We keep this short and plain. This policy explains what FlowStay collects, why we collect it, and the choices you have. If anything here is unclear, write to us and we will answer directly.
Last updated: July 1, 2026
FlowStay is a product of Flow Industries Inc. ("FlowStay," "we," "us"). We build AI systems for hospitality businesses. This policy covers this marketing website and the forms and demos reachable from it. When you contact us or request a demo, you are sharing information with Flow Industries Inc.
When you fill in a form, book a demo, or email us, we collect the contact details you provide: typically your name, work email, company, and whatever message you send. You choose what to share.
When you visit the site, we collect standard usage data: pages viewed, referring links, approximate location, and basic device and browser characteristics. This helps us understand what is useful and where the site can be better.
We use the information to respond to your enquiries, arrange and run demos, operate and improve the site, and keep the service secure. We do not sell your personal information. We do not use it for advertising networks.
We use privacy-friendly, cookieless analytics. Our product analytics (PostHog) runs in memory-only mode, so it does not set tracking cookies on your browser, and we use Microsoft Clarity for aggregate usability insight. We rely on these tools to see how the site performs in aggregate, not to build advertising profiles.
To protect the platform and the people who use it, FlowStay processes device and network signals, including a device fingerprint, IP address, and coarse, city-level geolocation, for security, fraud prevention, and abuse detection. We process these signals on a legitimate-interest basis: they help us detect and prevent fraudulent bookings, credential abuse, and other platform abuse, and they let us investigate incidents when they occur.
The device signal may also include network and TLS characteristics of the connection, such as a TLS or JA3 fingerprint, which help us tell automated and evasive traffic apart from ordinary visitors. To assess the connection itself, we may share the IP address with a third-party security and fraud-prevention provider that acts as a sub-processor. That provider helps us classify the connection type, for example whether it is a VPN, proxy, or hosting network, and identify the network operator (ISP and ASN). We use those results only to weigh the risk of a request.
For security and abuse investigation, session recordings may be reviewed in connection with the device signal on a legitimate-interest basis. This is separate from the aggregate, non-identifying analytics described above: it applies only when we are looking into a specific security or abuse concern, not to ordinary reporting.
These signals are used for security and integrity purposes, not for advertising. We retain them only as long as necessary for those purposes and then remove or de-identify them. Where the law provides you rights over this processing, the choices described below apply.
This security and abuse-prevention processing rests on legitimate interest, and it is necessary to protect the service. For that reason it is not switched off by an analytics opt-out or a Do Not Track signal. Those choices continue to govern the aggregate analytics described above, but they do not disable the processing we rely on to keep the platform safe.
Depending on where you live, you may have the right to access, correct, or delete your personal information, to object to certain processing, or to ask us to restrict it. You can also ask us what we hold about you. To exercise any of these, contact us using the details below and we will respond within a reasonable time. You can opt out of analytics by using your browser's privacy controls or a Do Not Track signal, which we honor where technically feasible.
Questions about this policy or your data can go to eric@flowstate.ai. We read every message and reply directly.