Privacy Policy
Last updated October 5, 2026
Flowstate ("we") runs booking pages for businesses, based in Lexington, Kentucky. This policy explains what we collect, why, and how to have it deleted.
Businesses that use Flowstate
When a business signs in with Google, we receive its name and email address so we can tell who is signed in.
When a business connects Google Calendar, Google gives us a refresh token, a key that keeps the connection working. We store it encrypted and use it only to do two things on the calendar the business connects:
- Read its free and busy times, so the booking page only offers open times. We do not read event titles, guests or details.
- Create an event when a guest books, with a video link when the guest picks a video call, and have Google email the guest an invite.
We also store the settings the business enters, such as event types, hours and address.
Guests who book
When you book, we collect what you enter: your name, email, phone number if given, what you're booking, your answers to the business's questions, and notes. We use it to create the booking on the business's calendar, send you the invite, and show the booking to that business. The business you book with can see everything you enter.
Google user data
Flowstate's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the booking features described above. We do not sell it, use it for advertising, or use it to train AI models, and people at Flowstate do not read it except with the business's permission, for security, or where the law requires.
Who we share data with
- The business you book with.
- Services that run Flowstate: Vercel (hosting), Neon (database) and Google (sign-in, calendar and invites).
- Sentry, which tells us when something breaks. Error reports leave out what people enter, like names, emails, phone numbers and notes.
- Authorities, when the law requires it.
We do not sell personal information.
Security and retention
Data travels over HTTPS, and calendar tokens are encrypted at rest. We keep business data while the account is active and booking records until the business or guest asks us to delete them.
Your choices
- Businesses can disconnect Google Calendar at any time in Flowstate's Settings. We delete the stored token and ask Google to withdraw our access. Access can also be removed from Google account permissions.
- Anyone can ask us to see, correct or delete their data by emailing jacobgambrell@gmail.com. We respond within 30 days.
Changes
If this policy changes, we will update the date above and tell businesses that use Flowstate.
Contact
Questions: jacobgambrell@gmail.com