FlowState IQ Privacy Policy

v1.1-FINAL · 2026-05-06 Effective Date: 2026-05-06 Last Updated: 2026-05-06 Status: Provisional working document. This document has not been reviewed by licensed counsel and is not legal advice. Counsel review is scheduled for the v2 revision at the first-revenue / cold-traffic clickwrap activation milestone. This Policy is published for disclosure via footer links across all destinations operated by FlowState IQ LLC: flowstateiq.com, flowstateiq.com/elevate, and becomingiq.com.

Supersedes: v1-FINAL (2026-04-18). The v1-FINAL Policy was scoped to the FlowState IQ platform and the Arc product. v1.1-FINAL broadens scope to all FlowState IQ LLC–operated destinations including becomingiq.com (public showcase + gated operator workspaces).

FlowState IQ LLC ("FlowState IQ," "FlowState," "we," "us," or "our") operates a portfolio of destinations under one entity. This Privacy Policy describes how we collect, use, store, share, and protect your information across those destinations. It also describes your rights regarding your information and how to exercise them.

This Policy is the single, canonical Privacy Policy for FlowState IQ LLC. The footer "Privacy" link on every destination resolves to this document.

0. Surfaces Covered by This Policy

This Policy applies to four distinct surfaces. Where data practices differ by surface, the per-section text identifies which surface a given practice applies to.

| Surface | URL | Audience | What happens here | |---|---|---|---| | Platform | flowstateiq.com (root) | Authenticated platform users | The FlowState IQ organizational intelligence platform — workshops, gap analysis, AI-generated recommendations | | Arc / Elevate IQ | flowstateiq.com/elevate | Arc purchasers and prospects | The First Arc assessment product and the Elevate IQ consulting practice | | BecomingIQ — public | becomingiq.com (public pages) | Public visitors | A showcase of in-development builds operated by FlowState IQ LLC | | BecomingIQ — operator workspace | becomingiq.com (gated) | Customers under an executed Engagement Letter | A customer-specific workspace for in-development build review and operational use during the engagement window |

The Arc Terms of Service at flowstateiq.com/elevate/terms (the "Arc ToS") govern Arc-specific data handling where addressed (for example, Arc ToS §7 Data Handling and §8 Intellectual Property); those terms govern for Arc-specific matters. The Engagement Letter executed by a BecomingIQ customer governs operator-workspace data handling for that customer's engagement. This Policy governs generally and fills any gap.

By using any of the destinations above, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree with these practices, please do not use the destinations.

1. Information We Collect

1.1 Account Information (Platform, Arc, Operator Workspace)

When you create an account or are provisioned an account, we collect information necessary to set up and maintain that account, including your name, email address, and password. If you access a destination through a consultant-led engagement, your account may be created on your behalf with information you provide to the consultant.

1.2 Organizational Data (Platform, Arc, Operator Workspace)

The core function of the Platform, the Arc, and BecomingIQ operator workspaces is to analyze organizational information you provide. This may include:

Technology systems and tools your organization uses
Workflow descriptions and operational processes
Identified operational gaps and challenges
Business strategy, goals, and aspirations
Revenue models, market positioning, and competitive context
Team structure and resource information
Responses to workshop questions and assessment prompts
Arc assessment inputs and generated operational profile
Operator-workspace inputs specific to an executed Engagement (see §1.6)

You control what organizational data you provide. We only process the information you voluntarily submit. We do not independently collect information about your organization from external sources.

1.3 Payment Information (Arc)

When you purchase the Arc, payment is processed by our third-party payment processor. We receive confirmation that payment was completed and a transaction identifier, but we do not collect, store, or process your full payment card number or account credentials. Refer to the payment processor's own privacy policy for its handling of payment data.

1.4 Usage Data (All Surfaces)

We automatically collect certain technical information when you use any destination, including your IP address, browser type, device information, pages visited, and timestamps. This data is used to maintain security and improve performance.

1.5 Cookies and Tracking (All Surfaces)

Our destinations use essential cookies required for authentication and session management on the surfaces that have authentication (Platform, Arc, BecomingIQ operator workspace). The BecomingIQ public showcase does not require authentication and does not set authentication cookies for unauthenticated visitors.

We do not currently use third-party analytics or advertising cookies on any destination. If we implement analytics tools in the future, we will update this Privacy Policy and, where required, obtain your consent.

