Press n or j to go to the next uncovered block, b, p or k for the previous block.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 | 3x | // privacy.ts — GENERATED from docs/site-text/. Do not hand-edit.
// Regenerate with scripts/build-legal-content.py when counsel revises copy.
import type {LegalDocument} from './types';
export const privacy: LegalDocument = {
"slug": "privacy",
"title": "Privacy Policy",
"version": "1.0",
"effectiveDate": "July 7, 2026",
"lastUpdated": "July 7, 2026",
"blocks": [
{
"type": "heading",
"level": 1,
"text": "1. INTRODUCTION AND SCOPE"
},
{
"type": "heading",
"level": 2,
"text": "1.1 Overview"
},
{
"type": "p",
"text": "This Privacy Policy describes how FlowState Flow State Capital LLC, together with its affiliates as applicable (“FlowState,” “Company,” “we,” “us,” or “our”), collects, uses, discloses, stores, processes, and protects information in connection with our website, online platform, digital tools, treasury workflows, business-purpose financial technology services, educational content, communications, onboarding processes, and related services."
},
{
"type": "p",
"text": "FlowState is designed primarily for Business Customers and Authorized Users who access our Platform for business, commercial, treasury, operational, lending, administrative, or institutional purposes. Because our services may involve business treasury management, business-purpose lending support, partner banking access, identity verification, due diligence, account opening workflows, and compliance review, we may collect both personal information about individuals and non-personal business information about organizations."
},
{
"type": "heading",
"level": 2,
"text": "1.2 Relationship to Other Policies and Agreements"
},
{
"type": "p",
"text": "This Privacy Policy should be read together with FlowState’s Terms of Use, Cookie Policy, Financial Services Disclaimer, Security and Data Protection Statement, Banking Partner Disclosure, Product Agreements, account agreements, electronic communications consents, customer due diligence notices, and other disclosures provided in connection with specific services."
},
{
"type": "p",
"text": "If a Product Agreement, Banking Partner agreement, or legally required privacy notice provides different or more specific terms regarding a particular product, account, transaction, or service, that document may control with respect to the specific subject matter it covers."
},
{
"type": "heading",
"level": 2,
"text": "1.3 Business-Focused Platform"
},
{
"type": "p",
"text": "The Platform is intended for business use. However, we may collect personal information about individuals associated with Business Customers, including owners, beneficial owners, control persons, officers, directors, managers, employees, contractors, authorized signers, guarantors, applicants, prospective customers, website visitors, and other individuals who interact with us."
},
{
"type": "heading",
"level": 1,
"text": "2. DEFINITIONS"
},
{
"type": "p",
"text": "For purposes of this Privacy Policy, the following terms have the meanings set forth below. Capitalized terms not defined in this Privacy Policy may have the meanings given in FlowState’s Terms of Use or applicable Product Agreements."
},
{
"type": "p",
"text": "“Authorized User” means any individual authorized by a Business Customer to access the Platform or interact with FlowState on behalf of that Business Customer."
},
{
"type": "p",
"text": "“Banking Partner” or “Partner Financial Institution” means any bank, trust company, credit union, depository institution, custodian, lender, payment processor, loan servicer, or other regulated or licensed third party that may provide financial services in connection with the Platform."
},
{
"type": "p",
"text": "“Business Customer” means any company, corporation, limited liability company, partnership, trust, fund, family office, sole proprietorship, organization, or other commercial or legal entity that accesses or uses the Platform or Services for business purposes."
},
{
"type": "p",
"text": "“Customer Data” means information, documents, records, and data submitted to or collected by FlowState in connection with the Platform or Services."
},
{
"type": "p",
"text": "“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identified or identifiable individual, as defined under applicable privacy laws."
},
{
"type": "p",
"text": "“Platform” means the FlowState website, portals, dashboards, forms, workflows, digital tools, document collection systems, communications systems, and related technology."
},
{
"type": "p",
"text": "“Services” means the products, tools, workflows, resources, content, and services made available by FlowState, including treasury management tools, business-purpose liquidity tools, onboarding workflows, educational content, and access to Partner Services where applicable."
},
{
"type": "p",
"text": "“Third-Party Provider” means any vendor, service provider, technology provider, data provider, compliance vendor, analytics provider, CRM provider, marketing provider, or other third party that supports FlowState’s operations or Services."
