Legal
Privacy Policy
Last updated: 7 October 2026
This Privacy Policy explains how Flow Inc. Ltd("CreativeFlow", "we", "us" or "our") collects, uses and protects personal data when you visit our website, book a call with us, or use the CreativeFlow design subscription service and its client platform (the "Service").
We are the data controllerfor personal data we process about you. We process personal data in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1. Who we are
Flow Inc. Ltd is a company registered in England & Wales under company number 11403469. Our registered office is at The Financial Management Centre, Meads Business Centre, 19 Kingsmead, Farnborough, England, GU14 7SR. You can contact us at Support@creativeflowstudio.co.uk.
We have not appointed a Data Protection Officer, as we are not required to under Article 37 UK GDPR. Privacy enquiries are handled by our team at the address above.
2. The personal data we collect
Depending on how you interact with us, we may collect:
- Identity and contact data: name, business email address, telephone number, job title and the company you represent.
- Enquiry data: when you use our website contact form, your name, email address, website and the package you are interested in.
- Booking data: when you book a discovery call, the name, email address, time zone and any answers you give in the booking form. The calendar on our contact page is provided by Calendly, who process this on our behalf.
- Account data: your sign-in email, your password (stored only as a hash), two-factor sign-in settings, profile information and account preferences.
- Service data: design requests, briefs, brand details, files, messages, comments, revisions and other content you submit or that we produce while delivering the Service.
- Billing data: billing contact name, company, billing address, VAT number and payment records. Card details are collected and held by our payment processor (Stripe Payments UK Ltd) and are not stored on our systems.
- Technical data: IP address, browser type and version, device details, time zone setting and operating system. Where the platform records an IP address, for example for sign-in security, it stores only a salted hash of it.
- Security and activity data: sign-in attempts, active sessions and a log of actions taken in the platform, used to keep accounts secure.
- Usage data: pages visited on our website and how you arrived. This is only collected with cookies if you have given us consent (see Section 8).
- Communications data: your messages to us by email, through our contact form or through messages in the platform.
We do not knowingly collect special category data (such as health or biometric data) and we ask you not to send it to us through the Service.
3. How we collect personal data
- Directly from you when you book a call, send an enquiry, create an account, communicate with us or use the Service.
- Automatically when you interact with our website, through cookies and similar technologies (see our Cookie Policy).
- From third parties, such as our payment processor, analytics providers, and (where applicable) public business registries.
4. Purposes and lawful bases for processing
Under the UK GDPR we must have a lawful basis for processing your personal data. We rely on the following:
| Purpose | Lawful basis |
|---|---|
| Providing the Service and managing your account | Performance of a contract |
| Processing payments and managing subscriptions | Performance of a contract; legal obligation |
| Responding to enquiries and call bookings | Legitimate interests (responding to prospects who contact us); steps to enter into a contract |
| Service emails and important account notifications | Performance of a contract |
| Marketing emails to existing business customers | Legitimate interests (PECR "soft opt-in"), with an unsubscribe option in every message |
| Marketing emails to other recipients | Consent |
| Analytics and performance measurement | Consent |
| Security, fraud prevention and service integrity | Legitimate interests; legal obligation |
| Compliance with accounting, tax and legal obligations | Legal obligation |
5. Who we share personal data with
We share personal data only with the following, and we put a written contract in place with every provider that processes personal data on our behalf.
| Provider | What they do for us | Data involved | Where |
|---|---|---|---|
| Vercel Inc. | Hosts this website and the client platform, and keeps server logs. | Technical data and any data sent through the website or platform. | The platform runs in London. Vercel is based in the US, so logs and its dashboard may be processed there. |
| Supabase, Inc. | Database and private file storage for the platform. | Accounts, requests, messages, brand details and uploaded files. | The region chosen for our project. Supabase is based in the US. |
| Upstash, Inc. | Rate limiting, to protect sign-in and forms from abuse. | Hashed IP addresses and account ids, held as short-lived counters. | The region chosen for our database. Upstash is based in the US. |
| Resend, Inc. | Sends account and notification emails. | Name, email address and the content of the email. | US, unless an EU sending region is used. |
| Stripe Payments UK Ltd | Payments, subscriptions and invoices. | Billing contact, company and payment details. Payment details are held by Stripe. | UK, with transfers to Stripe in the US. |
| Functional Software, Inc. (Sentry) | Error reports, to find and fix faults in the Service. | Technical data about errors. We remove tokens, cookies, IP addresses and email addresses before reports are sent. | The data region chosen for our account. Sentry is based in the US. |
| Google Ireland Ltd | Website analytics (Google Analytics 4). Used on our public website only, never in the signed-in platform or on sign-in and password reset pages. | Usage and technical data. See Section 8 for how consent affects this. | Ireland, with transfers to Google in the US. |
| Usercentrics A/S (Cookiebot) | Shows our cookie banner and keeps a record of your choice. | Your consent choice, an anonymised IP address and browser details. | EU |
| Calendly LLC | Booking discovery calls through our contact page. | Name, email address, time zone and your answers in the booking form. | US |
| Web3Forms | Receives our website contact form and forwards it to our inbox. | Name, email address, website and the package you are interested in. | Outside the UK |
| Adobe Inc. (Adobe Fonts) | Serves our brand typeface. | Your IP address and browser details when a page loads. | US |
| Microsoft Ireland Operations Ltd | Business email and collaboration. | Emails and enquiries you send us. | The data location of our Microsoft 365 account. |
When you open a deliverable link in the platform that points to Figma, Google Drive or Canva, the platform may show a preview loaded from that provider. The provider then receives your IP address and browser details, and its own terms and privacy policy apply.