1.6 BecomingIQ Operator-Workspace Inputs

Customers using a BecomingIQ operator workspace under an executed Engagement Letter may submit additional categories of operational data through the workspace, which can include:

Voice recordings or transcripts captured during operational use of the workspace (for example, a field operator capturing a job-site note by voice)
Photographs of physical assets, locations, or job sites uploaded into the workspace
GPS / location data associated with field operations the customer chooses to log
Customer end-user personal information the customer chooses to enter into the workspace (for example, a customer's own end-customer contact details, addresses, or account context)

The customer is the data controller for this information. FlowState IQ LLC is the data processor under the executed Engagement Letter. The Engagement Letter governs use, retention, and deletion specific to the engagement; this Privacy Policy describes the data flow.

1.7 BecomingIQ Public Visitors

Public visitors to becomingiq.com (visitors who are not authenticated into an operator workspace) submit no personal information to us. Web fonts are self-hosted; the public surface does not load resources from third-party CDNs that would set cookies or transmit visitor IP addresses to third parties beyond the standard hosting infrastructure described in §3.4. We do not run analytics on the public surface. We do not operate a contact form on the public surface; the email address chad@flowstateiq.com is the contact path.

The only information collected from a public visitor is the standard server-log data described in §1.4 (IP, user agent, timestamps, pages requested), retained for security and operational purposes.

2. How We Use Your Information

We use the information we collect for the following purposes:

Deliver the destinations and their products — provide account access, generate operational profiles, deliver workshop outputs and assessments, operate BecomingIQ workspaces under executed Engagements
Service communications — respond to your requests, send administrative notices, and communicate about your account or engagement
Follow-up outreach — determine whether to offer a Discovery Engagement, 90-Day Engagement, BecomingIQ engagement, or similar next steps based on your activity and outputs
Security and fraud prevention — detect, prevent, and respond to unauthorized access, abuse, and technical issues
Compliance — meet legal obligations, respond to valid legal process, and enforce our Terms of Service and Use-of-Site Terms
Product improvement in aggregate, anonymized form — see §5.5 (Anonymized Aggregate Data) and the Arc ToS §7.7 for the anonymization standard we apply before any such retention

We do not use your information for advertising, behavioral profiling for third parties, or any purpose not described in this Policy.

3. Artificial Intelligence and Data Processing

This section describes how your data interacts with artificial intelligence systems. We believe transparency about AI data handling is essential to earning and maintaining your trust.

3.1 AI Provider

FlowState uses Anthropic's Claude AI to analyze organizational data you provide and to generate insights, recommendations, and reports across the Platform, the Arc, and BecomingIQ operator workspaces. When you use features that involve AI analysis, relevant portions of your organizational data are transmitted to Anthropic's API for processing.

3.2 What Data Is Sent to Anthropic

When you engage in a workshop, assessment, BecomingIQ operator-workspace AI feature, or other AI-powered feature, the following types of data may be sent to Anthropic's API:

Your responses to workshop and assessment questions
Organizational context you have provided (technology systems, workflows, gaps, strategy)
Conversational inputs during interactive AI sessions
Arc assessment inputs during Arc-guided flows
BecomingIQ operator-workspace inputs that are routed to AI for processing (which can include voice transcripts, photo descriptions, and structured operational context — see §1.6)

We do not send your account credentials, payment information, or personal contact details to Anthropic.

3.3 Anthropic's Data Practices

Anthropic does not use data submitted through its API to train its AI models. This means your organizational data is not used to improve Anthropic's general AI capabilities. Anthropic processes the data solely to generate the requested response and may retain it temporarily for safety monitoring and abuse prevention purposes, in accordance with Anthropic's data retention policies.

For the most current information about Anthropic's data practices, please refer to Anthropic's privacy documentation at anthropic.com.

3.4 Data Storage, Hosting, and Residency

Your account data, organizational data, workshop responses, Arc inputs, AI-generated outputs, and (for BecomingIQ operator workspaces) operational inputs are stored in databases hosted by Supabase. Application hosting for all destinations is provided by Vercel. The FlowState IQ platform and BecomingIQ are deployed as separate Supabase projects; both run on US-based infrastructure. Data is retained to provide you continuity across sessions, historical analysis, and the ability to track progress over time.

For BecomingIQ operator workspaces, certain operational features may also engage:

Google Maps Platform for geocoding, mapping, and location-aware features
Other third-party APIs as documented in the executed Engagement Letter for that workspace

The full sub-processor list, by surface, is in §4.2.