},
{
"type": "heading",
"level": 1,
"text": "3. INFORMATION WE COLLECT"
},
{
"type": "heading",
"level": 2,
"text": "3.1 Personal Information You Provide"
},
{
"type": "p",
"text": "We may collect Personal Information that you provide directly to us when you visit our website, submit a form, request information, create an Account, apply for Services, communicate with us, attend a webinar, download materials, join a mailing list, complete due diligence, execute documents, or otherwise interact with FlowState."
},
{
"type": "p",
"text": "• Name, business title, company affiliation, and role."
},
{
"type": "p",
"text": "• Email address, telephone number, mailing address, and business address."
},
{
"type": "p",
"text": "• Username, password, authentication details, security questions, and account credentials."
},
{
"type": "p",
"text": "• Government-issued identification information where required for identity verification."
},
{
"type": "p",
"text": "• Date of birth, taxpayer identification number, Social Security number, passport number, driver’s license number, or similar identifiers where required for compliance, onboarding, lending, or partner financial institution purposes."
},
{
"type": "p",
"text": "• Signature, electronic signature, consent records, and authorization records."
},
{
"type": "p",
"text": "• Communications with FlowState, including emails, chat messages, support requests, call notes, meeting notes, and feedback."
},
{
"type": "p",
"text": "• Information submitted through forms, applications, questionnaires, certifications, documents, or portals."
},
{
"type": "heading",
"level": 2,
"text": "3.2 Personal Information Collected in Connection with Business Customers"
},
{
"type": "p",
"text": "Because FlowState serves Business Customers, we may collect Personal Information about individuals associated with a Business Customer. This may include beneficial owners, control persons, directors, officers, managers, members, partners, trustees, authorized signers, administrators, employees, contractors, guarantors, applicants, representatives, and other related parties."
},
{
"type": "p",
"text": "• Ownership percentages and beneficial ownership details."
},
{
"type": "p",
"text": "• Control person and senior management information."
},
{
"type": "p",
"text": "• Authority documentation, resolutions, incumbency information, and signatory authority."
},
{
"type": "p",
"text": "• Employment or organizational role."
},
{
"type": "p",
"text": "• Contact information for business-related communications."
},
{
"type": "p",
"text": "• Identity verification materials and compliance documentation."
},
{
"type": "p",
"text": "• Information contained in organizational documents, cap tables, account opening materials, loan documents, tax forms, and due diligence files."
},
{
"type": "heading",
"level": 2,
"text": "3.3 Information Collected Automatically"
},
{
"type": "p",
"text": "When you interact with the Website or Platform, we may automatically collect technical, usage, and device information through cookies, pixels, log files, software development kits, analytics tools, browser storage, and similar technologies."
},
{
"type": "p",
"text": "• IP address, device identifiers, browser type, operating system, device type, and approximate location derived from IP address."
},
{
"type": "p",
"text": "• Pages viewed, links clicked, forms started or completed, documents downloaded, time spent on pages, referring and exit pages, and navigation paths."
},
{
"type": "p",
"text": "• Login activity, session information, authentication events, account activity, error logs, and security events."
},
{
"type": "p",
"text": "• Cookie identifiers, analytics identifiers, advertising identifiers, preference settings, and consent choices."
},
{
"type": "p",
"text": "• Performance data, crash reports, diagnostic data, and system metadata."
},
{
"type": "heading",
"level": 2,
"text": "3.4 Information from Third Parties"
},
{
"type": "p",
"text": "We may collect information from third parties where permitted by law and relevant to our Services, business operations, compliance obligations, underwriting, risk management, fraud prevention, or customer support."
},
{
"type": "p",
"text": "• Banking Partners, Partner Financial Institutions, lenders, custodians, loan servicers, payment processors, and financial service providers."
},
{
"type": "p",
"text": "• Identity verification, sanctions screening, fraud prevention, compliance, and risk vendors."
},
{
"type": "p",
"text": "• Commercial databases, public records, government records, business registries, secretary of state filings, and tax records."
},
{
"type": "p",
"text": "• CRM, marketing automation, email, analytics, customer support, and communications providers."
},
{
"type": "p",
"text": "• Credit-related, business data, bank account verification, accounting, payroll, transaction, and financial data providers, where permitted."
},
{
"type": "p",
"text": "• Professional advisors, referral partners, consultants, brokers, legal counsel, accountants, auditors, and administrators."
