Privacy Policy

Controller / Business / Responsible Entity:

Flowstates Inc
330 Madison Avenue, 27th Floor
New York, NY 10017
United States

Privacy Contact / Data Protection Officer:

Email: dataprotectionofficer@flowstates.net

For privacy rights requests, data protection questions, complaints, or Colombian consultas or reclamos, please contact us using the email address above.

This Privacy Policy applies to Personal Data we process when:

• you visit our website;
• you create or use a Flowstates account;
• you communicate with us;
• you receive customer support;
• you subscribe to our marketing communications;
• you interact with our cookies, pixels, or similar technologies;
• you are a business customer, supplier, partner, or representative of one; or
• your Personal Data is processed through the Flowstates Services on behalf of one of our Customers.

This Privacy Policy does not replace any Data Processing Agreement, Customer agreement, messaging terms, or platform-specific terms that apply to our Customers.

Flowstates may process Personal Data in different roles depending on the context.

3.1 Where Flowstates Acts as Controller

Flowstates acts as a controller when we determine the purposes and means of processing Personal Data, including when we process account registration information, billing information, website data, support records, business contact data, marketing communications, and security logs for our own business purposes.

3.2 Where Flowstates Acts as Processor or Service Provider

Flowstates acts as a processor, service provider, or contractor when we process Personal Data on behalf of our Customers through the Flowstates Services. In that context, the Customer determines the purposes and means of processing, and Flowstates processes the data only on the Customer's documented instructions, under the applicable Data Processing Agreement, Terms of Service, and applicable law.

3.3 Colombian Law Roles

For purposes of Colombian data protection law, Flowstates may act as a Responsable del Tratamiento when it determines the purposes and means of processing, or as an Encargado del Tratamiento when it processes Personal Data on behalf of a Customer.

Customer

a business or organization that registers for or uses the Flowstates Services.

End User

an individual customer, contact, subscriber, website visitor, or recipient whose data is processed by a Flowstates Customer through the Flowstates Services.

End User Messages

SMS, RCS, or other electronic messages sent by Customers to End Users through the Flowstates Services.

Personal Data or Personal Information

information that identifies, relates to, describes, can reasonably be associated with, or could reasonably be linked to an identified or identifiable person, household, or device.

Processing

any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, deletion, or analysis.

Sensitive Personal Data

Personal Data treated as sensitive under applicable law, which may include health data, biometric data, precise geolocation, government identifiers, account login credentials, racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, sexual orientation, children's data, or other protected categories.

Data Processing Agreement or DPA

the agreement governing Flowstates' processing of Personal Data on behalf of a Customer.

The table below describes the main categories of Personal Data we process as controller.

Customers use the Flowstates Services to send SMS, RCS, and other electronic messages to End Users. In this context, the Customer is generally the controller or business, and Flowstates is generally the processor, service provider, contractor, or encargado.

Customers are responsible for:

• providing lawful notices to End Users;
• obtaining and documenting all legally required consents and authorizations;
• determining the lawful basis or authorization for processing;
• ensuring that their messages are lawful and non-deceptive;
• honouring opt-outs and suppression requests;
• maintaining accurate contact lists;
• ensuring that End User data submitted to Flowstates may lawfully be processed; and
• complying with applicable SMS, RCS, email, consumer protection, marketing, and privacy laws.

Flowstates processes End User Personal Data only to provide the Flowstates Services, comply with Customer instructions, maintain security and service integrity, prevent abuse, comply with law, and perform related activities described in our DPA.

6.1 End User Data Processed Through the Flowstates Services

Some data may be aggregated or de-identified. Where information can reasonably be linked to an individual, household, or device, we treat it as Personal Data or Personal Information as required by applicable law.

Because the Flowstates Services are used for SMS, RCS, and other electronic messaging, Customers must comply with all applicable messaging, privacy, marketing, telecommunications, consumer protection, and anti-spam laws.

Customers must not use the Flowstates Services to send unlawful, deceptive, misleading, harassing, unauthorized, or non-compliant messages.

Customers must obtain and maintain evidence of all required consents and authorizations before sending messages. Customers must also provide legally required disclosures, identify the sender where required, include or support required opt-out instructions, and honour opt-outs, revocations, STOP requests, unsubscribe requests, suppression requests, and other legally valid objections.

