Privacy Policy
Updated Date: Feb 5, 2026, 12:00 AM
1. Introduction and scope
This Privacy Policy explains how Phlow (“Phlow”, “we”, “us”, or “our”) collects, uses, stores, and protects personal data in connection with the operation of our website, communications, and services.
This Policy applies to personal data processed when you:
visit our website;
submit information through contact forms;
communicate with us via email;
request information, quotes, or services;
engage with Phlow as a client, prospective client, collaborator, or business contact.
This Policy applies to individuals worldwide. Where you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, your personal data is processed in accordance with applicable data protection laws, including Regulation (EU) 2016/679 (“GDPR”) and related national legislation.
This Policy does not apply to third-party websites, platforms, or services that may be linked from our website. Where you interact with such third parties, their own privacy policies govern the processing of your personal data.
Phlow provides visual production services for businesses and professionals. Accordingly, most data processing activities relate to business communications and service delivery rather than consumer-facing digital products.
2. Data controller
For the purposes of applicable data protection laws, Phlow acts as the data controller with respect to personal data collected and processed in connection with its services and operations.
The data controller is:
Phlow
Email: hello@phlow.studio
Phlow determines the purposes and means of processing personal data in connection with inquiries, service delivery, billing, and operational activities.
At this stage, Phlow does not appoint a Data Protection Officer (DPO), as the nature and scale of data processing do not require such appointment under applicable regulations. Should this change, the Policy will be updated accordingly.
For any privacy-related questions, data subject requests, or concerns regarding the processing of personal data, you may contact: hello@phlow.studio
3. Definitions
For the purposes of this Privacy Policy:
“Personal Data” means any information relating to an identified or identifiable natural person, including but not limited to name, email address, company information, and communication content.
“Processing” means any operation performed on Personal Data, including collection, storage, organization, use, transmission, or deletion.
“Data Subject” means any individual whose Personal Data is processed by Phlow.
“Controller” means the entity determining the purposes and means of processing Personal Data (Phlow).
“Processor” means a third party that processes Personal Data on behalf of Phlow, such as hosting providers, payment processors, cloud storage services, or communication platforms.
“Service Data” means Personal Data provided in connection with requesting or receiving services.
“Communication Data” means information exchanged through emails, forms, or other contact channels.
“Technical Data” means information automatically collected through website interaction, such as IP address, browser type, and basic usage data where applicable.
4. Categories of personal data we collect
Phlow collects only the categories of Personal Data necessary to operate, communicate, and deliver services effectively. Depending on how you interact with us, we may collect:
4.1 Contact information
name and surname;
email address;
company or brand name;
professional role (where provided).
4.2 Communication data
messages submitted via contact forms;
email communications;
attachments or files shared for project purposes;
project-related instructions or feedback.
4.3 Business and project data
product descriptions and specifications;
brand guidelines;
reference materials;
project requirements and visual direction.
While most of this information relates to business activities, it may still qualify as Personal Data where it can be linked to identifiable individuals.
4.4 Technical data
When you visit our website, certain technical information may be collected automatically, such as:
IP address;
device and browser type;
general geographic region;
interaction with website pages.
At present, Phlow does not actively deploy advanced analytics tools; however, basic technical data may still be processed by hosting infrastructure providers as part of standard web operation.
4.5 Payment and transaction data
When engaging our services, payment-related information may be processed via external payment providers. Phlow does not store full payment card details. We may receive limited transaction information such as:
payment confirmation;
billing name;
transaction identifier;
billing-related contact details.
Payment processing is handled by third-party providers (e.g., PayPal, Stripe, or similar), which operate as independent data controllers under their own privacy policies.
5. How we collect data
Phlow collects Personal Data through direct interactions and limited automated processes.
5.1 Data provided directly by you
We collect Personal Data when you:
submit a contact form on our website;
send us an email;
request a quote or consultation;
provide project materials;
enter into a service agreement.