},
{
"type": "heading",
"level": 1,
"text": "4. BUSINESS INFORMATION WE COLLECT"
},
{
"type": "heading",
"level": 2,
"text": "4.1 Categories of Business Information"
},
{
"type": "p",
"text": "In addition to Personal Information, FlowState may collect business and organizational information about Business Customers. This information may not always be Personal Information, but it may be sensitive or confidential to the Business Customer."
},
{
"type": "p",
"text": "• Legal entity name, trade names, formation jurisdiction, entity type, registration status, and good standing information."
},
{
"type": "p",
"text": "• Employer identification number, tax status, business licenses, regulatory status, and industry classification."
},
{
"type": "p",
"text": "• Business address, operating locations, website, domain, and contact points."
},
{
"type": "p",
"text": "• Organizational documents, ownership records, capitalization information, beneficial ownership charts, authority documents, and resolutions."
},
{
"type": "p",
"text": "• Banking relationships, account information, treasury practices, cash balances, cash flow information, deposits, payments, transaction history, and liquidity needs."
},
{
"type": "p",
"text": "• Financial statements, tax returns, bank statements, revenue information, expenses, liabilities, assets, borrowing needs, collateral information, and business plans."
},
{
"type": "p",
"text": "• Contracts, invoices, purchase agreements, sale agreements, collateral documents, loan documents, investor documents, and commercial records."
},
{
"type": "p",
"text": "• Information about counterparties, vendors, customers, investors, lenders, affiliates, subsidiaries, and related parties."
},
{
"type": "heading",
"level": 2,
"text": "4.2 Use of Business Information"
},
{
"type": "p",
"text": "We may use Business Customer information to evaluate eligibility, provide Services, support treasury workflows, coordinate partner banking access, process applications, support underwriting, perform compliance review, manage risk, prevent fraud, administer accounts, communicate with customers, develop products, and maintain records."
},
{
"type": "p",
"text": "Business information may be shared with Banking Partners, Partner Financial Institutions, lenders, payment processors, custodians, compliance vendors, verification providers, data providers, professional advisors, and other Third-Party Providers where necessary or appropriate for these purposes."
},
{
"type": "heading",
"level": 2,
"text": "4.3 Confidentiality of Business Information"
},
{
"type": "p",
"text": "FlowState intends to treat non-public business information with commercially reasonable care and in accordance with applicable agreements, privacy notices, security practices, and law. However, information submitted through the Website or Platform may be used and shared as described in this Privacy Policy and applicable Product Agreements."
},
{
"type": "heading",
"level": 1,
"text": "5. COOKIES, ANALYTICS, AND SIMILAR TECHNOLOGIES"
},
{
"type": "heading",
"level": 2,
"text": "5.1 Cookies and Similar Technologies"
},
{
"type": "p",
"text": "We may use cookies, pixels, tags, scripts, local storage, session storage, software development kits, and similar technologies to operate the Website and Platform, remember preferences, authenticate users, analyze usage, improve performance, detect fraud, secure accounts, deliver content, and support marketing activities."
},
{
"type": "p",
"text": "• Essential cookies used to operate the Website and Platform, maintain sessions, authenticate users, provide security, remember privacy choices, and enable core functionality."
},
{
"type": "p",
"text": "• Functional cookies used to remember preferences, improve user experience, and support platform features."
},
{
"type": "p",
"text": "• Analytics cookies used to understand how visitors and users interact with the Website and Platform."
},
{
"type": "p",
"text": "• Marketing or advertising cookies used to measure campaigns, understand referrals, build audiences, or deliver relevant communications where permitted."
},
{
"type": "p",
"text": "• Security cookies and similar technologies used to detect fraud, abuse, suspicious activity, account takeover attempts, and unauthorized access."
},
{
"type": "heading",
"level": 2,
"text": "5.2 Analytics"
},
{
"type": "p",
"text": "We may use analytics providers to help us understand website traffic, product usage, conversion funnels, user behavior, page performance, and campaign effectiveness. Analytics providers may collect information such as IP address, device information, browser information, page views, events, clicks, referring pages, and other usage data."
},
{
"type": "p",
"text": "Analytics information may be used to improve the Website, Platform, Content, Services, user experience, marketing strategy, security, and operational performance."
},
{
"type": "heading",
"level": 2,
"text": "5.3 Cookie Choices"
},
{
"type": "p",
"text": "Depending on your jurisdiction and the technologies we use, you may be able to manage cookie preferences through a cookie banner, consent management tool, browser settings, or other mechanisms provided by FlowState or third parties. Browser controls may not block all technologies, and disabling certain cookies may affect Website or Platform functionality."
