Privacy Policy

1. Who we are

This policy covers theflowx.com and the way the flowX handles personal data. We are a digital marketing practice operating from Sainikpuri, Hyderabad, Telangana, India, working with clients across India and remotely worldwide.

For anything in this policy, write to info@theflowx.com.

2. What we collect

When you send a written brief

The brief form on our contact page collects your name, email address, subject line and message. It is delivered to us as email and stored in our business mailbox. Nothing else on that form is recorded.

When you book a call

Bookings on our Book a Call page run through Cal.com, embedded in the page. You give your name, email address and any details their form asks for directly to Cal.com, and Cal.com passes the booking to us. Cal.com handles that data under its own privacy notice at cal.com/privacy.

When you email or call us

We keep the contents of the message together with the contact details you used, so that we can reply and keep track of the conversation.

Server logs

Our hosting provider records standard request information — IP address, browser user agent, the page requested and a timestamp — for security and reliability. We do not use these logs to build profiles of visitors.

What we do not collect

We do not run Google Analytics, Meta Pixel, LinkedIn Insight Tag, session recording, heatmaps, or any comparable tracker on this website. We do not buy or enrich visitor data from third-party brokers.

3. Cookies and third-party services

the flowX does not set its own advertising or analytics cookies on this website.

Our pages do load files from the third parties below. Because your browser fetches those files directly, each provider receives your IP address and browser details as part of that request.

If you would rather not load these, most browsers and content blockers can block third-party requests. The site still reads and works without them, though the booking calendar will not appear — in that case email us and we will arrange a time by hand.

4. Why we process your data

We process personal data to reply to enquiries, to scope and deliver client work, to send the reporting an engagement requires, to keep our records straight, and to keep the site secure.

If you are in the EU or the UK, our lawful bases under the GDPR are:

• Contract — performing an engagement, or taking steps at your request before one begins.
• Legitimate interests — replying to correspondence, keeping the website secure, and describing our work to prospective clients.
• Legal obligation — tax and accounting records.
• Consent — anything you explicitly opt into. You can withdraw consent at any time.

If you are in India, we process personal data under the Digital Personal Data Protection Act, 2023, for the lawful purpose for which you provided it, or for certain legitimate uses the Act permits.

5. How long we keep it

• Enquiries that do not become work: up to 24 months, then deleted.
• Client records: for the length of the engagement, and afterwards for as long as tax and accounting law requires us to keep the books.
• Server logs: the short retention window set by our hosting provider.

You can ask us to delete your data sooner — see your rights below.

6. Who we share it with

We share personal data only where it is needed to do the work or to meet the law:

• Our email and web hosting providers.
• Cal.com, for scheduling.
• Our accountants and professional advisers, where relevant.
• Authorities, where the law compels disclosure.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

Where we run advertising or analytics on a client's own accounts, that data sits in the client's platforms under the client's control and the client's own privacy policy — not ours.

7. International transfers

Some of the providers above (Google, Cloudflare, Cal.com) process data on servers outside India. Where the GDPR applies to a transfer out of the EU or UK, it relies on an appropriate safeguard such as the European Commission's Standard Contractual Clauses or an adequacy decision.

8. Your rights

Under the DPDP Act, if you are in India you have the right to obtain a summary of the personal data we hold about you and how we process it, to have it corrected, completed or updated, to have it erased, to nominate someone to exercise your rights if you die or become incapacitated, and to have a grievance addressed.

Under the GDPR, if you are in the EU or UK you have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing carried out on legitimate interests, and withdrawal of consent.

If you are in the EU or UK and you are not satisfied with our response, you can complain to your national data protection supervisory authority.

9. Security

We keep personal data in access-controlled business accounts, limit who can see it to the people doing the work, and use encrypted connections for this website. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security — but if a breach affects your data we will act on it and notify you and the relevant authority where the law requires.

10. Children

This website is meant for businesses and the people who run them. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, write to us and we will delete it.

11. Changes to this policy

We update this page when our practices change. The date at the top always shows the current version. If a change is significant, we will say so clearly on this page.

12. Contact and grievances

For privacy questions, data requests, or a grievance under the DPDP Act:

See also our Terms of Service.