5.2 Website interaction
Basic technical data may be collected automatically through standard hosting infrastructure when you access our website. This may include log data, browser information, and connection metadata necessary to ensure functionality, security, and performance.
Our website is built on a third-party platform, and certain technical processing may occur as part of that platform’s standard operation.
5.3 Payment providers
When you make payments, transaction data is processed by external payment providers. Phlow receives only the information necessary to confirm payment and manage billing.
5.4 Future tools and technologies
Phlow may implement additional tools over time, such as analytics platforms, communication tools, or marketing systems. Where such tools involve Personal Data processing, this Privacy Policy will be updated to reflect the relevant categories, purposes, and legal bases.
We do not knowingly collect Personal Data beyond what is necessary for legitimate business and operational purposes.
6. Purposes of processing
Phlow processes Personal Data solely for legitimate, specific, and clearly defined purposes connected to its operations as a visual production studio.
Personal Data may be processed for the following purposes:
6.1 Responding to inquiries and communications
To respond to contact requests, emails, consultation requests, project inquiries, and other forms of communication initiated by individuals or businesses.
6.2 Service provision and project execution
To evaluate, plan, execute, and deliver visual production services, including:
project management;
communication regarding scope and revisions;
delivery of assets;
operational coordination.
6.3 Pre-contractual and contractual activities
To assess requests for services, prepare proposals, define scope, and manage engagements prior to entering into a formal agreement.
6.4 Billing, payments, and financial administration
To manage invoicing, confirm payments, maintain transaction records, and comply with accounting obligations.
6.5 Operational and security purposes
To ensure system integrity, website functionality, communication reliability, and prevention of unauthorized use or abuse.
6.6 Legal and compliance obligations
To comply with applicable legal requirements, including tax, accounting, and regulatory obligations.
6.7 Legitimate business development
To maintain professional communication with business contacts, prospective clients, and collaborators, where such communication is relevant and proportionate to a legitimate business relationship.
Phlow does not use Personal Data for automated decision-making, profiling, or behavioral targeting.
7. Legal bases for processing
Where Phlow processes Personal Data subject to GDPR, processing occurs on one or more of the following legal bases:
7.1 Contractual necessity
Processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract, including responding to service requests and delivering commissioned work.
7.2 Legitimate interests
Processing is necessary for the legitimate interests of Phlow, including:
managing communications;
operating the website;
improving service delivery;
preventing misuse or abuse.
These interests are balanced against the rights and freedoms of data subjects.
7.3 Legal obligations
Processing is required to comply with legal requirements, including tax, accounting, and regulatory obligations.
7.4 Consent (where applicable)
Where specific activities require consent under applicable law (for example, future newsletter communications or certain tracking technologies), such consent will be requested explicitly and may be withdrawn at any time.
Phlow does not rely on consent where processing can be lawfully based on contractual necessity or legitimate interest.
8. Cookies and tracking technologies
Phlow’s website may use essential technical mechanisms necessary for functionality and security. At present, Phlow does not actively deploy advanced tracking or advertising cookies; however, basic technical data may still be processed through hosting infrastructure.
Future implementation of analytics tools or similar technologies may involve:
collection of aggregated usage data;
performance monitoring;
anonymized behavioral insights.
If such tools are introduced, they will be implemented in accordance with applicable data protection laws and, where required, subject to consent mechanisms.
Users may manage browser settings to limit or disable cookies and similar technologies. Disabling certain technical mechanisms may affect website functionality.
Phlow does not use invasive tracking, cross-site behavioral profiling, or advertising networks for the purpose of targeting individuals.
9. Data sharing and recipients
Phlow does not sell Personal Data. Data may be shared only where necessary to operate the business and deliver services.
Personal Data may be shared with:
9.1 Service providers and processors
Third-party providers that support operational activities, including:
hosting platforms;
cloud storage providers;
communication tools;
payment processors;
file transfer services.