},
{
"type": "heading",
"level": 1,
"text": "6. CRM, MARKETING, AND COMMUNICATIONS"
},
{
"type": "heading",
"level": 2,
"text": "6.1 CRM Integrations"
},
{
"type": "p",
"text": "FlowState may use customer relationship management systems, marketing automation tools, email platforms, sales enablement tools, customer support platforms, calendar tools, and communications systems to manage contacts, leads, prospects, customers, investor or partner inquiries, onboarding workflows, service requests, and business relationships."
},
{
"type": "p",
"text": "• Contact information, company information, role, relationship status, communication history, meeting notes, customer support notes, pipeline status, onboarding status, and preferences."
},
{
"type": "p",
"text": "• Form submissions, downloaded materials, webinar attendance, event registrations, newsletter subscriptions, and website interactions."
},
{
"type": "p",
"text": "• Lead source, referral source, campaign attribution, engagement activity, and communications history."
},
{
"type": "heading",
"level": 2,
"text": "6.2 Marketing Communications"
},
{
"type": "p",
"text": "We may send administrative, operational, transactional, security, compliance, service-related, educational, promotional, or marketing communications. Marketing communications may include newsletters, product updates, event invitations, educational materials, treasury insights, lending information, case studies, and other business-related content."
},
{
"type": "p",
"text": "You may opt out of marketing emails by using the unsubscribe link or by contacting us. Even if you opt out of marketing communications, we may still send non-marketing communications, including service notices, legal notices, security alerts, compliance requests, account notices, due diligence requests, transaction communications, and other administrative communications."
},
{
"type": "heading",
"level": 2,
"text": "6.3 Telephone, SMS, and Similar Communications"
},
{
"type": "p",
"text": "Where permitted by law and with any required consent, FlowState may communicate by phone, SMS, text message, messaging applications, or similar channels for service-related, onboarding, security, support, or business relationship purposes. Message and data rates may apply. You should not use SMS or unsecured messaging channels to send sensitive information unless FlowState expressly directs you to do so through an approved secure process."
},
{
"type": "heading",
"level": 1,
"text": "7. HOW WE USE INFORMATION"
},
{
"type": "p",
"text": "FlowState may use Personal Information, Business Customer information, Customer Data, automatically collected information, and third-party information for the following purposes:"
},
{
"type": "p",
"text": "• Provide, operate, maintain, improve, and secure the Website, Platform, Content, and Services."
},
{
"type": "p",
"text": "• Create, administer, authenticate, and manage Accounts and Authorized Users."
},
{
"type": "p",
"text": "• Process inquiries, applications, onboarding materials, documents, and service requests."
},
{
"type": "p",
"text": "• Verify identity, authority, business existence, beneficial ownership, control persons, source of funds, and business purpose."
},
{
"type": "p",
"text": "• Perform customer due diligence, enhanced due diligence, sanctions screening, anti-money laundering review, fraud prevention, and risk management."
},
{
"type": "p",
"text": "• Coordinate with Banking Partners, Partner Financial Institutions, lenders, payment processors, custodians, loan servicers, and other Third-Party Providers."
},
{
"type": "p",
"text": "• Support treasury workflows, cash management tools, business-purpose lending workflows, underwriting support, collateral review, and reporting tools."
},
{
"type": "p",
"text": "• Communicate with Users and Business Customers, provide customer support, respond to requests, and send service-related notices."
},
{
"type": "p",
"text": "• Analyze Website and Platform usage, improve products, develop new features, monitor performance, and conduct research."
},
{
"type": "p",
"text": "• Send marketing communications, educational content, event invitations, and product updates where permitted by law."
},
{
"type": "p",
"text": "• Detect, investigate, prevent, and respond to fraud, cyber threats, unauthorized access, policy violations, legal claims, disputes, and suspicious activity."
},
{
"type": "p",
"text": "• Comply with legal, regulatory, tax, accounting, audit, recordkeeping, reporting, litigation, subpoena, court order, law enforcement, and governmental obligations."
},
{
"type": "p",
"text": "• Enforce Terms of Use, Product Agreements, policies, rights, and remedies."
},
{
"type": "p",
"text": "• Protect the rights, property, safety, security, reputation, and integrity of FlowState, Users, Business Customers, Banking Partners, Partner Financial Institutions, Third-Party Providers, and the Platform."