Flowstates may suspend, restrict, or terminate messaging activity where we believe it is necessary to protect End Users, prevent abuse, preserve service integrity, comply with law, respond to carrier or regulator requirements, or enforce our Terms of Service.

Flowstates does not require Customers to submit Sensitive Personal Data through the Flowstates Services.

Customers must not submit Sensitive Personal Data, protected health information, children's data, biometric data, government identifiers, or other regulated data to the Flowstates Services unless:

• the Customer has obtained all legally required consent or authorization;
• such processing is permitted by the applicable agreement with Flowstates;
• the Customer has completed any required additional documentation, including a Business Associate Agreement where HIPAA applies; and
• Flowstates has confirmed that the relevant Flowstates Services are configured to support that processing.

The Flowstates Services are not intended for the processing of Protected Health Information under HIPAA unless Flowstates and the Customer have entered into a separate Business Associate Agreement.

Where we process Sensitive Personal Data as controller, we do so only where permitted by applicable law and, where required, with explicit consent.

The Flowstates Services are intended for business customers and are not directed to children or minors under 18.

We do not knowingly collect Personal Data from children under 13. Customers must not use the Flowstates Services to send marketing messages to children or minors unless they have obtained all legally required consents and authorizations.

For Colombian data subjects, the processing of Personal Data of children and adolescents is restricted and must respect their superior interests and fundamental rights.

If you believe a child or minor has provided Personal Data to Flowstates, please contact us at dataprotectionofficer@flowstates.net.

We use cookies, pixels, tags, SDKs, and similar technologies on flowstates.net and within the Flowstates Services.

These technologies may be used for:

• strictly necessary website and service functionality;
• account authentication;
• security and fraud prevention;
• analytics and performance measurement;
• remembering preferences;
• advertising, retargeting, and attribution; and
• understanding how users interact with our website and services.

We may use technologies provided by analytics and advertising partners, including Google and Meta/Facebook, subject to our configuration choices and applicable law.

Where required by law, we obtain consent before using non-essential cookies, pixels, or similar technologies. You may manage cookie preferences through our cookie settings.

We may disclose Personal Data to the following categories of recipients:

• Flowstates staff and authorized personnel, subject to access controls and confidentiality obligations;
• hosting, cloud infrastructure, and database providers;
• SMS, RCS, telecommunications, carrier, and message delivery providers;
• payment processors and billing providers;
• customer support and communications tools;
• analytics and performance measurement providers;
• advertising and marketing partners, where permitted by law and subject to your choices;
• security, fraud prevention, and abuse detection providers;
• professional advisers, including lawyers, accountants, auditors, and insurers;
• public authorities, courts, regulators, law enforcement, or other third parties where required or permitted by law;
• parties involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar corporate transaction; and
• Customers, where we process End User data on their behalf.

We do not sell Personal Data for money. However, our use of certain advertising cookies, pixels, or similar technologies may be considered a "sale," "sharing," or use for targeted advertising under some U.S. state privacy laws, including California law. See the California Privacy Notice below for more information and your choices.

We use third-party subprocessors, service providers, contractors, and vendors to help provide, secure, maintain, and improve the Flowstates Services.

Our subprocessors are required to process Personal Data under contract and only for the purposes authorized by Flowstates or our Customers. We require subprocessors to use appropriate confidentiality, security, and privacy safeguards.

Where required by our DPA, we provide Customers with notice of new subprocessors and an opportunity to object.

Our primary data servers are hosted in Frankfurt, Germany. Personal Data may also be processed in the United States, the European Economic Area, and other countries where Flowstates or its subprocessors operate.

Where we transfer Personal Data from the EEA, UK, Switzerland, Colombia, or another jurisdiction that restricts international transfers, we use appropriate safeguards where required, such as:

• Standard Contractual Clauses;
• the UK International Data Transfer Agreement or UK Addendum;
• adequacy decisions, where applicable;
• data processing or transmission agreements;
• contractual safeguards required under Colombian data protection law; or
• another lawful transfer mechanism.

You may contact us at dataprotectionofficer@flowstates.net for more information about the transfer safeguards we use.

