Privacy Policy

Controller / Business:
Flowstates Inc, doing business as Flow2FA
330 Madison Avenue, 27th Floor
New York, NY 10017
United States

Privacy Contact / Data Protection Officer: dataprotectionofficer@flowstates.net

Legal Contact: legal@flowstates.net

For privacy rights requests, data protection questions, complaints, or Colombian consultas or reclamos, please contact us using the privacy email address above, or via our contact page.

This Privacy Policy applies to Personal Data we process when:

• you visit flow2fa.com;
• you create or use a Flow2FA account;
• you communicate with us, including through our contact form or AI assistant;
• you receive customer support;
• you interact with our cookies or similar technologies (see our Cookie Policy);
• you are a business customer, supplier, partner, or representative of one; or
• your Personal Data is processed through the Flow2FA Services on behalf of one of our Customers, for example as an OTP or verification message recipient.

This Privacy Policy does not replace any Data Processing Agreement, Customer agreement, or platform-specific terms that apply to our Customers. See our Website Terms of Use and Cookie and Browser Storage Policy for related terms.

Flow2FA may process Personal Data in different roles depending on the context.

• Customer — a business or organization that registers for or uses the Flow2FA Services to authenticate or verify its own end users.
• End User — an individual whose phone number, WhatsApp identifier, or email address is used by a Flow2FA Customer to receive an OTP or verification message through the Flow2FA Services.
• OTP / Verification Message — a one-time passcode, authentication code, or related verification communication sent by or on behalf of a Customer through the Flow2FA Services.
• Personal Data or Personal Information — information that identifies, relates to, describes, can reasonably be associated with, or could reasonably be linked to an identified or identifiable person, household, or device.
• Processing — any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, deletion, or analysis.
• Sensitive Personal Data — Personal Data treated as sensitive under applicable law, which may include health data, biometric data, precise geolocation, government identifiers, account login credentials, racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, sexual orientation, children's data, or other protected categories.
• Data Processing Agreement or DPA — the agreement governing Flow2FA's processing of Personal Data on behalf of a Customer.

The table below describes the main categories of Personal Data we process as controller through flow2fa.com and our own business operations. Unlike a marketing platform, our website does not run advertising pixels, analytics cookies, or a payment checkout — the categories below reflect what the site actually collects.

Customers use the Flow2FA Services to deliver one-time passcodes and verification messages to their own End Users over WhatsApp, SMS, and email, using their own vendors and SMPP binds, Flow2FA-supplied routes, or both. In this context the Customer is generally the controller (or Responsable del Tratamiento), and Flow2FA is generally the processor, service provider, or Encargado del Tratamiento.

Flow2FA processes End User Personal Data only to provide the Flow2FA Services, comply with Customer instructions, maintain security and service integrity, prevent abuse, comply with law, and perform related activities described in the applicable DPA. Flow2FA is a business-to-business authentication delivery platform — it is not a marketing campaign platform, and Flow2FA does not guarantee delivery of any message.

Because the Flow2FA Services are used to deliver OTP and verification messages, Customers must comply with all applicable privacy, telecommunications, consumer protection, and anti-spam laws. Customers are responsible for:

• providing lawful notices to End Users regarding authentication messages;
• obtaining and documenting any legally required consents or authorizations;
• determining the lawful basis for processing End User Personal Data;
• ensuring messages sent through the Flow2FA Services are lawful and non-deceptive;
• maintaining accurate End User contact data;
• ensuring that End User data submitted to Flow2FA may lawfully be processed; and
• properly configuring their own vendors, SMPP binds, or Flow2FA-supplied routes.

Flow2FA may suspend, restrict, or terminate access to the Services where we believe it is necessary to protect End Users, prevent abuse, preserve service integrity, comply with law, respond to carrier or regulator requirements, or enforce our Website Terms of Use.

Flow2FA does not require Customers to submit Sensitive Personal Data through the Flow2FA Services. Customers must not submit Sensitive Personal Data, protected health information, children's data, biometric data, government identifiers, or other regulated data through the Services unless:

• the Customer has obtained all legally required consent or authorization;
• such processing is permitted under the applicable agreement with Flow2FA; and
• Flow2FA has confirmed that the relevant Services are configured to support that processing.

The Flow2FA Services are not intended for the processing of Protected Health Information under HIPAA unless Flow2FA and the Customer have entered into a separate agreement addressing that processing. Where we process Sensitive Personal Data as controller, we do so only where permitted by applicable law and, where required, with explicit consent.