},
{
"type": "p",
"text": "• Create aggregated, anonymized, or de-identified data for lawful business purposes."
},
{
"type": "heading",
"level": 2,
"text": "7.1 Legal Bases Where GDPR Applies"
},
{
"type": "p",
"text": "Where GDPR, UK GDPR, or similar laws apply, our legal bases for processing may include performance of a contract, steps taken prior to entering into a contract, compliance with legal obligations, legitimate interests, consent, and protection of vital interests where applicable. Additional GDPR-ready disclosures are included below for attorney review and customization."
},
{
"type": "heading",
"level": 1,
"text": "8. HOW WE SHARE INFORMATION"
},
{
"type": "p",
"text": "We may share Personal Information, Business Customer information, and Customer Data as described below and as otherwise disclosed to you or authorized by you."
},
{
"type": "heading",
"level": 2,
"text": "8.1 With Banking Partners and Partner Financial Institutions"
},
{
"type": "p",
"text": "We may share information with Banking Partners, Partner Financial Institutions, lenders, custodians, payment processors, loan servicers, and other financial services providers to facilitate account opening, deposit services, treasury services, payment services, lending services, loan servicing, custody, underwriting, compliance review, risk management, fraud prevention, transaction processing, and other Partner Services."
},
{
"type": "heading",
"level": 2,
"text": "8.2 With Third-Party Providers"
},
{
"type": "p",
"text": "We may share information with vendors and service providers that support our operations, including hosting providers, cloud infrastructure providers, cybersecurity vendors, analytics providers, CRM providers, marketing automation providers, email providers, customer support platforms, identity verification providers, sanctions screening providers, fraud prevention providers, data providers, document management providers, electronic signature providers, payment processors, auditors, consultants, and professional advisors."
},
{
"type": "heading",
"level": 2,
"text": "8.3 For Compliance, Legal, and Risk Purposes"
},
{
"type": "p",
"text": "We may disclose information to regulators, governmental authorities, law enforcement agencies, courts, auditors, legal counsel, compliance professionals, Banking Partners, Partner Financial Institutions, and other authorized parties when we believe disclosure is required or appropriate to comply with law, respond to legal process, cooperate with investigations, report suspicious activity, prevent fraud, enforce agreements, protect rights, or manage risk."
},
{
"type": "heading",
"level": 2,
"text": "8.4 Business Transfers"
},
{
"type": "p",
"text": "We may disclose or transfer information in connection with a merger, acquisition, financing, restructuring, reorganization, sale of assets, bankruptcy, receivership, joint venture, investment, assignment, corporate transaction, or similar business transaction involving FlowState or any portion of its business or assets."
},
{
"type": "heading",
"level": 2,
"text": "8.5 With Consent or at Your Direction"
},
{
"type": "p",
"text": "We may share information when you consent, authorize, direct, or instruct us to do so, including when you connect a third-party account, request a Partner Service, submit information to a Banking Partner, invite an Authorized User, or use a Platform feature that involves data sharing."
},
{
"type": "heading",
"level": 2,
"text": "8.6 Aggregated and De-Identified Information"
},
{
"type": "p",
"text": "We may share aggregated, anonymized, or de-identified information that does not identify an individual or Business Customer in a manner prohibited by law. This information may be used for analytics, benchmarking, product development, research, reporting, marketing, and business intelligence."
},
{
"type": "heading",
"level": 1,
"text": "9. PARTNER FINANCIAL INSTITUTIONS AND THIRD-PARTY PROVIDERS"
},
{
"type": "p",
"text": "Certain services accessible through or in connection with FlowState may be provided by Banking Partners, Partner Financial Institutions, or Third-Party Providers rather than by FlowState. These third parties may collect, use, disclose, retain, and protect information under their own privacy notices, agreements, legal obligations, and regulatory requirements."
},
{
"type": "p",
"text": "For example, a Banking Partner may be responsible for deposit account opening, account servicing, transaction processing, regulatory reporting, and financial privacy notices. A lender or loan servicer may be responsible for loan underwriting, servicing, credit decisions, collateral review, repayment processing, and related notices. A payment processor may be responsible for ACH, wire, card, or payment activity. An identity verification vendor may be responsible for verification checks and fraud signals."
},
{
"type": "p",
"text": "FlowState is not responsible for the privacy practices of third parties that are not acting on our behalf. You should review the privacy notices and agreements of any Banking Partner, Partner Financial Institution, or Third-Party Provider whose services you access."