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Where Flowstates acts as a processor, service provider, contractor, or encargado, deletion may be subject to Customer instructions, legal obligations, backup cycles, security requirements, or dispute preservation needs.

We use reasonable and appropriate technical, organizational, and administrative safeguards designed to protect Personal Data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These safeguards may include:

• encryption in transit and, where appropriate, at rest;
• secure hosting environments;
• access controls and role-based permissions;
• authentication controls;
• network security measures;
• logging and monitoring;
• staff confidentiality obligations;
• vendor security review;
• incident response procedures; and
• physical security measures where relevant.

No method of transmission or storage is completely secure. We use safeguards designed to protect Personal Data, but we cannot guarantee absolute security.

Depending on where you live and the law that applies, you may have rights over your Personal Data.

These may include the right to:

• request access to your Personal Data;
• request a copy of your Personal Data;
• request correction of inaccurate Personal Data;
• request deletion of Personal Data;
• request restriction of processing;
• object to processing;
• withdraw consent where processing is based on consent;
• request data portability;
• opt out of marketing communications;
• opt out of sale, sharing, targeted advertising, or certain profiling where applicable;
• limit the use or disclosure of Sensitive Personal Information where applicable;
• appeal certain rights request decisions where applicable; and
• lodge a complaint with a supervisory authority or regulator.

To exercise your rights, contact: dataprotectionofficer@flowstates.net

We may need to verify your identity before responding to your request. We will respond within the time required by applicable law.

Where we process Personal Data on behalf of a Customer, we may forward your request to the relevant Customer or instruct you to contact the Customer directly. We will assist Customers with rights requests as required by our DPA and applicable law.

Where the GDPR, UK GDPR, or Swiss data protection law applies, you may have the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to data portability;
• right to object;
• right to withdraw consent at any time, without affecting processing carried out before withdrawal;
• right not to be subject to automated decision-making producing legal or similarly significant effects, where applicable; and
• right to lodge a complaint with your local data protection supervisory authority.

Where we rely on legitimate interests, you may object to processing. Where we rely on consent, you may withdraw consent at any time.

We do not use Personal Data for automated decision-making that produces legal or similarly significant effects without appropriate notice and lawful basis.

Residents of certain U.S. states may have additional privacy rights, depending on applicable law. These may include rights to access, confirm processing, delete, correct, obtain a portable copy of Personal Information, opt out of targeted advertising, opt out of sale, opt out of certain profiling, restrict certain uses of Sensitive Personal Information, and appeal a denied request.

To exercise U.S. state privacy rights, contact: dataprotectionofficer@flowstates.net

Where required, we will provide an appeal process if we deny your request.

This California Privacy Notice applies to California residents and supplements the rest of this Privacy Policy. It applies to the extent Flowstates is a "business" under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

19.1 Notice at Collection

We do not use or disclose Sensitive Personal Information for purposes that require a right to limit under California law, unless we provide the required notice and choice.

19.2 Categories of Sources

We collect Personal Information from:

• you;
• your employer or organization;
• account administrators;
• Customers;
• End Users' interactions with Customer websites or messages;
• browsers and devices;
• cookies, pixels, analytics tools, and advertising technologies;
• payment processors;
• service providers and subprocessors;
• communications with us; and
• publicly available business sources.

19.3 Business or Commercial Purposes

We collect, use, disclose, and, where applicable, share Personal Information for:

• providing the Flowstates Services;
• account creation and administration;
• authentication and security;
• billing and payment processing;
• customer support;
• SMS, RCS, and electronic message delivery;
• analytics and service improvement;
• marketing and advertising;
• cookie-based retargeting and attribution;
• fraud, spam, DDoS, and abuse prevention;
• legal, tax, accounting, and compliance purposes;
• enforcing agreements and policies; and
• responding to legal requests.

19.4 Disclosures for Business Purposes

In the preceding 12 months, we may have disclosed identifiers; § 1798.80 information; commercial information; internet or network activity; approximate geolocation data; professional or employment-related information; inferences; and Sensitive Personal Information where necessary for account security, authentication, payment processing, or compliance — to service providers, contractors, subprocessors, payment processors, hosting providers, telecommunications and messaging providers, support tools, analytics providers, security providers, professional advisers, and legal authorities.

