Information we may collect
- Public-site and demo responses; name, email, company, role, phone, and communications.
- Authentication, invitation, account, company membership, role, session, entitlement, and security records.
- Purchases, invoices, order status, and limited payment metadata from the payment provider; FlowState should not store full card numbers.
- Operational assessment responses, company facts, locations, teams, reports, evidence, and authorized uploads.
- MTNV scenario choices, interpretations, confidence, limitations, and workplace-development information.
- Device, browser, timestamp, log, cookie, analytics, support, seminar, testimonial, and marketing-preference information.
How information is used
FlowState uses information to provide demos and purchased services, create and secure accounts, isolate company workspaces, process verified purchases and entitlements, generate reports, provide support, prevent misuse, maintain evidence, improve reliability, and comply with law.
Identifiable customer information is not used for an undisclosed materially different purpose. Research or system improvement using identifiable or linkable customer information requires authority under the applicable agreement or separate permission.
Business customer and workforce data
When a business provides workforce information and FlowState processes it under that business's instructions, the business generally determines the authorized purpose and participants. Individuals should ordinarily direct workplace-record requests to that business; FlowState will assist as required by contract and applicable law.
MTNV does not diagnose a person and should not be used as an automatic or sole employment decision-maker.
Sharing
Information may be shared with authorized company administrators and assigned reviewers; service providers supporting hosting, authentication, storage, email, payments, documents, security, analytics, and support; professional advisers; transaction successors subject to protection; and authorities or others when lawfully required or reasonably necessary to protect rights and security.
FlowState does not sell personal data for money. If future practices constitute covered sale, targeted advertising, or profiling, the notice and required choice mechanisms must be updated before that practice begins.
Retention and security
Information is retained only as reasonably needed for services, contracts, security, disputes, tax and legal obligations, backup cycles, and documented business purposes. Required deletion may be delayed by lawful retention, security investigation, backup rotation, or legal hold.
FlowState uses reasonable safeguards including independent authentication, company and role controls, entitlement checks, private storage, encrypted transport, logs, sessions, backups, and recovery procedures. No system can promise absolute security.
Your choices and requests
Depending on context and applicable law, a verified person may request access, correction, export, deletion, or withdrawal of consent and may opt out of marketing. Identity, company authority, and report-recipient authority may be verified before protected information is changed or released.
Submit a request through the signed-in Privacy & Data Rights center or contact privacy@thinkflowstate.com. Appeals or unresolved privacy questions may be submitted through the same contact.
Children, changes, and contact
FlowState is a business service and is not directed to children under 13. Material notice changes will identify a new version and effective date.
Privacy contact: privacy@thinkflowstate.com. Business: FlowState Consulting LLC, Colorado, United States.