Privacy Policy

Who we are

Flowlabz is operated by Brandon Watkins, based in Cape Town, Western Cape, South Africa. For anything on this page, contact brandon@flowlabz.com. Brandon Watkins, trading as Flowlabz, is the responsible party (POPIA) and the data controller (GDPR) for the information described here. In this policy, “we”, “us” and “our” mean Flowlabz.

What we collect

When you contact us

The contact form asks for your name and email address, with your company and phone number optional. To start a project it also asks what you need, your budget range, when you'd like to start and a description of the project, and, optionally, your current website and how you found us. A quick message skips the project questions and asks only for your message. We use these only to reply to you and to scope the work you're asking about.

The form sends your message to our inbox by email, through Resend, an email delivery service, and sends you a short confirmation the same way so you know it arrived. The confirmation doesn't repeat your message. Nothing is stored on this site's servers: the email is the only record. Until you send it, what you've entered is kept in your own browser (session storage, for that tab only), so closing the form or reloading the page loses nothing; it's cleared once it's sent, and when you close the tab.

To keep out spam, the contact form uses Google reCAPTCHA. Its script loads only when you open the form, and it sends Google information about your browser, your device and how you use the page, so Google can tell a person from a bot. Google's Privacy Policy and Terms of Service apply to that.

When you download a resource

The free downloads on the AI Resources page ask for your name, email address, company and country before the file is handed over. Those details come to our inbox the same way an enquiry does, and nowhere else. We also email you the link to the file, so you can find it again. We use your details to know who is using the work and to reply if you write back. We won't add you to a mailing list without asking you first, and if we ever do send an update, it will include a way to unsubscribe.

When you ask for a website audit

The free website audit offer asks for your name, your business name, your website's address and your email address. Those details come to our inbox the same way an enquiry does, and nowhere else, and we send you a short confirmation. We use them to review your website and to email you what we find. On a computer, the offer opens as you move to leave the site; whether you've already seen it is remembered in your own browser (local storage), so it doesn't keep appearing, and that never leaves your device.

When you browse the site

The site uses Google Analytics to see which pages people visit, where they arrive from and what they do on the way: page path, referrer, country, browser and device type, and events such as a form sent or a resource downloaded. It sets the cookies described below so that one visit can be told from another. The reports are aggregate and do not identify you by name, and Google states that Google Analytics does not store IP addresses. Google processes this data under its own privacy policy. You can opt out with Google's browser add-on or by blocking cookies for this site.

Vercel Web Analytics runs alongside it. It is cookieless, does not build a profile of you or follow you across other websites, and records the same kind of aggregate information: page path, referrer, country, browser and device type. It also counts which of the site's links and buttons are used, such as the navigation, the calls to action and the contact form's steps and its sending, with whether it was a project or a quick message and the budget range chosen, but never anything you type. Vercel Speed Insights, also cookieless, measures how quickly pages load and respond for visitors, so we can keep the site fast.

Our web host, Vercel, processes standard server logs including your IP address for security and reliability. Fonts are loaded from Google Fonts, which means your browser contacts Google's servers to fetch them.

Cookies

This site sets no advertising cookies. The cookies it does set:

• Google Analytics (_ga and _ga_*): a random identifier that lets Google Analytics recognise a returning browser and count visits rather than page loads. They last up to two years.
• Preview access (flz_access): set only if you enter the pre-launch password, so you aren't asked again on the same device for thirty days. It holds a hash, never the password, and is strictly necessary for the preview to work.

Clearing your browser's cookies removes all of them.

Prices on the site show in rand, euros or dollars. Which one is chosen from your device's time zone, in your browser, and nothing about your location is sent anywhere. If you pick a currency yourself, that choice is remembered in your own browser (local storage) until you clear it.

Why we're allowed to hold it

For enquiries, audit requests and resource downloads, the lawful basis is your consent and the steps needed to enter into a contract with you. For analytics, server logs and the spam check on the contact form, it is legitimate interest in keeping the site working and understanding whether it's useful, balanced by the fact that the data is aggregate and pseudonymous, and that you can opt out.

Who else sees it

No one buys it and no one is given it for their own purposes. The service providers that process data on our behalf are:

• Google Analytics, visit and event analytics, with the cookies described above
• Vercel, hosting, server logs and cookieless analytics
• Google Fonts, serves the typeface your browser renders
• Google reCAPTCHA, checks that contact form enquiries come from a person
• Resend, delivers the contact form, audit request and download details to our inbox, and our confirmation emails to you
• Our email provider, receives and stores your enquiry

Some of these operate outside South Africa and the EU. Where that happens, transfers rely on the providers' standard contractual clauses and equivalent safeguards.

How long we keep it

Project enquiries and download details are kept for as long as the conversation is live and for up to three years afterwards, so we can pick up where we left off. Analytics data is retained in aggregate by Google Analytics and Vercel. Ask us to delete your enquiry at any time and we will.

Your rights

You can ask us to show you what we hold about you, correct it, delete it, or stop using it, and you can withdraw consent at any time. Email brandon@flowlabz.com and we'll respond within 30 days.

If you think we've handled your information badly, you can complain to the Information Regulator of South Africa, or to your local data protection authority if you're in the EU or UK.

Children

This site is aimed at businesses. We don't knowingly collect information from anyone under 18.

Changes

If this policy changes, the date at the top changes with it. Material changes will be obvious rather than quiet.