3.5 AI Limitations

AI-generated analyses and recommendations are produced by statistical models and may contain inaccuracies. They are provided for informational purposes and should not be treated as professional advice. Please refer to the Arc Terms of Service for important disclaimers regarding AI-generated content. The same disclaimers apply to AI features in BecomingIQ operator workspaces.

4. How We Share Your Information

We do not sell your personal information or organizational data. We share your information only in the following limited circumstances.

4.1 AI Service Provider

As described in §3, relevant organizational data is transmitted to Anthropic for AI processing. This sharing is essential to provide AI-powered functionality across destinations.

4.2 Infrastructure and Sub-Processors

We use third-party infrastructure providers and sub-processors to operate our destinations. The current list, by surface where the provider is engaged:

| Sub-processor | Purpose | Surfaces | |---|---|---| | Supabase | Database hosting and authentication | Platform, Arc, BecomingIQ operator workspace | | Vercel | Application hosting | Platform, Arc, BecomingIQ public, BecomingIQ operator workspace | | Anthropic | AI processing | Platform, Arc, BecomingIQ operator workspace | | Google Maps Platform | Geocoding and mapping | BecomingIQ operator workspace | | Payment processor | Arc checkout payment processing | Arc |

These providers process data on our behalf and are contractually obligated to protect your information. We will update this list as material sub-processors change.

4.3 FlowState Consultants

If you access a destination through a consultant-led engagement, your assigned FlowState consultant will have access to your organizational data and outputs to the extent necessary to facilitate your engagement. Consultants are bound by confidentiality obligations.

4.4 BecomingIQ Customer Engagements

If you are a BecomingIQ customer with an executed Engagement Letter, that Engagement Letter is the controlling document for use, access, retention, and deletion of data within your operator workspace. Where this Privacy Policy and an executed Engagement Letter address the same matter, the Engagement Letter controls for that engagement.

4.5 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process, such as a court order, subpoena, or government investigation. We will make reasonable efforts to notify you of such disclosures unless prohibited by law.

4.6 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

5. Data Retention

5.1 Active Accounts

We retain your information for as long as your account is active and as needed to provide you with destination services.

5.2 Inactive Accounts

If your account is inactive for a continuous period of one (1) year, we will make reasonable efforts to notify you at the email address associated with your account and provide an opportunity to export your data or reactivate your account. If the account remains inactive, we will then delete your organizational data and outputs from our systems, subject to §5.4.

5.3 Deletion Requests

Upon a verified deletion request under §6.3, we will delete your personal and organizational data within thirty (30) days, except where retention is required by law, necessary to complete transactions already initiated, or permitted under §5.5 (anonymized aggregate data).

5.4 Exceptions

We may retain certain information beyond the periods described above where required by law, for legitimate business purposes (such as resolving disputes), or where deletion is not technically feasible for specific backup systems. Such retained data will be minimized and protected.

5.5 Anonymized Aggregate Data

We may retain anonymized, aggregated data derived from destination activity — patterns of pain points, closure types, industry shapes — to improve our products and develop derivative templates. For this purpose, "anonymized" means data has been processed such that it cannot reasonably be used to identify you or your business, whether alone or in combination with other information. Anonymized aggregate data is not considered personal data under this Policy. See Arc ToS §7.7 for parallel treatment.

5.6 Operator-Workspace Retention

For BecomingIQ operator workspaces, the retention period for engagement-specific data is governed by the executed Engagement Letter. The default position absent contrary terms in the Engagement Letter is that operator-workspace data is retained during the engagement window and for a reasonable post-engagement period to permit data export, then handled per the Engagement Letter's deletion or transfer terms.

6. Your Rights

You have the following rights regarding your information.

6.1 Access

You may request a copy of the personal and organizational data we hold about you.

6.2 Correction

You may request that we correct any inaccurate or incomplete information we hold about you.

6.3 Deletion

You may request that we delete your personal and organizational data. Upon receiving a verified deletion request, we will delete your data within thirty (30) days, except as set out in §§5.4, 5.5, and 5.6.

6.4 Data Portability

You may request a complete export of your data in a commonly used, machine-readable format. We will fulfill export requests within thirty (30) days.

6.5 Withdrawal of Consent

Where we process your information based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

6.6 How to Exercise Your Rights

To exercise any of these rights, please contact us at chad@flowstateiq.com with the subject line "Privacy Request." We will respond within thirty (30) days. We may need to verify your identity before fulfilling certain requests.

