Privacy Policy

Effective date: 5 July 2026

This policy explains what personal information Flowstate Atlas collects, how we use and protect it, and your rights. It is written to comply with South Africa's Protection of Personal Information Act (POPIA). The responsible party is Flowstate Systems (Pty) Ltd (registration number K2026509159).

1. Our promise in plain terms

• We use your data only to run the Service for you.
• We do not sell your data, do not use it for advertising, and do not use it to train AI models.
• We do not run third-party advertising trackers or analytics pixels on the Service.
• We share data only with the limited service providers needed to operate the Service, listed below.

2. Information we collect

• Account details — your name, email address, organisation name, and (optionally) your role.
• Operational data you enter — your process maps, cost inputs, metrics, readings, improvement projects, and similar information you choose to add.
• Support and communications — messages you send us, including support tickets and demo requests.
• Billing information — your plan, subscription status and credit history. We never receive or store your full card details — card payments are handled directly by our payment processor (see below).
• Technical data needed to run the Service — for example, secure session cookies that keep you logged in and remember basic preferences. We do not use tracking or advertising cookies.

3. Why we use it, and our lawful basis

We process your information to: create and manage your account; provide the mapping, analysis and tracking features; process payments and manage subscriptions; provide support; keep the Service secure; and meet legal obligations. Under POPIA, we rely on the performance of our contract with you (to deliver the Service you signed up for), our legitimate interests (to run and secure the Service), your consent (for optional AI processing), and compliance with the law where applicable.

4. AI analysis

AI analysis is optional and you control it with a setting in your account. When you enable it, the operational data needed for the analysis is sent to our AI provider, Anthropic, to generate the results. Anthropic processes this data to return your analysis and, under its commercial API terms, does not use it to train its models. You can disable AI processing at any time, after which no further data is sent for AI analysis.

5. Who we share data with (sub-processors)

We share data only with the providers that make the Service work. Each is bound to protect your information and use it only on our instructions.

We may also disclose information if required by law, to protect our rights, or as part of a business transfer — in which case we will ensure your information stays protected.

6. Payments

Card payments are processed by Paystack, a licensed payment provider, on their secure (PCI-DSS compliant) systems. We receive only what we need to manage your subscription — such as the result of a payment and your plan status — and never your full card number.

7. International transfers

Some of our providers process or store data on servers outside South Africa. Where personal information is transferred across borders, we take reasonable steps to ensure it remains protected to a standard consistent with POPIA, including through the providers' contractual data-protection commitments. This transfer is necessary to provide the Service you have requested.

8. How we protect your data

We use industry-standard safeguards, including encryption of data in transit, authenticated access, and database-level access controls that restrict each account to its own data. No system is perfectly secure, but we work to protect your information and to address issues promptly.

9. How long we keep it

We keep your information while your account is open and as needed to provide the Service. When you delete your account, it enters a 30-day recovery period (so an accidental deletion can be reversed), after which your data is permanently removed from our active systems, except where we must keep limited records to meet legal, tax or accounting obligations.

10. Your rights under POPIA

You have the right to: access the personal information we hold about you; ask us to correct or delete it; object to certain processing; and withdraw consent for optional processing (such as AI). You can manage much of this in your account settings, or contact us at privacy@flowstatesystems.co.za. You also have the right to complain to the regulator:

Information Regulator (South Africa) — POPIAComplaints@inforegulator.org.za — https://inforegulator.org.za

11. Cookies

We use only the cookies needed to run the Service — for example, to keep you signed in and to remember basic preferences. We do not use advertising or third-party tracking cookies.

12. Children

The Service is for business use by adults and is not directed at anyone under 18. We do not knowingly collect information from children.

13. Changes to this policy

We may update this policy from time to time. For material changes we will give reasonable notice. The "effective date" above shows when the current version took effect.

14. Contact us

Information Officer: Ziyaad Jasat Flowstate Systems (Pty) Ltd Johannesburg, Gauteng, South Africa Privacy enquiries: privacy@flowstatesystems.co.za