Last updated: 10 November 2026
This policy explains what personal data FlowLyt collects through flowlyt.cloud, why, who it is shared with and what rights you have.
1. Who we are
FlowLyt S.A.S. is a company registered with the Chamber of Commerce of Ibagué, Colombia, and legally represented by Víctor Hugo Estupiñán Parra. FlowLyt S.A.S. is the controller of the data described here. Privacy contact: victor@flowlyt.cloud
2. What we collect
When you fill in the contact form: your name, business name, email address, website (optional) and the service and city you work in. We also record the page and language you used.
When you message us on WhatsApp or by email: your phone number or email address, your name as shown in the app, and whatever you choose to write.
When you browse the site (only with your consent, see section 5): pages visited, time on the page, device and browser type, approximate location from your IP address, and how you interact with the page.
We do not ask for sensitive data, and the site is not meant for children under 16.
3. Why we use it, and on what basis
| Purpose | Legal basis (UK GDPR / EU GDPR) |
|---|---|
| Replying to your enquiry and preparing a proposal you asked for | Steps you asked us to take before a contract |
| Following up on that enquiry (no more than 3 follow-ups) | Legitimate interest in answering potential clients |
| Delivering a service you hired | Contract |
| Measuring how the site is used, to improve it | Your consent |
We do not sell your data and we do not use it for automated decisions with legal effects.
4. Who we share it with
- Our sales representative for English-speaking markets (UAE, United Kingdom and Australia). If you write in English or use the English WhatsApp number, your enquiry is handled by this independent representative, who is bound by a written agreement to use your data only to answer you on FlowLyt's behalf.
- Service providers that process data for us: Hostinger (web hosting and the server where our forms and automations run), n8n (self-hosted automation software on that server), Google (email and Google Analytics / Tag Manager), Microsoft (Clarity analytics), Meta (WhatsApp and the Meta Pixel) and Notion (where we keep the record of each enquiry).
- Authorities, only if the law requires it.
5. Cookies and analytics
We use Google Tag Manager, Google Analytics 4, Microsoft Clarity and the Meta Pixel (to measure the results of our ads). Clarity can record how you scroll and click on a page (session replays and heatmaps); it masks what you type in forms. These tools only load if you accept them in the cookie banner. You can change your choice at any time from the "Cookie settings" link in the footer.
6. International transfers
FlowLyt operates from Colombia, and some of our providers process data in the United States and other countries. When data leaves the UK or the EU, we rely on the safeguards those providers offer (such as standard contractual clauses or adequacy decisions). You can ask us for details.
7. How long we keep it
- Enquiries that do not become a project: up to 24 months after our last contact, then deleted.
- Client data: for as long as the contract lasts, plus the period required by Colombian tax and accounting law.
- Analytics data: according to each tool's retention settings.
8. Which laws apply
Because FlowLyt is based in Colombia, Colombian data protection law (Law 1581 of 2012) applies to everything we do. When we offer our services to people in other countries, their local law can also apply, whatever this policy says. In particular:
- United Kingdom: the UK GDPR and the Data Protection Act 2018.
- European Union: the EU GDPR.
- United Arab Emirates: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
- Australia: we follow the Australian Privacy Principles as good practice.
9. Your rights
Depending on where you live, you can ask to access your data, correct it, delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent at any time. Write to victor@flowlyt.cloud; we reply within 30 days. You can also complain to a data protection authority: the Information Commissioner's Office in the UK (ico.org.uk), the authority of your EU country, the UAE Data Office, or the Superintendencia de Industria y Comercio in Colombia.
10. Security
Access to enquiries is limited to the people who need it, connections to the site are encrypted (HTTPS), and credentials are kept in a password manager. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
11. Changes
If we change this policy, we will publish the new version here with its date. If the change is significant, we will say so on the site.