Privacy notice.

Who is responsible?

Flow Labs Ltd, registered in the United Arab Emirates and trading as Flow Labs, is responsible for the personal information handled through flowlabs.me. This notice covers this services website, not Surf or other websites in our portfolio.

For privacy questions or requests, use our contact form and start your message with "Privacy request". If we have already corresponded, you can also reply to that email.

What we handle and why

When you submit the form, we receive your name, email address and message. We use these to respond, discuss your project and keep relevant correspondence. Please do not send passwords, wallet keys or sensitive personal information.

Our hosting and security providers may process technical information such as your IP address, request time, requested page, browser information and error or security logs. This supports website delivery, troubleshooting and protection against spam and abuse. The contact endpoint uses per-IP rate limiting.

Where applicable law requires a lawful basis, we rely on steps taken at your request before a contract for project enquiries, our legitimate interests in handling other correspondence and protecting the website, and any applicable legal obligations. Where consent is required, it must be obtained for that purpose; submitting an enquiry is not consent to marketing.

Where your information goes

Vercel hosts the website and processes form requests. Resend sends your enquiry to our Namecheap Private Email inbox. Relevant team members and service providers may handle information as needed to respond and operate the service.

We do not save enquiries in a website database. Copies can still exist in our email correspondence and in providers' delivery records, logs or backups. We do not sell enquiry data or add people to marketing lists because they contacted us.

Providers may process information outside your country, including through international infrastructure and support. The Resend sending domain is configured in Ireland; this does not mean all processing stays there. Applicable transfer safeguards depend on the provider agreements and relevant law.

How long information is kept

Retention depends on whether an enquiry remains active, leads to a project, or is needed for contractual, accounting or legal purposes. We do not currently operate a fixed automatic deletion schedule for enquiry emails. Provider logs and backups have their own retention settings and policies.

You can ask us to delete an enquiry that is no longer needed. We will assess the request and explain any information we need to retain under applicable obligations.

Cookies and tracking

We have not added advertising trackers or analytics scripts to this website. Hosting and security services may still process technical requests and use mechanisms needed to deliver and protect the site. External websites linked from our portfolio have their own privacy practices.

Your choices and rights

Depending on the law that applies, you may have rights to access, correct or delete your personal information, restrict or object to its use, request a portable copy, or withdraw consent where processing relies on consent. You may also be able to complain to the relevant data protection authority.

Contact us through the form to make a request. We may need to verify your identity before disclosing or changing personal information. Some requests are subject to legal exceptions.

Changes to this notice

We will update this page when our website's data handling changes. The date above identifies the latest version.