The Flow2FA Services are intended for business customers and are not directed to children or minors under 18. We do not knowingly collect Personal Data from children under 13 through our website or AI assistant. Customers must not use the Flow2FA Services to deliver messages to children or minors unless they have obtained all legally required consents and authorizations.

If you believe a child has provided Personal Data to us, please contact dataprotectionofficer@flowstates.net.

flow2fa.com does not use analytics, advertising, social-media pixels or cross-site tracking technologies. On your first visit you see a banner headed "Your privacy choices" that lets you accept or reject optional storage with equal prominence, or open granular preferences. Your choice is recorded in a necessary first-party localStorage entry, flow2fa.storageConsent.v1, which holds the preference, policy version, decision timestamp, expiry and method for 180 days and is not sent to our servers.

The only optional technology is a persistent identifier, flow2fa.chat.sessionId.v1, that lets the website assistant continue a conversation across pages, reloads and later visits. It is never created or read before you consent, and only once you open or use the assistant. Without that consent the assistant still works using a temporary identifier held in page memory only. You can reopen or change your choices at any time using "Cookie settings" in the website footer. Full details are set out in our Cookie and Similar Technologies Policy.

If this changes in the future — for example, if we introduce analytics — we will update this Privacy Policy and our Cookie Policy and obtain any consent required by applicable law before the technology is used.

We may disclose Personal Data to the following categories of recipients:

• Flow2FA staff and authorized personnel, subject to access controls and confidentiality obligations;
• hosting, cloud infrastructure, and database providers (including Supabase, which stores our contact-form submissions and AI assistant conversations);
• the AI infrastructure and model providers used to generate assistant replies (the Lovable AI Gateway and the underlying Google Gemini model);
• vendors, carriers, and mobile operators involved in delivering WhatsApp, SMS, or email messages, whether supplied by the Customer or by Flow2FA;
• professional advisers, including lawyers, accountants, auditors, and insurers;
• public authorities, courts, regulators, or law enforcement where required or permitted by law;
• parties involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction; and
• Customers, where we process End User data on their behalf as a processor.

We use third-party subprocessors, service providers, and vendors to help provide, secure, maintain, and improve the Flow2FA Services. These currently include our database and backend infrastructure provider (Supabase) and the AI infrastructure used by our assistant (the Lovable AI Gateway and the underlying Google Gemini model). Customers may also route traffic through their own vendors and SMPP binds, which are not Flow2FA subprocessors.

Our subprocessors are required to process Personal Data under contract and only for the purposes authorized by Flow2FA or our Customers, using appropriate confidentiality, security, and privacy safeguards. Where required by our DPA, we provide Customers with notice of new subprocessors and an opportunity to object.

Flow2FA is based in the United States, and Personal Data we process — whether as controller or processor — may be processed in the United States and in other countries where our subprocessors operate. Where we transfer Personal Data from the EEA, UK, Switzerland, Colombia, or another jurisdiction that restricts international transfers, we use appropriate safeguards where required, such as:

• Standard Contractual Clauses;
• the UK International Data Transfer Agreement or UK Addendum;
• applicable adequacy decisions;
• data processing or transmission agreements; or
• another lawful transfer mechanism recognized under applicable law.

You may contact us at dataprotectionofficer@flowstates.net for more information about the transfer safeguards we use.

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Because exact retention periods depend on the type of record and applicable legal requirements, we describe the criteria we apply below rather than fixed periods.

We use administrative, technical, and organizational safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, including access controls, encryption in transit, and database-level access restrictions on our backend infrastructure. No security measure is perfect, and we cannot guarantee absolute security. If we become aware of a security incident affecting Personal Data, we will take reasonable steps to investigate and notify affected parties as required by applicable law.

Depending on your location and the applicable law, you may have rights to access, correct, delete, restrict, or object to our processing of your Personal Data, to receive a copy of your data in a portable format, or to withdraw consent where processing is based on consent. You may exercise these rights by contacting dataprotectionofficer@flowstates.net. Where Flow2FA processes your Personal Data as a processor on behalf of a Customer, we may direct your request to that Customer, who is generally best placed to respond.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

• access the Personal Data we hold about you;
• rectify inaccurate or incomplete Personal Data;
• erase your Personal Data in certain circumstances;
• restrict or object to processing in certain circumstances;
• request data portability; and
• lodge a complaint with your local data protection supervisory authority.