7. Data Security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (TLS/SSL)
Row-level security controls in our databases restricting data access to authorized users
Authentication and access controls for accounts on each destination
Separation of FlowState platform and BecomingIQ data into distinct Supabase projects, providing defense-in-depth between unrelated tenancy domains
Regular review of data collection, storage, and processing practices

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee its absolute security.

8. Children's Privacy

Our destinations are not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly.

9. State Privacy Rights

9.1 Illinois Residents

If you are an Illinois resident, you may have additional rights under the Illinois Personal Information Protection Act (PIPA) or other applicable state laws.

Illinois Biometric Information Privacy Act (BIPA) note. The FlowState IQ platform and Arc do not collect biometric identifiers or biometric information as defined under BIPA. BecomingIQ operator workspaces accept voice recordings and photographs from authenticated operators acting under an executed Engagement Letter; we do not perform biometric identification (such as voiceprint analysis or facial recognition) on this content. If a BecomingIQ engagement is configured in the future to perform biometric identification, that change requires written notice to the customer, additional disclosure, and (where required) explicit informed consent under BIPA prior to processing.

9.2 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and its successor, the California Privacy Rights Act (CPRA). We do not sell personal information and do not share personal information for cross-context behavioral advertising. To exercise rights under California law, contact us at chad@flowstateiq.com.

9.3 Other States

Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Texas, and others) may have additional rights, which may include the rights of access, deletion, correction, portability, and opt-out of certain processing. Contact us to learn more about your specific rights.

9.4 International Users — EU and UK Posture

Our destinations are operated from and for the United States. We do not target users in the European Union, the European Economic Area, the United Kingdom, or other jurisdictions with comprehensive cross-border data protection regimes. Specifically:

We do not market our destinations to users in those jurisdictions.
We do not localize our destinations into EEA-member languages or currencies.
We do not configure payment paths for EEA-member or UK billing.
We do not have customers established in those jurisdictions.

If you access a destination from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. Data you submit will be transferred to and processed in the United States.

If you are accessing a destination from the EEA or United Kingdom and have a privacy question, you may contact us at chad@flowstateiq.com.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated Policy on the destinations and update the "Last Updated" date. For material changes, we will provide at least thirty (30) days' notice via the email address associated with your account. Non-material changes (typo fixes, clarifications that do not alter substantive rights) take effect immediately upon posting.

Your continued use of any destination after the effective date of any material changes constitutes acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

FlowState IQ LLC 825 S Evergreen Ave Arlington Heights, IL 60005 chad@flowstateiq.com

For privacy-specific inquiries, please include "Privacy" in the subject line of your email to help us route your request appropriately.

Version: v1.1-FINAL — broadens scope to all FlowState IQ LLC destinations Supersedes: v1-FINAL (2026-04-18) Last modified: 2026-05-06 Counsel review: Scheduled at v2 (first-revenue / cold-traffic clickwrap activation milestone, or first paid BecomingIQ hosting arrangement, whichever comes first)

v2 counsel re-engagement scope

Carry-forward items for the next counsel review:

Verify Illinois PIPA, BIPA, and general consumer-protection fit for an Illinois data-controller processing business data — including the §9.1 BIPA note covering BecomingIQ voice/photo handling
Confirm CCPA/CPRA posture for California residents (sale/share attestation, opt-out mechanics)
Evaluate whether comprehensive multi-state disclosure (Colorado, Connecticut, Virginia, Texas, Oregon, etc.) should be expanded from current general reference to per-state specificity
Review Anthropic sub-processor posture — whether the current disclosure is sufficient, whether SCCs or similar instruments are ever needed, whether AI-specific disclosure patterns (FTC AI guidance) warrant changes
Review the broader sub-processor list (§4.2) — Google Maps Platform terms, Vercel terms, payment processor DPA — and confirm contractual data-protection posture across the chain
Clickwrap pattern for Privacy Policy acceptance at Arc checkout (coordinate with Arc ToS §1 clickwrap review, IMPL-01)
Confirm international-user posture (§9.4) — whether affirmative access restriction is required or current passive non-targeting disclaimer suffices; pressure-test the EEA/UK contact path
Age-18 threshold under §8 — confirm fit with COPPA and state-level child-privacy thresholds
Operator-workspace data flows (§§1.6, 5.6, 9.1) — confirm interaction with executed Engagement Letter governance and processor-controller framing
Hosting Services Agreement template — fires when FlowState IQ transitions any BecomingIQ customer from "free hosting during engagement" to "paid continued hosting"; this Policy will need a corresponding update at that point