},
{
"type": "heading",
"level": 1,
"text": "10. DATA RETENTION"
},
{
"type": "heading",
"level": 2,
"text": "10.1 Retention Principles"
},
{
"type": "p",
"text": "We retain information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, provide Services, administer relationships, maintain business records, comply with legal and regulatory obligations, resolve disputes, enforce agreements, manage risk, prevent fraud, support audits, and protect the rights and interests of FlowState and others."
},
{
"type": "heading",
"level": 2,
"text": "10.2 Factors Affecting Retention"
},
{
"type": "p",
"text": "• The nature of the information and Services involved."
},
{
"type": "p",
"text": "• The duration of your relationship with FlowState."
},
{
"type": "p",
"text": "• Legal, regulatory, tax, accounting, audit, and recordkeeping requirements."
},
{
"type": "p",
"text": "• Banking Partner, Partner Financial Institution, lender, payment processor, custodian, and Third-Party Provider requirements."
},
{
"type": "p",
"text": "• Anti-money laundering, sanctions, fraud prevention, due diligence, and suspicious activity review obligations."
},
{
"type": "p",
"text": "• Loan, account, transaction, treasury, collateral, payment, and onboarding records."
},
{
"type": "p",
"text": "• Security, litigation, investigation, dispute resolution, and enforcement needs."
},
{
"type": "p",
"text": "• Whether deletion is technically feasible and legally permitted."
},
{
"type": "heading",
"level": 2,
"text": "10.3 Deletion and Account Closure"
},
{
"type": "p",
"text": "Closing an Account, discontinuing use of the Platform, withdrawing consent, or requesting deletion may not result in immediate deletion of all information. We may retain information where retention is required or permitted by law, necessary for legitimate business purposes, required by Banking Partners or Partner Financial Institutions, or needed to protect against fraud, resolve disputes, enforce agreements, or maintain records."
},
{
"type": "heading",
"level": 1,
"text": "11. DATA SECURITY"
},
{
"type": "p",
"text": "FlowState may implement administrative, technical, physical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, disclosure, or destruction. Safeguards may include encryption, access controls, authentication, logging, monitoring, vendor review, employee training, incident response procedures, backup and recovery processes, and other measures appropriate to the nature of the information and Services."
},
{
"type": "p",
"text": "No website, platform, transmission, network, storage system, or security measure is completely secure. We cannot guarantee absolute security. You are responsible for maintaining the security of your devices, accounts, credentials, networks, personnel, email systems, and internal controls."
},
{
"type": "p",
"text": "You should promptly notify FlowState if you suspect unauthorized access, credential compromise, business email compromise, fraud, phishing, malware, account takeover, or any other security incident involving your Account, systems, personnel, or information."
},
{
"type": "heading",
"level": 1,
"text": "12. INTERNATIONAL USERS AND CROSS-BORDER TRANSFERS"
},
{
"type": "p",
"text": "FlowState is based in the United States, and the Website, Platform, and Services are primarily intended for use by Business Customers in jurisdictions where FlowState makes the Services available. If you access the Website or Platform from outside the United States, your information may be collected, transferred to, stored in, and processed in the United States or other jurisdictions where FlowState, its service providers, Banking Partners, Partner Financial Institutions, or Third-Party Providers operate."
},
{
"type": "p",
"text": "Privacy laws in the United States or other jurisdictions may differ from the laws of your jurisdiction. By using the Website, Platform, or Services, you acknowledge that information may be processed in jurisdictions outside your location, subject to applicable law."
},
{
"type": "p",
"text": "Where GDPR, UK GDPR, Swiss privacy law, or similar international transfer rules apply, FlowState may rely on appropriate safeguards such as standard contractual clauses, adequacy decisions, contractual commitments, consent, necessity for contract performance, legal claims, or other transfer mechanisms permitted by law."
},
{
"type": "heading",
"level": 1,
"text": "13. YOUR PRIVACY CHOICES AND RIGHTS"
},
{
"type": "heading",
"level": 2,
"text": "13.1 Account and Communication Choices"
},
{
"type": "p",
"text": "You may have choices regarding certain information and communications. These may include updating Account information, correcting contact information, managing marketing email preferences, adjusting cookie settings, disabling certain browser cookies, or contacting FlowState to request assistance."