Such providers process data under their own privacy and security frameworks and, where applicable, under data processing agreements.
9.2 Professional advisors
Legal, accounting, or administrative professionals where necessary for compliance and operational purposes.
9.3 Legal Authorities
Where required by law, regulation, legal process, or to protect rights, safety, or property.
Phlow limits data sharing to what is necessary and proportionate for each purpose.
10. International data transfers
Given the global nature of digital services, Personal Data may be processed in jurisdictions outside the EEA.
This may occur where:
service providers operate internationally;
payment processors operate across multiple jurisdictions;
cloud infrastructure spans global data centers.
Where Personal Data is transferred outside the EEA, Phlow seeks to ensure that appropriate safeguards are in place, which may include:
reliance on adequacy decisions;
standard contractual clauses (SCCs);
recognized international transfer mechanisms.
The Client and users acknowledge that international data transfers are a normal aspect of operating modern digital services.
Phlow takes reasonable steps to ensure that such transfers maintain an adequate level of data protection consistent with applicable regulations.
11. Data retention
Phlow retains Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including service delivery, operational continuity, legal compliance, and legitimate business interests.
Retention periods vary depending on the nature of the data and the context in which it was collected.
11.1 Communication and inquiry data
Personal Data obtained through contact forms, emails, or preliminary inquiries may be retained for as long as reasonably necessary to:
respond to requests;
maintain continuity of communication;
support potential future engagements.
Where no professional relationship develops, such data may be periodically reviewed and deleted within a reasonable timeframe.
11.2 Client and project data
Personal Data connected to Projects or Subscriptions may be retained for the duration necessary to:
deliver services;
maintain records of work performed;
manage follow-up requests;
address potential disputes.
Project-related data may be archived after completion and retained for operational continuity and documentation purposes.
11.3 Billing and financial data
Payment and invoicing information may be retained for the period required by applicable accounting, tax, and financial regulations.
11.4 Technical and security data
Technical data generated through website operation or communication systems may be retained for system maintenance, security monitoring, and operational diagnostics for a reasonable period.
11.5 Deletion and minimization
Phlow periodically reviews stored data and aims to remove or anonymize information that is no longer necessary for legitimate operational or legal purposes.
Phlow does not guarantee indefinite retention of project materials or communication data unless required by law or contractual obligations.
12. Security measures
Phlow adopts appropriate technical and organizational measures designed to protect Personal Data against unauthorized access, loss, misuse, alteration, or disclosure.
Such measures may include:
restricted access to systems and files;
password-protected environments;
use of reputable cloud infrastructure;
secure communication channels where appropriate;
basic operational safeguards against data exposure.
Security measures are continuously evaluated in light of the scale of operations and technological evolution.
However, the Client acknowledges that no digital transmission or storage system can be guaranteed to be completely secure. While Phlow implements reasonable safeguards, absolute security cannot be assured.
In the event of a data incident that materially affects Personal Data, Phlow will take appropriate steps consistent with applicable legal obligations.
13. Data subject rights
Where applicable under GDPR and similar regulations, individuals have rights concerning their Personal Data processed by Phlow.
These rights may include:
the right to access Personal Data held by Phlow;
the right to request rectification of inaccurate or incomplete data;
the right to request erasure where data is no longer necessary or where processing is unlawful;
the right to request restriction of processing in certain circumstances;
the right to data portability where technically feasible and applicable;
the right to object to processing based on legitimate interests;
the right to lodge a complaint with a competent supervisory authority.
These rights are subject to legal limitations and may not apply where data processing is required for contractual, legal, or legitimate operational purposes.
Phlow does not engage in automated decision-making or profiling that produces legal or similarly significant effects.
14. How to exercise your rights
Requests relating to Personal Data may be submitted to:
Phlow may request reasonable verification of identity before responding to data-related requests, in order to protect individuals against unauthorized access or disclosure.
