Data Processing Summary

This is a plain-language summary of how FlowState processes data on behalf of a client organization or school district. It is written so a client and its counsel can understand the arrangement quickly. It is a summary, not a signed agreement.

What data we process

On your behalf we process the data your use of the platform creates: assessment answers, form and feedback submissions, the names and emails of your members, the content typed into our assistant, and any files uploaded through the tools you use. We do not process payment card data.

The roles

You, the customer, are the controller of your data: you decide what is collected and why. FlowState is the processor: we handle that data only to provide the service you asked for and only on your instructions. We do not use your data for our own purposes, we do not sell it, and we do not use it to train AI models.

Security measures

Access control is enforced at the database with row-level security, so records deny by default and are isolated per organization. Privileged actions require a signed server session. Data is encrypted in transit. Secrets never ship in the browser. These controls are described in more detail on our Security and Trust page.

Subprocessors

We use a small, named set of providers to deliver the service, and each handles only what it needs. The current list, with the data each one handles and why, is on our Subprocessors page. We do not permit any of them to use your content to train AI models.

Deletion on request

You can ask us to delete the data we process for you, and we will, subject to any retention obligation that licensing or records law imposes on a given application. Requests can be made through our data request page.

Breach notification

If we become aware of a security breach affecting your data, we intend to notify you promptly, describe what we know, and cooperate with your response. The specific timelines and obligations are set in a signed agreement.

This is a summary of our current data-processing practices, not counsel-reviewed contract language. A formal data-processing agreement is provided and reviewed by qualified counsel before any client contract depends on it.