Privacy
Policy.

We collect personal data only when you actively provide it or when it is generated as a necessary part of delivering our services. We do not buy data lists or acquire personal information from third-party data brokers.

Data we collect includes:

• Contact information — name, email address, phone number and business name when you submit our audit request form or contact us directly.
• Engagement data — project notes, call recordings (with your consent) and documents shared during a client engagement.
• Usage data — anonymised analytics about how visitors interact with this website, collected via privacy-first tooling (no cross-site tracking).
• Communications — the content of emails, messages and meeting notes exchanged between you and our team.

We do not collect payment card data directly. Any transactions are handled by third-party payment processors under their own security standards.

We use your data to deliver our consultancy services and to communicate with you about your engagement. Our lawful bases under UK GDPR are:

• Contract performance — processing necessary to carry out the audit and build work you've engaged us for.
• Legitimate interest — responding to enquiries, maintaining records of our work, and improving our service quality.
• Consent — sending you optional updates or case study invitations, only where you have explicitly opted in.

We will never sell your personal data, use it for unrelated advertising, or share it with third parties except where required to deliver your project (e.g. integration partners you've selected) or where required by law.

We use a small number of carefully selected third-party tools to run our business. Each processor is bound by a Data Processing Agreement and GDPR-compliant terms.

• Notion / Google Workspace — project documentation and client communications.
• Calendly — booking and scheduling.
• Stripe — invoicing and payment processing.
• Make / n8n — automation tooling for client builds (no personal data stored beyond what the client workflow requires).
• Plausible Analytics — cookieless, privacy-first website analytics. No cross-site tracking, no personal identifiers stored.

Where a client engagement involves AI model APIs (e.g. OpenAI, Anthropic), any data processed is covered by the data processing agreements we put in place as part of that engagement.

We retain client data for as long as is necessary to fulfil the engagement and comply with our legal obligations. In practice:

• Enquiry data from contacts who did not become clients is deleted within 12 months of the last interaction.
• Active client project data is retained for the duration of the engagement plus 6 years (UK statutory limitation period for contracts).
• Financial records are retained for 7 years in line with HMRC requirements.

All data is stored on servers located within the UK or EEA, or in jurisdictions with adequate protection decisions from the UK ICO.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data where we no longer have a lawful basis to hold it.
• Restriction — ask us to pause processing your data while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, where consent is the lawful basis, without affecting prior processing.

To exercise any of these rights, email contact@flowstackai.cloud. We will respond within 30 days. If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the ICO at ico.org.uk.

This website uses no advertising cookies and no cross-site tracking technologies. We use Plausible Analytics, a cookieless, privacy-first analytics tool that does not collect personal identifiers and does not require a cookie consent banner.

If you contact us via a third-party form or booking tool embedded on our site, that provider may set their own cookies. Please refer to their individual privacy policies for details.

We may update this policy from time to time as our services evolve or legal requirements change. When we make material changes, we will update the "last updated" date at the top of this page and, where appropriate, notify active clients by email.

Continued use of our website or services after a policy update constitutes acceptance of the revised terms.