Privacy Policy

This Privacy Policy explains how Flow State (“we”, “us”, “our”) collects, uses, and protects your personal data when you use this website and purchase our products or services.

Who we are

Flow State — trading name. Registered business address: [ADD YOUR REGISTERED ADDRESS]. Company number (if applicable): [ADD COMPANY NO]. VAT number (if applicable): [ADD VAT NO]. Contact email: flowstatemgmt@outlook.com.

What data we collect

• Contact details you give us: name, email address, and any message you send via forms.
• Account details if you sign in: email address and authentication identifiers.
• Order details: products purchased, billing details, and order history.
• Payment details: handled directly by our payment provider — we do not store full card numbers.
• Technical data: IP address, device/browser type, and pages viewed (via cookies — see Cookie Policy).

Why we collect it (lawful basis)

• Contract — to deliver products, services, downloads and customer support.
• Legitimate interests — to run, secure and improve the site, and to prevent fraud.
• Consent — for marketing emails and optional cookies. You can withdraw consent at any time.
• Legal obligation — to comply with tax, accounting and consumer-law requirements.

Third parties we share data with

Payment / checkout providers

• Stripe — payment processing, fraud prevention, tax calculation and (where applicable) tax compliance handling. Stripe is the data controller for payment data it processes. See Stripe's privacy notice on their website.

Email & form tools

• Formspree — processes signup and contact form submissions on our behalf.
• Email provider (Microsoft Outlook) — for replying to your enquiries.
• We do not currently use a third-party bulk email marketing platform. If we add one (for example Mailchimp, Klaviyo or similar), we will update this policy and ask for consent where required.

Analytics

• We do not currently run third-party analytics. If we add a tool such as Google Analytics or Plausible, it will only be loaded after you accept analytics cookies.

Hosting & infrastructure

• The site is hosted on cloud infrastructure that may process technical data (IP, request logs) to operate the service.

Retention periods

• Order and tax records: kept for 6 years to meet UK tax/accounting rules.
• Account data: kept while your account is active, then deleted within 12 months of closure.
• Marketing list: kept until you unsubscribe, plus a short suppression record so we don't email you again.
• Contact form messages: kept for up to 24 months after the matter is resolved.

Your rights

Under UK and EU data protection law you have the right to:

• Access a copy of your data.
• Have inaccurate data corrected.
• Request deletion of your data (subject to legal retention rules).
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent at any time (for marketing or optional cookies).
• Complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

How to contact us about privacy

Email privacy requests to flowstatemgmt@outlook.com. We aim to respond within 30 days.