Roles and processing
For customer-controlled company or workforce data, the customer generally determines authorized purpose, participants, and access; FlowState processes the information to provide, secure, support, and document the purchased service.
Processing may include collection, organization, analysis, report generation, secure storage, support, authorized combination analysis, and deletion or return under the agreement.
Customer obligations
- Establish lawful authority, required notice or consent, purpose limitation, and data accuracy.
- Provide only information reasonably needed for the purchased purpose.
- Do not instruct FlowState to process information unlawfully or infer prohibited medical or protected characteristics.
- Identify authorized report recipients and revoke access when responsibilities change.
MTNV boundary
MTNV produces contextual behavioral evidence and workplace hypotheses under observed assessment conditions. It does not diagnose personality disorders, narcissism, dishonesty, criminality, disability, mental illness, or permanent suitability.
MTNV outputs must not be used as an automatic or sole basis for hiring, firing, promotion, compensation, discipline, benefits, or another consequential employment decision. Employers remain responsible for job-relatedness, validation where required, consistent administration, accommodations, human review, factual correction, appeal, and adverse-impact monitoring.
Security, subprocessors, and incidents
FlowState will use reasonable safeguards, company isolation, role controls, private storage, and confidentiality duties. Service providers may support hosting, authentication, storage, email, payments, documents, security, and support under appropriate obligations.
FlowState will notify the business customer without unreasonable delay after confirming a covered incident when notification is contractually or legally required, subject to law-enforcement restrictions and ongoing investigation.
Retention, deletion, export, and verification
Data is retained only as reasonably required for services, contracts, security, dispute prevention, tax/legal obligations, backup cycles, and documented purposes. Authorized deletion or export requests require identity and company-authority verification and remain subject to lawful retention and legal hold.
FlowState may provide reasonable compliance information; reviews must protect security, other customers, and trade secrets and must not become unrestricted access to protected systems.