19.5 Sale or Sharing of Personal Information

We do not sell Personal Information for money.

We may "share" the following categories for cross-context behavioral advertising through advertising cookies, pixels, or similar technologies:

• identifiers, such as cookie IDs, device identifiers, IP addresses, and similar online identifiers;
• internet or network activity information, such as website interactions and page views; and
• inferences, such as advertising or marketing interests.

You may opt out of sale or sharing by managing your cookie preferences.

We also process legally recognized opt-out preference signals, such as Global Privacy Control, where required by law. Where your browser or device sends a valid opt-out preference signal, we will treat it as a request to opt out of sale or sharing for that browser or device. If you are logged into your account and we can associate the signal with your account, we may apply the opt-out to your account as required by law.

We do not have actual knowledge that we sell or share Personal Information of consumers under 16 years of age.

19.6 California Rights

• know what Personal Information we collect, use, disclose, sell, or share;
• access specific pieces of Personal Information;
• delete Personal Information, subject to exceptions;
• correct inaccurate Personal Information;
• opt out of sale or sharing;
• limit use or disclosure of Sensitive Personal Information where applicable;
• not receive discriminatory or retaliatory treatment for exercising privacy rights; and
• use an authorized agent to submit a request.

19.7 How to Exercise California Rights

Email: dataprotectionofficer@flowstates.net

We will verify your request by matching the information you provide with information we maintain. We may request additional information where necessary to verify your identity or authority to act on behalf of another person.

Authorized agents may submit requests on behalf of California residents. We may require proof of authorization and may ask the resident to verify their identity directly with us unless an exception applies.

19.8 Response Timelines

We will respond to California privacy requests within the period required by law. For requests to know, access, delete, or correct, we generally confirm receipt within 10 business days and respond within 45 calendar days, unless an extension is permitted. For opt-out requests, we will comply as soon as reasonably practicable and within the legally required period.

This section applies to Personal Data processing subject to Colombian data protection law, including Law 1581 of 2012 and related regulations.

20.1 Responsible Entity

Responsable del Tratamiento:
Flowstates Inc
330 Madison Avenue, 27th Floor
New York, NY 10017
United States
Email: dataprotectionofficer@flowstates.net

20.2 Purposes of Processing

• providing and operating the Flowstates Services;
• managing accounts and business relationships;
• delivering SMS, RCS, and other electronic messages;
• providing customer support;
• billing, accounting, and tax compliance;
• fraud, spam, DDoS, and abuse prevention;
• security monitoring and incident response;
• analytics and service improvement;
• marketing communications where legally permitted;
• compliance with legal, regulatory, judicial, or contractual obligations;
• responding to consultations, claims, complaints, and rights requests; and
• any other purpose disclosed at the time of collection or authorized by the data subject.

20.3 Authorization

Where required by Colombian law, we will request prior, express, and informed authorization for the processing of Personal Data. Authorization may be obtained in writing, electronically, orally, by affirmative conduct, or by another mechanism that allows later consultation of the authorization.

When requesting authorization, we will inform data subjects of:

• the Personal Data to be collected;
• the purposes of processing;
• their rights as data subjects;
• the identity, address, email, and telephone number of Flowstates;
• the optional nature of providing Sensitive Personal Data or children's/adolescents' data, where applicable; and
• how to access this Privacy Policy.

20.4 Sensitive Data

The provision of Sensitive Personal Data is optional unless an exception applies under law. We will not condition any activity on the provision of Sensitive Personal Data unless legally permitted.

Where Sensitive Personal Data is processed, we will inform the data subject which data is sensitive, the purpose of processing, and the optional nature of providing such data, and we will obtain express consent where required.

20.5 Children and Adolescents

Processing Personal Data of children and adolescents is restricted. Where such processing is permitted, it must respect the superior interests of the child or adolescent and their fundamental rights.

20.6 Colombian Data Subject Rights

• know, update, and rectify their Personal Data;
• request proof of authorization granted for processing, unless an exception applies;
• be informed, upon request, about how their Personal Data has been used;
• file complaints with the Superintendencia de Industria y Comercio after completing the applicable consultation or claim process with Flowstates;
• revoke authorization and/or request deletion of Personal Data where applicable;
• access their Personal Data free of charge; and
• exercise any other right provided under Colombian law.

