Privacy Policy
Last updated: June 21, 2026
This Privacy Policy explains how Flowify collects, uses, and protects personal data when you visit our website or engage our services. We comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA) as amended by the CPRA.
Who we are
Flowify is operated by Human Experience Design SRL, a Romanian company based in Bucharest. We are the data controller for personal data described in this Policy.
Contact: mike@flowifyresults.com
Data we collect
Information you provide:
Name, business name, email, phone, and billing details when you contact us, sign a proposal, or become a client
Account credentials and access tokens you grant us to manage advertising accounts on your behalf
Content of communications with us, including emails, calls, and messages
Information collected automatically:
IP address, device, browser type, referrer, and pages visited on our website
Cookies and similar technologies, as described in Section 8
Information from third parties:
Advertising platform metrics from Meta, Google, and other ad networks where you authorize access
Analytics and conversion data from platforms you connect
We do not knowingly collect data from children under 16.
Why we use it
We process personal data for:
Delivering the services you hired us to perform, including campaign management, reporting, and account access (legal basis under GDPR: contract performance)
Sending invoices, processing payments, and reconciling ad spend (contract performance and legal obligation)
Communicating about your account, our services, and operational updates (contract performance and legitimate interest)
Marketing our services to business prospects, including cold email and newsletters, where permitted by law (legitimate interest, with opt-out always available)
Improving our website and services (legitimate interest)
Complying with tax, accounting, and other legal obligations (legal obligation)
Who we share data with
We share personal data only as needed:
Service providers and processors that help us operate, including hosting, email delivery, CRM, analytics, accounting, and payments
Advertising platforms where we manage your campaigns, including Meta and Google
Professional advisors, including lawyers and accountants
Authorities where required by law
We do not sell personal data. We do not share personal data for cross-context behavioral advertising as defined under California law.
International transfers
Some of our service providers are based outside the European Economic Area, including in the United States. Where we transfer personal data internationally, we rely on:
European Commission adequacy decisions where available
Standard Contractual Clauses approved by the European Commission
Other lawful transfer mechanisms
You can request information about the safeguards in place by contacting us.
How long we keep data
We retain personal data for as long as needed to deliver our services, meet legal and tax obligations, and resolve disputes:
Client records: duration of the engagement plus ten years for accounting compliance under Romanian law
Prospect and marketing records: until you opt out, or up to three years from last contact
Website analytics: typically twenty-six months or less
Your rights
If you are in the EU, EEA, UK, or Switzerland, you have the right to:
Access the personal data we hold about you
Correct inaccurate data
Erase your data in certain circumstances
Restrict or object to processing
Data portability
Withdraw consent where processing is based on consent
Lodge a complaint with a supervisory authority, including the Romanian Data Protection Authority (ANSPDCP)
If you are a California resident, you have the right to:
Know what personal information we collect, use, and disclose
Delete personal information we collected from you
Correct inaccurate personal information
Opt out of sale or sharing of personal information (we do not sell or share)
Limit use of sensitive personal information (we do not use sensitive PI beyond what is necessary)
Non-discrimination for exercising your rights
To exercise any right, email us at mike@flowifyresults.com. We will respond within the timeframes required by law, typically thirty days under GDPR and forty-five days under CCPA. We may need to verify your identity before fulfilling a request.
Cookies
Our website uses cookies and similar technologies for:
Essential functions, such as keeping the site working
Analytics, such as understanding how visitors use the site
Marketing, such as measuring campaign results
You can manage cookie preferences through our cookie banner or your browser settings. Disabling some cookies may affect site functionality.
Security
We use reasonable technical and organizational measures to protect personal data, including access controls, encryption in transit, and vendor due diligence. No system is fully secure, and we cannot guarantee absolute protection.
Changes
We may update this Policy. The "Last updated" date reflects the most recent revision. Material changes will be notified through our website or by email.
Contact
Human Experience Design SRL
Bucharest, Romania
Email: mike@flowifyresults.com
For GDPR matters, you may also contact the Romanian Data Protection Authority (ANSPDCP) at www.dataprotection.ro.
Only change: Section 8 swapped "campaign performance" for "campaign results" to keep the document free of performance-marketing positioning. Everything else stayed clean since the Privacy Policy never framed Flowify as a performance agency to begin with. Note that under GDPR Article 6, "contract performance" is the standard legal-basis term, so I kept it in Section 3 since it's a regulatory term of art, not positioning.
