Privacy Policy

Flow State (“we”, “us”) designs custom AI and automation systems for businesses. This policy covers flowstate.lk and the enquiries you send us through it.

It does not cover the systems we build and operate for a client — in those, the client is the data controller and their own privacy policy applies. We act as a processor under our agreement with them.

We only collect what you choose to send us:

• Enquiry details — your name, business name, email address or WhatsApp number, and whatever you write in the message or select as your focus area.
• Correspondence — the emails and messages we exchange with you afterwards.

We do not run advertising trackers, we do not sell data, and we do not build profiles on visitors. The site sets no marketing or analytics cookies.

Your details are used to:

• reply to your enquiry and arrange a walkthrough;
• prepare the automation map we discuss on that call;
• keep a record of what was agreed if we go on to work together.

The lawful basis is your consent when you contact us, and our legitimate interest in responding to business enquiries. We will not add you to a mailing list from a walkthrough request.

Enquiries that do not become projects are deleted within 24 months. Records connected to a signed engagement are kept for as long as the engagement runs and for a further seven years where tax or contract law requires it.

Only the people at Flow State working on your enquiry, plus the service providers that run our email and hosting. Those providers process data on our instructions under contract.

We may disclose information if the law requires it. We never sell or rent personal data to anyone.

Our email and hosting providers may store data on servers outside Sri Lanka. Where that happens we rely on providers that offer appropriate contractual safeguards for international transfers.

You can ask us to give you a copy of the personal data we hold about you, correct it, delete it, or stop using it. Write to support@flowstate.lk and we will respond within 30 days.

If you are unhappy with how we have handled your data, tell us first — we would rather fix it directly — and you retain the right to complain to the relevant data protection authority.

Access to enquiry data is limited to the team members who need it, protected by multi-factor authentication, and transmitted over encrypted connections. No system is perfectly secure, but we will tell you promptly if a breach affects your data.

If this policy changes materially we will update the date at the top of this page. Continuing to use the site after a change means you accept the updated policy.