20.7 Procedure for Consultas and Reclamos

Privacy / Data Protection Office
Email: dataprotectionofficer@flowstates.net

Requests should include:

• the data subject's full name;
• identification information sufficient to verify identity;
• contact details for response;
• a clear description of the request, consulta, or reclamo;
• supporting documents, where applicable; and
• if submitted by a representative, proof of authority to act.

Consultas will be answered within 10 business days from receipt. If we cannot respond within that period, we will explain the reason for the delay and provide a response within the additional period permitted by law.

Reclamos will be handled within 15 business days from receipt of a complete claim. If the claim is incomplete, we may request additional information. If we cannot respond within the initial period, we will explain the reason for the delay and provide a response within the additional period permitted by law.

A data subject may file a complaint with the Superintendencia de Industria y Comercio only after first completing the applicable consulta or reclamo process with Flowstates.

20.8 International Transfers and Transmissions From Colombia

Personal Data subject to Colombian law may be transferred or transmitted outside Colombia, including to the United States, Germany, and other countries where Flowstates or its subprocessors operate.

Where required, Flowstates will use contractual safeguards, transmission agreements, transfer mechanisms, authorization, or other measures required under Colombian data protection law.

20.9 Effective Date and Database Validity

This Colombian Personal Data processing policy is effective from 12/05/2026.

Flowstates' databases will remain valid for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer period is required or permitted by law, contract, compliance, dispute resolution, or legitimate business purposes.

We may send marketing communications to business contacts, Customers, and individuals who have consented or where otherwise permitted by law.

You may opt out of marketing emails at any time by using the unsubscribe link in the email or by contacting us at dataprotectionofficer@flowstates.net.

We may continue to send non-marketing communications, including transactional, service, account, security, billing, legal, and support messages.

Commercial emails sent by Flowstates will include required sender information and opt-out mechanisms.

If you receive a message sent by a Flowstates Customer through the Flowstates Services, the Customer is generally responsible for that message and for honouring your messaging preferences.

You may be able to opt out by replying with a recognized opt-out keyword such as STOP, QUIT, CANCEL, END, UNSUBSCRIBE, or another method described in the message.

If you contact Flowstates about an End User message, we may forward your request to the relevant Customer or help process the request as required by law, contract, or platform rules.

Some browsers provide "Do Not Track" settings. Because there is no uniform industry standard for responding to Do Not Track signals, our response may vary.

Where required by law, including California law, we will process recognized opt-out preference signals, such as Global Privacy Control, as a request to opt out of sale or sharing for the relevant browser, device, or account where applicable.

We do not use Personal Data for automated decision-making that produces legal or similarly significant effects without appropriate notice and lawful basis.

We may use analytics, segmentation, and campaign tools to help Customers configure messaging campaigns. Where Flowstates acts as a processor, Customers are responsible for determining whether their campaign configuration involves profiling or automated decision-making requiring notice, consent, opt-out rights, or other safeguards.

We may disclose Personal Data where we believe disclosure is necessary or appropriate to:

• comply with applicable law;
• respond to subpoenas, court orders, warrants, lawful government requests, or legal process;
• cooperate with regulators or law enforcement;
• protect the rights, property, or safety of Flowstates, Customers, End Users, or others;
• investigate fraud, spam, abuse, security incidents, or unlawful activity;
• enforce our agreements and policies; or
• preserve evidence or defend legal claims.

If Flowstates is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, Personal Data may be disclosed or transferred as part of that transaction, subject to appropriate safeguards and applicable law.

Our website and services may link to third-party websites, platforms, integrations, payment processors, or services. We are not responsible for the privacy practices of third parties. Their privacy policies govern their collection and use of Personal Data.

We may update this Privacy Policy from time to time. The "Last Revised" date at the top of this page indicates when it was last updated.

Where required by law, we will provide additional notice or obtain consent for material changes.

For questions, privacy rights requests, complaints, Colombian consultas or reclamos, California privacy requests, GDPR requests, or data protection concerns, please contact:

Flowstates Inc
330 Madison Avenue, 27th Floor
New York, NY 10017
United States

Privacy Contact / Data Protection Officer:
Email: dataprotectionofficer@flowstates.net