Privacy notice

Effective October 4, 2026

Who handles your information

I am Michael Noke, acting for Flow State AI Solutions LLC (FSS). This notice explains how FSS handles information from this website and initial service inquiries. Contact me at michael@flowstate-ai.biz with privacy questions. Client project information is also governed by the signed project agreement and any applicable confidentiality or data-processing agreement.

Information you provide

The inquiry form requires your name, email address, phone number, company, current challenges, goals, software, familiarity with AI, and frequency of AI use. I use these details to understand your needs and respond. You choose whether to submit the form; you can also contact me by email.

Please provide general business information only. Do not submit passwords, payment-card details, government identifiers, medical information, confidential customer records, or information about children through the inquiry form. Before a project needs confidential or sensitive material, I will arrange appropriate terms and a suitable transfer method with you.

How website inquiries are used and delivered

I use inquiry information to reply, discuss possible services, keep related business records, and protect the website against misuse. Submissions are sent as a plain-text email through Resend to my business mailbox at michael@flowstate-ai.biz. The inquiry application does not store your contact details or written answers in its security database. The email delivery service and business mailbox process and retain the email separately.

I do not sell your personal information. Submitting an inquiry does not sign you up for a marketing mailing list. I do not use the inquiry application to send your answers to ChatGPT or Claude. Any approved use of client project information with those tools is addressed separately below.

Security and updates

The website uses HTTPS and measures intended to reduce unauthorized access and form abuse. No website or email system can guarantee absolute security. I will update this notice when relevant practices change and identify the effective date. Material changes to a signed project agreement require the agreement’s change process.

Verification cookies and technical information

The form uses Cloudflare Turnstile to help distinguish people from bots. Cloudflare processes browser and network signals, including IP addresses and browser characteristics, for security and to improve its bot-detection service. Its Turnstile Privacy Addendum explains these uses.

After successful verification, this website sets a signed, host-only verification cookie lasting up to 30 minutes. It is marked Secure, HttpOnly, and SameSite Strict. It helps the form recognize a verified browser and is not an advertising cookie. Blocking it can prevent submission.

For abuse prevention, the application temporarily records keyed, hashed network identifiers, attempt counts, and submission fingerprints. A fingerprint is a keyed digest used to recognize repeat submissions, not a stored copy of your answers. These records are pseudonymous security data, not a promise of anonymity. Rate-limit records are marked to expire after 48 hours and submission records after 24 hours. Expired records are deleted when a later qualifying form-service request runs the cleanup; expiration is not guaranteed physical deletion at that exact time.

The website uses first-party analytics to understand page views, approximate visits, referral domains, short campaign codes, LET’S BUILD clicks, form starts, error categories, and successful inquiry receipts. Analytics never collects form answers, names, email addresses, raw IP addresses, full referring URLs, or browser fingerprints. A random visit identifier is stored in this tab’s session storage for up to 30 minutes; it is not a person identifier and is not shared with an external analytics service. Known automated, owner and explicitly marked test activity is separated where detectable. The website respects browser Global Privacy Control and Do Not Track signals for optional browser analytics. Successful server-side inquiry receipts may still be counted without a visit identifier. Analytics records are limited to 90 days and deleted when a later analytics collection or owner reporting request runs cleanup; physical deletion at the exact expiry time is not guaranteed. There are no advertising scripts. Hosting, security, and email providers may separately process operational information and logs needed to run their services. Provider processing, backups, and retention are not limited by the application’s security-record expiry periods.

Optional tools and animation preferences

The service finder and time-savings calculator run in your browser. Their answers and calculations are not sent to FSS or an AI provider and are not saved by these tools. The thank-you page uses the same verification cookie and a server-side submission receipt to confirm a successful inquiry. Your device’s reduced-motion setting is respected. Animation preferences are not stored by this website.

Service providers and other disclosures

FSS uses service providers for hosting, verification, email delivery, and business email. Cloudflare provides Turnstile and Resend delivers inquiry email. Providers process information under their own applicable terms and FSS’s service arrangements. I may disclose information when law requires it or when reasonably necessary to protect people, address fraud, or establish or defend legal rights. I will limit disclosures to the relevant purpose.

Client projects and approved AI tools

Before client data is sent to an AI provider, I will obtain the client’s approval of the provider, intended purpose, permitted information, and relevant account settings. ChatGPT and Claude are possible tools, not blanket authorizations. I will minimize or redact data where practical. A provider’s training, retention, human-review, and location practices depend on the specific service and settings; I do not promise that all AI services have identical protections.

We agree on data-retention and deletion terms before work begins.

Retention and privacy requests

I retain inquiry email for responding, evaluating services, and legitimate business or legal recordkeeping. The period depends on the purpose and applicable obligations. It is separate from the short-lived website security records. Deleting active records may not immediately remove provider logs or backup copies, and relevant records may be preserved for a legal obligation or dispute.

Email michael@flowstate-ai.biz to request access, correction, or deletion of information you provided. I may need reasonable verification before acting. I will respond as required by applicable law and explain any limits on a request. Where applicable law provides additional rights or an appeal process, those rights remain available.