Privacy Policy

Last updated: June 8, 2026

1. Who We Are

FlowStrata operates at flowstrata.com and provides done-for-you B2B outbound lead generation services. References to "FlowStrata", "we", "us" or "our" in this policy refer to the FlowStrata team. For privacy enquiries, contact us at privacy@flowstrata.com.

2. What Data We Collect

We collect the following categories of personal data:

  • Contact form submissions: Full name, company name, job title, email address, phone number, LinkedIn profile URL, and your enquiry message.
  • Newsletter subscriptions: Email address.
  • Tool usage: Inputs you provide when using our free tools (ICP Builder, ROI Calculator, Deliverability Grader). We do not store tool inputs unless you choose to submit your email.
  • Usage data: Pages visited, time on page, browser type, and referring URL, collected anonymously via standard server logs.
  • Cookies: We use strictly necessary cookies for site functionality. Optional analytics cookies may be set if you accept them via our cookie banner. See Section 8 for details.

3. Legal Basis for Processing (GDPR)

For individuals in the UK or European Economic Area, we process your data under the following legal bases:

  • Contractual necessity (Article 6(1)(b)): Processing your contact submission to respond to your enquiry and provide our services.
  • Legitimate interests (Article 6(1)(f)): Sending our newsletter to subscribers, improving our website, and following up on genuine business enquiries. We have conducted a Legitimate Interests Assessment (LIA) available on request.
  • Consent (Article 6(1)(a)): Where you have opted in to marketing communications or accepted optional cookies.

4. How We Use Your Data

  • To respond to your enquiries and provide our services
  • To send you our newsletter (if subscribed)
  • To personalise follow-up communications based on your stated needs
  • To improve our website and service based on aggregated usage data
  • To comply with legal and regulatory obligations

We do not sell, rent or trade your personal data to third parties for their own marketing purposes.

5. Sub-Processors and Data Sharing

We use the following sub-processors to operate our services. Each is bound by appropriate data processing agreements:

  • Supabase Inc. (hosted on AWS), Database storage for contact and newsletter submissions. Data hosted in EU region (eu-west-1). Supabase DPA available at supabase.com/legal/dpa.
  • Resend Inc. (Twilio SendGrid infrastructure), Email delivery for notifications and newsletters. Resend DPA available on request.
  • Vercel Inc., Website hosting and serverless functions. Data transits through Vercel's edge network. Vercel DPA at vercel.com/legal/dpa.

We may disclose your data if required by law, court order, or regulatory authority.

6. Data Retention

  • Contact submissions: Retained for 2 years from the date of submission, or until you request deletion.
  • Newsletter subscriptions: Retained until you unsubscribe, after which your email is moved to a suppression list to prevent future sends.
  • Server logs: Retained for 90 days.

7. Your Rights

Under GDPR and UK GDPR, you have the following rights (where applicable):

  • Right of access, Request a copy of the personal data we hold about you.
  • Right to rectification, Request correction of inaccurate data.
  • Right to erasure, Request deletion of your personal data ("right to be forgotten").
  • Right to restrict processing, Request that we limit how we use your data.
  • Right to data portability, Receive your data in a structured, machine-readable format.
  • Right to object, Object to processing based on legitimate interests.
  • Right to withdraw consent, Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email privacy@flowstrata.com. We will respond within 30 days. You also have the right to lodge a complaint with the relevant supervisory authority (ICO in the UK: ico.org.uk; your national DPA in the EU).

8. Cookies

We use the following cookie categories:

  • Strictly necessary: Required for the website to function. Cannot be disabled. These include session management cookies.
  • Analytics (optional): Used to understand how visitors interact with our website. Only set with your consent via our cookie banner.

You can manage your cookie preferences at any time via the "Cookie Settings" link in the footer.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Row-level security on all database tables
  • API authentication via environment-variable-secured keys (never exposed client-side)
  • Access limited to personnel who require it to deliver services

10. International Data Transfers

Our sub-processors (Supabase, Resend, Vercel) may process data in countries outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) or equivalent mechanisms, to protect your data in line with GDPR requirements.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to subscribers and by updating the "Last updated" date at the top of this page. Continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related queries, data subject requests, or to request our Legitimate Interests Assessment or Data Processing Agreement:

Email: privacy@flowstrata.com
Response time: Within 30 calendar days