Where we rely on legitimate interests to process your data as controller, you have the right to object at any time. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

For cookies and similar technologies, you can withdraw consent as easily as you gave it by using "Cookie settings" in the website footer. Changing that setting stops any further persistent storage on your device and removes the optional assistant-continuity identifier immediately, so earlier conversations are no longer restored in your browser. It does not by itself delete assistant messages already stored on our servers. You can delete those yourself using "Delete this conversation" in the assistant panel, which permanently removes that conversation and all of its messages from our live database; in any event, each conversation is deleted automatically 30 days after its last message. Other requests to access or delete server-side data are handled as privacy-rights requests under this Privacy Policy, using the contact details above.

Residents of certain U.S. states — including California, Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws — may have rights to know what Personal Information we collect about them, to access or delete that information, to correct inaccuracies, to opt out of the sale or sharing of Personal Information or its use for targeted advertising, and to be free from discrimination for exercising these rights.

Flow2FA does not sell Personal Information for money, and the current version of flow2fa.com does not use Personal Information for targeted advertising or cross-context behavioral advertising. You may exercise your state privacy rights by contacting dataprotectionofficer@flowstates.net. The full California Privacy Notice below describes our practices and your rights in more detail; other state residents may exercise comparable rights using the same contact channel.

This section supplements the rest of this Privacy Policy and applies to California residents, as required by the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

This section applies to Personal Data processing subject to Colombian data protection law, including Law 1581 of 2012 and its implementing regulations.

We may send account-related, transactional, service, and support communications to our Customers and business contacts as part of operating the Flow2FA Services. Where we send any promotional communications, we will do so only where permitted by law and will provide an opt-out mechanism. You may object to any such communications at any time by contacting dataprotectionofficer@flowstates.net. We may continue to send non-promotional communications, including transactional, account, security, billing, and legal messages.

If you receive an OTP or verification message sent by a Flow2FA Customer through the Flow2FA Services, the Customer is generally responsible for that message and for honouring your preferences. If you contact Flow2FA about a message you received, we may forward your request to the relevant Customer or help process the request as required by law, contract, or carrier rules. Because OTP and verification messages are transactional and typically required to complete authentication, an opt-out request may mean the Customer can no longer authenticate you through that channel.

Some browsers provide "Do Not Track" settings. Because there is no uniform industry standard for responding to Do Not Track signals, and because our website does not currently use advertising or analytics cookies, we do not respond differently to Do Not Track signals at this time. Where required by law, including California law, we will honour recognized opt-out preference signals, such as Global Privacy Control, as a request to opt out of any future sale or sharing of Personal Information for the relevant browser, device, or account.

We do not use Personal Data for automated decision-making that produces legal or similarly significant effects without appropriate notice and lawful basis. Our AI assistant generates conversational replies only and does not make decisions about you. Where the Flow2FA Services include risk signals or delivery-monitoring logic used to route, retry, or fall back a message between channels, this operational logic is used to improve delivery reliability and does not constitute profiling that produces legal or similarly significant effects on End Users.

We may disclose Personal Data where we believe disclosure is necessary or appropriate to:

• comply with applicable law;
• respond to subpoenas, court orders, warrants, lawful government requests, or legal process;
• cooperate with regulators or law enforcement;
• protect the rights, property, or safety of Flow2FA, Customers, End Users, or others;
• investigate fraud, abuse, security incidents, or unlawful activity;
• enforce our agreements and policies; or
• preserve evidence or defend legal claims.

If Flow2FA is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, Personal Data may be disclosed or transferred as part of that transaction, subject to appropriate safeguards and applicable law.

Our website and Services may link to third-party websites, platforms, or integrations, including channel providers such as WhatsApp, mobile carriers, and Customer-supplied vendors. We are not responsible for the privacy practices of third parties, and their own privacy policies govern their collection and use of Personal Data.

We may update this Privacy Policy from time to time. The "Last Revised" date at the top of this page indicates when it was last updated. Where required by law, we will provide additional notice or obtain consent for material changes. See also our Website Terms of Use and Ethics Policy for related commitments.

For questions, privacy rights requests, complaints, Colombian consultas or reclamos, California privacy requests, GDPR requests, or other data protection concerns, please contact:

Flowstates Inc, doing business as Flow2FA
330 Madison Avenue, 27th Floor
New York, NY 10017
United States

Privacy Contact / Data Protection Officer: dataprotectionofficer@flowstates.net
Legal: legal@flowstates.net
Or use our contact page.

This Privacy Policy is governed by the laws of the State of New York, United States.