

Our website and services are intended for business users and are not directed to children or minors under 18.

We do not knowingly use cookies to collect Personal Data from children under 13. We also do not knowingly sell or share Personal Information of consumers under 16.

If you believe a child or minor has provided Personal Data to Flowstates, contact us at dataprotectionofficer@flowstates.net.

We may update this Cookie Policy from time to time. The "Last Revised" date above shows when this Cookie Policy was last updated.

Where required by law, we will provide additional notice or request renewed consent for material changes to our use of cookies or similar technologies.

For questions about this Cookie Policy, cookie choices, privacy rights, or data protection practices, contact:

Flowstates Inc
330 Madison Avenue, 27th Floor
New York, NY 10017
United States

Privacy Contact / Data Protection Officer:
Email: dataprotectionofficer@flowstates.net