Subprocessors

The companies we use to run Flowstate that may process our customers' personal data.

Last updated 23 October 2026. Provided by FLOWSTATE MAIL LTD, a company registered in Nigeria (RC number [Placeholder: RC number]).

These are the service providers FLOWSTATE MAIL LTD uses that may process personal data for our customers. We give at least 14 days' notice before adding or replacing one (see section 6 of the Data Processing Agreement). Notices go to each account owner's email.

In use

• Railway Corporation. Hosts the website, app, database and uploaded files. Data: All account and brand data. Where: United States. Safeguards: Railway DPA with EU Standard Contractual Clauses, UK Addendum and EU-US Data Privacy Framework. [Placeholder: confirm: DPA signed]
• Anthropic, PBC. AI models (Claude) for research, planning, copy, design, checks, reports and chat; web search for research. Data: Store content, brand details, onboarding answers, chat messages, images and Klaviyo numbers. Never Klaviyo keys. Where: United States. Safeguards: Anthropic DPA (part of its Commercial Terms) with EU Standard Contractual Clauses and UK Addendum. No training on our content; deleted within 30 days by default.
• Resend, Inc.. Sends sign-in links and service emails. Data: Email addresses and email content. Where: United States (account data); emails sent from its EU region. Safeguards: Resend DPA with EU Standard Contractual Clauses; EU-US Data Privacy Framework.
• Cloudflare, Inc.. Domain name system; receives and forwards email sent to team@flowstatemail.com. Data: Emails sent to us; request metadata. Where: Worldwide. Safeguards: Cloudflare DPA with EU Standard Contractual Clauses; EU-US Data Privacy Framework.
• Google LLC (Google Workspace). Our team email and database backups. Data: Support emails; backup copies of all data. Where: United States and worldwide. Safeguards: Google Cloud Data Processing Addendum with EU Standard Contractual Clauses. [Placeholder: confirm: moved to Google Workspace]

Only if switched on

• Anysphere, Inc. (Cursor), with xAI (Grok) as the model. Some creative steps (copy and design), with Claude as the fallback. Data: Store content and brand details. Where: United States. Safeguards: Business plan with Privacy Mode and a DPA required first. [Placeholder: confirm: remove this row if not used for customer work at launch]
• Figma, Inc. and Google Sheets. Shared design files and calendars, if delivered that way. Data: Email designs and plans. Where: United States. Safeguards: Provider DPAs. [Placeholder: confirm: whether used]
• Analytics and error tracking. Not in use. We'll update the Cookie notice and this list, with notice, before adding any.

Not our subprocessors

• Klaviyo and Shopify are your providers. We access them only on your instructions, at the access level you choose.
• Lemon Squeezy (Link, LLC) is our reseller and merchant of record. It handles checkout and billing as a separate controller under its own privacy policy.
• The tools we use for our own business outreach never receive customer data.

This is a draft. Have a lawyer review it before relying on it.