},
{
"type": "heading",
"level": 2,
"text": "13.2 Marketing Opt-Out"
},
{
"type": "p",
"text": "You may opt out of marketing emails by using the unsubscribe link included in marketing emails or by contacting us. Opting out of marketing communications does not prevent us from sending service, legal, security, compliance, account, transactional, or administrative communications."
},
{
"type": "heading",
"level": 2,
"text": "13.3 Access, Correction, Deletion, and Other Rights"
},
{
"type": "p",
"text": "Depending on your jurisdiction and relationship with FlowState, you may have rights to request access to, correction of, deletion of, restriction of, portability of, or objection to certain processing of Personal Information. These rights may be subject to limitations, exceptions, verification requirements, legal obligations, business record retention requirements, Banking Partner obligations, and other restrictions permitted by law."
},
{
"type": "p",
"text": "To submit a privacy request, contact FlowState using the contact information below. We may need to verify your identity and authority before processing a request. If you submit a request on behalf of another person or Business Customer, we may require proof of authorization."
},
{
"type": "heading",
"level": 1,
"text": "14. U.S. STATE PRIVACY RIGHTS; CCPA/CPRA-READY DISCLOSURES"
},
{
"type": "heading",
"level": 2,
"text": "14.1 Categories of Personal Information Collected"
},
{
"type": "p",
"text": "In the preceding twelve months, FlowState may have collected the following categories of Personal Information, depending on your relationship with FlowState:"
},
{
"type": "p",
"text": "• Identifiers, such as name, alias, postal address, email address, telephone number, IP address, online identifiers, government identifiers, taxpayer identifiers, and account credentials."
},
{
"type": "p",
"text": "• Customer records information, such as signature, bank account information, financial information, business contact information, and due diligence documentation."
},
{
"type": "p",
"text": "• Protected classification information, only where voluntarily provided or required for legally permissible identity, compliance, or regulatory purposes."
},
{
"type": "p",
"text": "• Commercial information, such as products or services considered, requested, or used; transaction information; service history; and customer relationship information."
},
{
"type": "p",
"text": "• Internet or electronic network activity information, such as browsing activity, search activity, page views, clicks, device information, login activity, and interactions with the Website or Platform."
},
{
"type": "p",
"text": "• Geolocation information, such as approximate location derived from IP address."
},
{
"type": "p",
"text": "• Audio, electronic, visual, or similar information, such as call recordings, video meetings, voicemail, or electronic communications where applicable and legally permitted."
},
{
"type": "p",
"text": "• Professional or employment-related information, such as title, employer, business role, authority, and organizational affiliation."
},
{
"type": "p",
"text": "• Inferences derived from other information, such as preferences, interests, risk signals, service eligibility, marketing segments, or product interests."
},
{
"type": "p",
"text": "• Sensitive personal information, such as government identifiers, financial account information, credentials, precise identifiers where applicable, and information used for identity verification, only where necessary and legally permitted."
},
{
"type": "heading",
"level": 2,
"text": "14.2 Sources of Personal Information"
},
{
"type": "p",
"text": "Sources may include you, Business Customers, Authorized Users, public records, government records, Banking Partners, Partner Financial Institutions, Third-Party Providers, data vendors, compliance vendors, marketing providers, analytics providers, CRM systems, and automatically collected website or platform data."
},
{
"type": "heading",
"level": 2,
"text": "14.3 Purposes for Collection and Use"
},
{
"type": "p",
"text": "Purposes may include providing Services, account administration, onboarding, due diligence, identity verification, compliance, fraud prevention, security, treasury workflows, lending support, customer support, marketing, analytics, legal compliance, recordkeeping, risk management, and business operations."
},
{
"type": "heading",
"level": 2,
"text": "14.4 Categories of Information Disclosed"
},
{
"type": "p",
"text": "FlowState may disclose the categories of Personal Information described above to service providers, contractors, Banking Partners, Partner Financial Institutions, lenders, payment processors, custodians, compliance vendors, analytics providers, CRM providers, marketing providers, professional advisors, regulators, governmental authorities, law enforcement, and business transaction counterparties."
},
{
"type": "heading",
"level": 2,
"text": "14.5 Sale, Sharing, and Targeted Advertising"
},
{
"type": "p",
"text": "FlowState does not intend to sell Personal Information in the traditional sense of exchanging Personal Information for money. However, certain uses of advertising, analytics, pixels, cookies, or marketing technologies may be considered a “sale,” “sharing,” targeted advertising, or cross-context behavioral advertising under some privacy laws. FlowState’s final practices should be described in the Cookie Policy and applicable opt-out mechanisms."
