Privacy Policy

FlowMatch (“we”, “us”, “our”) is committed to protecting the personal information of everyone who uses our platform. This Privacy Policy explains what information we collect, why we collect it, and how we handle it. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and we are mindful of the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) for users in those jurisdictions.

1. Information We Collect

A. Agency Application Data

When an AI agency applies to be listed on FlowMatch, we collect the following:

• Agency name and owner name
• Business email address
• Website URL and booking link (Calendly)
• Business location (city/region)
• Agency bio and service description
• Industry niches and service offerings
• Starting price

Purpose: To review and create an approved agency listing on the platform.

B. Review Submissions

When a business owner submits a review, we collect:

• Reviewer name
• Company name and role (optional)
• Star rating and written review text

Purpose: To display verified client reviews on agency profiles.

C. Technical Data

Our hosting provider (Vercel) and database provider (Supabase) may automatically collect standard server logs including IP address, browser type, OS, and pages visited.

Purpose: Platform security, debugging, and performance monitoring.

D. What We Do Not Collect

FlowMatch does not collect payment information, government IDs, health data, or any sensitive personal categories. We do not require accounts to browse the platform.

2. How We Use Your Information

• To review agency applications and create approved directory listings
• To display agency profiles and reviews publicly on the platform
• To contact applicants regarding their application status
• To operate, maintain, and improve the platform
• To detect and prevent fraud, abuse, or violations of our Terms of Service

We do not sell your personal information to third parties, use it for advertising targeting, or send marketing emails without your explicit consent.

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area, our legal bases are:

• Contract performance: Processing agency application data to fulfil our commitment to review and list qualified agencies.
• Legitimate interests: Maintaining platform security, preventing fraud, and improving the service.
• Consent: Where you voluntarily submit review data to be displayed publicly.

4. Data Sharing and Third Parties

We share data only with the following service providers, solely to operate the platform:

We do not share personal information with any other third parties, advertisers, or data aggregators.

5. Cookies and Local Storage

FlowMatch uses minimal browser storage:

• Language preference: Stored in localStorage as flowmatch_lang. Not a cookie and does not leave your device.
• Admin session cookie: Set only when an administrator logs in to the admin panel. Never set for regular visitors.

We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party cookie-based tracking.

6. Data Retention

• Approved agency listings: Retained as long as the agency is active. Removed upon written request.
• Rejected applications: Retained for 90 days for anti-fraud purposes, then deleted.
• Reviews: Retained as long as the associated agency listing exists.
• Server logs: Per Vercel and Supabase standard policies (typically 30–90 days).

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion of your personal data.
• Portability: Request your data in a machine-readable format.
• Objection/Restriction: Object to or restrict certain types of processing.
• California residents (CCPA): Right to know, delete, and opt out of sale (we do not sell data).

To exercise any of these rights, contact us at emil555.arias@gmail.com. We will respond within 30 days.

8. Data Security

We implement reasonable technical and organizational measures including encrypted database connections (TLS), row-level security, and restricted admin access. No method of internet transmission is 100% secure; we cannot guarantee absolute security.

9. Children's Privacy

FlowMatch is not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will update the effective date at the top of this page. Continued use of the platform after any changes constitutes acceptance of the updated policy.

11. Contact