We also share personal data with:
- Professional advisers such as accountants and lawyers, where necessary.
- Authorities and regulators, where required by law or to protect our rights.
- Successors in the event of a sale, merger or reorganisation of our business.
We do not sell personal data.
6. International transfers
Some of our service providers are located outside the United Kingdom, mainly in the US. When personal data goes from the UK to the US, we rely on the UK-US data bridge where the provider is certified under it. Otherwise we rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum. Where EU data is involved, we rely on the EU Standard Contractual Clauses. These are supported by suitable technical and organisational measures.
7. Retention
We keep personal data only for as long as we need it, including to meet legal, accounting and reporting requirements. A nightly automated job deletes or reduces data when these periods end:
- Platform accounts and client content (requests, messages, files and brand details): for as long as the subscription runs. When a client leaves, we keep this for up to 6 years after the contract ends for legal and accounting reasons, then delete or anonymise it. You can ask us to delete content we do not need to keep sooner.
- Invoices and billing records: 6 years from the end of the financial year they relate to, as required by UK tax law, then deleted.
- Sign-in sessions and one-time links: deleted 30 days after they expire or are used.
- Failed sign-in records (email address and hashed IP address): 90 days.
- In-app notifications: 12 months.
- Security audit log (actions taken in the platform, with hashed IP addresses): 2 years.
- Copies of payment events from Stripe: reduced to a reference after 30 days.
- Website enquiries and call bookings that do not lead to a contract: up to 24 months. Enquiries are held in our email inbox and in Web3Forms.
- Marketing contact data: until you unsubscribe, or for up to 24 months of inactivity.
- Website analytics: 14 months in Google Analytics.
- Cookie consent records: up to 12 months.
8. Cookies and similar technologies
We use strictly necessary cookies to run the website and to keep you signed in to the platform. With your consent, we also use Google Analytics cookies on our public website. We use Google Consent Mode v2. If you do not consent, no analytics cookies are set and Google receives only cookieless, anonymous signals that a page was visited. Google Signals is turned off. Analytics never runs inside the signed-in platform. We do not run advertising or tracking cookies. You can change or withdraw your choice at any time using the "Manage cookies" link in the footer. See our Cookie Policy for the full list.
9. Your rights
Subject to certain conditions, you have the right to:
- access the personal data we hold about you;
- request rectification of inaccurate or incomplete data;
- request erasure of your data (the "right to be forgotten");
- restrict processing or object to processing;
- request portability of data you have provided to us;
- withdraw consent at any time where we rely on consent; and
- object to direct marketing at any time.
To exercise any of these rights, please email Support@creativeflowstudio.co.uk. We may need to confirm your identity first. We will respond within one month.
- Access and portability: we can export your personal data as a download of your account data, messages and files.
- Erasure:we can erase your account. We remove your personal details and your sign-in access. We keep invoices and records we must keep by law. Content that belongs to your company's account stays with the company.
10. Security
We use appropriate technical and organisational measures to protect personal data. These include:
- encryption of data in transit (HTTPS, with HSTS);
- passwords stored only as hashes (Argon2id);
- two-factor sign-in, available on every account;
- IP addresses stored only as salted hashes;
- files kept in private storage and served through short-lived links;
- access limited by role; and
- regular review of our suppliers.
No method of transmission or storage is 100% secure. If we become aware of a personal data breach that puts your rights and freedoms at risk, we will tell you and the Information Commissioner's Office where the law requires it.
11. Children
The Service is for businesses. It is not intended for anyone under 18. We do not knowingly collect personal data from children.
12. Changes to this Policy
We may update this Policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be highlighted on this page or notified to you directly.
13. Complaints
If you have a concern about the way we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113