},
{
"type": "heading",
"level": 2,
"text": "14.6 California and Other State Rights"
},
{
"type": "p",
"text": "Subject to applicable law and verification, residents of certain U.S. states may have rights to know, access, correct, delete, obtain a portable copy of, opt out of certain sales or sharing, opt out of targeted advertising, limit certain uses of sensitive personal information, and not be discriminated against for exercising privacy rights. These rights may be subject to exceptions, including exceptions for business-to-business information, GLBA-regulated information, legal compliance, fraud prevention, security, and recordkeeping."
},
{
"type": "heading",
"level": 1,
"text": "15. GDPR-READY DISCLOSURES FOR EEA, UK, AND SWISS USERS"
},
{
"type": "heading",
"level": 2,
"text": "15.1 Controller"
},
{
"type": "p",
"text": "For purposes of GDPR-ready disclosures, FlowState Flow State Capital LLC may act as a controller with respect to Personal Information collected for its own business purposes, customer relationship management, compliance, Platform operations, marketing, and service administration. In some circumstances, FlowState may act as a processor or service provider for another entity, or another entity may act as an independent controller, depending on the applicable Product Agreement or partner arrangement."
},
{
"type": "heading",
"level": 2,
"text": "15.2 Legal Bases for Processing"
},
{
"type": "p",
"text": "Where GDPR or similar laws apply, we may process Personal Information based on one or more legal bases, including:"
},
{
"type": "p",
"text": "• Performance of a contract or steps taken prior to entering into a contract."
},
{
"type": "p",
"text": "• Compliance with legal obligations, including financial crime prevention, sanctions, tax, accounting, regulatory, and recordkeeping obligations."
},
{
"type": "p",
"text": "• Legitimate interests, including operating and improving the Platform, securing systems, preventing fraud, managing business relationships, analyzing usage, and developing services."
},
{
"type": "p",
"text": "• Consent, including for certain marketing communications or non-essential cookies where required."
},
{
"type": "p",
"text": "• Establishment, exercise, or defense of legal claims."
},
{
"type": "heading",
"level": 2,
"text": "15.3 GDPR Rights"
},
{
"type": "p",
"text": "Subject to applicable law, individuals may have rights to access, rectify, erase, restrict, object to processing, receive portability, withdraw consent, and lodge a complaint with a supervisory authority. These rights may be limited by legal obligations, financial services requirements, fraud prevention, recordkeeping, legal claims, and other lawful bases for retaining or processing information."
},
{
"type": "heading",
"level": 2,
"text": "15.4 International Transfers"
},
{
"type": "p",
"text": "Where required, FlowState may rely on standard contractual clauses, adequacy decisions, consent, necessity for contract performance, legal claims, or other lawful transfer mechanisms for cross-border transfers of Personal Information."
},
{
"type": "heading",
"level": 1,
"text": "16. CHILDREN’S PRIVACY"
},
{
"type": "p",
"text": "The Website, Platform, Content, and Services are intended for business use and are not directed to children. FlowState does not knowingly collect Personal Information from children under the age of thirteen, or under the age threshold applicable in a particular jurisdiction, without appropriate consent. If we learn that we have collected Personal Information from a child in violation of applicable law, we will take appropriate steps to delete or otherwise address the information."
},
{
"type": "heading",
"level": 1,
"text": "17. CHANGES TO THIS PRIVACY POLICY"
},
{
"type": "p",
"text": "FlowState may update this Privacy Policy from time to time to reflect changes in our business, Services, technology, data practices, legal requirements, or operational needs. When we update this Privacy Policy, we may revise the “Last Updated” date and provide notice as required by law or as otherwise appropriate."
},
{
"type": "p",
"text": "Your continued use of the Website, Platform, or Services after an updated Privacy Policy becomes effective means that you acknowledge the updated Privacy Policy, subject to any rights or consent requirements under applicable law."
},
{
"type": "heading",
"level": 1,
"text": "18. CONTACT INFORMATION"
},
{
"type": "p",
"text": "Questions, requests, or concerns regarding this Privacy Policy or FlowState’s privacy practices may be directed to:"
},
{
"type": "p",
"text": "Flow State Capital LLC\nAttn: Privacy / Legal Department\n383 W Lakeview Rd\nLindon UT 84042\nadmin@flowstatecapital.ai\nflowstatecapital.ai"
}
]
};
|