Privacy Notice

This Privacy Notice applies to Flowa (Pty) Ltd ("Flowa", "we", "us", "our"), a company registered in South Africa. We operate the Flowa WhatsApp Business automation platform, including the scope and demo booking service at scope.flowa.co.za.

General enquiries: info@flowa.co.za

In terms of the Protection of Personal Information Act 4 of 2013 ("POPIA"), our Information Officer is:

When you complete our scope and demo booking form, we collect:

• Identity data: first name, last name, job title
• Contact data: work email address, mobile phone number
• Business data: company legal name, trading name, website, industry, employee count
• Needs data: desired features, conversation volumes, budget range, go-live timeline
• Technical data: UTM / marketing attribution parameters captured automatically from the URL
• Consent records: timestamps of your POPIA consent and any marketing opt-in

We retain your personal information for a maximum of 24 months from the date of collection, unless you request earlier deletion or we are required by law to retain it for longer.

If you do not proceed with Flowa services after the demo, your data will be anonymised or deleted within the 24-month window.

We do not sell your personal information. We share it only with:

• Supabase Inc. — our database provider (see cross-border transfers below)
• Resend Inc. — our transactional email provider (USA; Standard Contractual Clauses apply)
• Cal.com Inc. — our calendar booking provider (USA; SCCs apply)
• Internal Flowa staff — only those who need access to process your demo request

Your data is stored on Supabase infrastructure located in the European Union (Frankfurt, Germany). The EU has been assessed as providing an adequate level of data protection for South African POPIA purposes.

Where other sub-processors are located outside South Africa, we ensure appropriate safeguards are in place (including Standard Contractual Clauses where applicable).

You have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to correct inaccurate or incomplete information
• Deletion — request erasure of your personal information (subject to legal retention obligations)
• Objection — object to processing based on legitimate interest
• Withdraw consent — withdraw your consent at any time, without affecting the lawfulness of prior processing
• Lodge a complaint — with the Information Regulator of South Africa at inforegulator.org.za

To exercise any of the rights above, please email our Information Officer at info@flowa.co.za with the subject line "POPIA Request" and a description of your request. We will respond within 30 days.

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, and destruction. Access to personal data is restricted to authorised personnel on a need-to-know basis.

We may use PostHog for privacy-respecting, cookieless analytics to understand how visitors use our scope form. No personally identifiable information is sent to PostHog without your consent. We do not use advertising cookies or third-party tracking pixels on this site.

We may update this Privacy Notice from time to time. The "Last updated" date at the top of this page reflects the most recent version. We will notify you of material changes via email if you have an active relationship with Flowa.

For all privacy-related queries, please contact us at info@flowa.co.za.

Flowa (Pty) Ltd · South Africa