Requests will be handled within a reasonable timeframe consistent with applicable legal requirements.
Where a request cannot be fulfilled due to legal obligations, contractual constraints, or operational necessity, Phlow will provide an explanation where appropriate.
Phlow reserves the right to refuse requests that are manifestly unfounded, excessive, repetitive, or incompatible with legal obligations.
15. Communications and marketing
Phlow primarily communicates with individuals and businesses in the context of professional interactions, service inquiries, and project-related communication.
At present, Phlow does not operate a structured newsletter or automated marketing system. However, the following principles apply:
15.1 Business communications
Phlow may communicate with business contacts where such communication is relevant to an existing relationship, inquiry, or professional context.
15.2 Future marketing activities
Should Phlow introduce newsletters, updates, or marketing communications, such activities will:
comply with applicable legal requirements;
rely on appropriate legal bases;
include opt-out or unsubscribe mechanisms where required.
15.3 Opt-out
Recipients may request to stop receiving non-essential communications at any time by contacting:
Phlow does not engage in mass unsolicited communications or aggressive marketing practices and aims to maintain proportionate and professional outreach consistent with business norms.
16. Payment and billing data
When engaging Phlow’s services, certain Personal Data may be processed in connection with payments, invoicing, and financial administration.
Phlow does not directly collect or store full payment card details. Payment transactions are processed by external payment providers, such as PayPal, Stripe, or similar financial platforms, which operate as independent data controllers and process Personal Data under their own privacy policies and security frameworks.
Phlow may receive and retain limited payment-related information necessary for operational and accounting purposes, which may include:
billing name and contact details;
transaction confirmations;
invoice data;
payment status;
financial documentation required for tax compliance.
Such data is processed for purposes including:
confirming payments;
issuing invoices and accounting records;
managing financial compliance;
resolving billing inquiries or disputes.
Financial records may be retained for the period required under applicable accounting and tax regulations.
Phlow does not access, store, or control sensitive payment credentials beyond what is necessary to verify transactions.
17. Children’s privacy
Phlow’s services and website are intended for use by businesses, professionals, and individuals acting in a professional capacity.
Phlow does not knowingly collect Personal Data from children or individuals under the age required by applicable data protection laws to provide valid consent.
If Phlow becomes aware that Personal Data has been provided by a minor without appropriate legal basis, reasonable steps will be taken to delete such data.
Parents or guardians who believe that Personal Data of a minor has been submitted may contact:
18. Third-party links and platforms
Phlow’s website, communications, or materials may contain links to third-party websites, tools, platforms, or resources.
These third parties operate independently and have their own privacy policies governing the collection and processing of Personal Data.
Phlow is not responsible for:
the privacy practices of third-party platforms;
the content of external websites;
how external providers handle Personal Data.
Users are encouraged to review the privacy policies of any third-party services they interact with.
Interactions with external platforms, including social media, payment providers, hosting tools, and communication platforms, are governed by the terms and privacy practices of those respective providers.
19. Changes to this Privacy Policy
Phlow may update this Privacy Policy from time to time to reflect:
changes in operational practices;
implementation of new tools or technologies;
regulatory developments;
business evolution.
Updates will be published on the website with an updated revision date.
Changes will apply prospectively and will not retroactively alter how previously collected Personal Data was handled unless required by law.
Where changes materially affect how Personal Data is processed, Phlow will take reasonable steps to ensure transparency and clarity regarding those updates.
Continued interaction with Phlow’s services following the publication of an updated Privacy Policy constitutes acknowledgment of the revised terms.
20. Contact
For any questions, concerns, or requests regarding this Privacy Policy or the processing of Personal Data, you may contact:
Phlow
Email: hello@phlow.studio
Phlow will respond to privacy-related inquiries within a reasonable timeframe and in accordance with applicable legal obligations.
Individuals also have the right to contact their local data protection authority where they believe that their rights have been violated or that Personal Data has been processed unlawfully.