Privacy Policy
Last updated 18 October 2026
This policy explains what personal data Flow State collects, why, and what rights you have. It applies to rokas-flow-state.com, our checkout, our email list, and our Instagram, Facebook, YouTube and TikTok pages.
1. Who is responsible for your data
The data controller is Rokas Gavėnavičius, operating as Flow State, based in Balaguer, Spain.
Email: support@rokas-flow-state.com
Location: Balaguer, Lleida, Spain
2. What we collect
When you buy something
- Name, email address, country
- Billing details you enter at checkout
- What you bought, when, and how much you paid
- We never see or store your full card number. Card data goes directly to Stripe.
When you join the email list or a free challenge
- Name and email address
- Which page or form you signed up from
- Whether you opened our emails and which links you clicked
When you message us or comment on our posts
- Your Instagram or Facebook username, the comment text, and the message content
- Anything you choose to share in that conversation
When you use the site
- IP address, browser type, device type, pages visited, time on page
- Cookies and similar identifiers (see section 8)
When you are a member of Flow State Inner Circle
- Your Skool account details, membership status, and activity inside the community
We do not knowingly collect data from anyone under 16. If you believe a minor has given us data, contact us and we will delete it.
3. Why we use it, and the legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Delivering what you bought, and support | Name, email, purchase record | Performance of a contract |
| Taking payment and keeping accounting records | Billing data, invoices | Contract and legal obligation (Spanish tax law) |
| Sending training emails and offers | Name, email, engagement | Consent, or legitimate interest for existing customers |
| Replying to comments and DMs | Social handle, message content | Legitimate interest in serving customers |
| Improving the site and our marketing | Analytics, cookies | Consent (non-essential cookies) |
| Preventing fraud and abuse | IP, device, purchase history | Legitimate interest |
You can withdraw consent at any time. Every marketing email has an unsubscribe link, and unsubscribing never affects a purchase you already made.
4. Who we share it with
We do not sell your data. We share it only with the providers that make the business run.
| Provider | What it does | Where |
|---|---|---|
| GoHighLevel (LeadConnector) | CRM, email, checkout, funnels | United States |
| Stripe | Card payments | Ireland / United States |
| Meta Platforms | Instagram and Facebook messaging and ads | Ireland / United States |
| Skool | Paid community hosting | United States |
| Analytics and YouTube hosting | Ireland / United States | |
| Make (Celonis) | Workflow automation between the tools above | European Union |
Each of these is bound by a data processing agreement and, where data leaves the EU, by Standard Contractual Clauses or an equivalent safeguard. We may also disclose data where the law requires it, or to protect our legal rights.
5. How long we keep it
- Purchase and invoice records: 6 years, as required by Spanish commercial and tax law.
- Email list: until you unsubscribe, then removed within 30 days.
- Support conversations and DMs: 24 months after the last message.
- Analytics data: 14 months.
- Community membership: while you are a member, plus 12 months.
6. Your rights
Under GDPR you can ask us to:
- Access the data we hold about you
- Correct anything wrong
- Delete it, where we are not required to keep it
- Restrict or object to certain processing
- Port it to another provider
- Withdraw consent at any time
Email support@rokas-flow-state.com and we will respond within 30 days. We may ask you to confirm your identity first. If you are unhappy with our answer you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.
7. Where your data is stored
Our providers are mainly in the United States. Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. You can request a copy of the safeguards we use.
8. Cookies
We use two kinds:
- Essential — needed for checkout, login and security. These cannot be switched off.
- Analytics and marketing — tell us which pages work and which ads bring buyers. These load only after you accept them in the cookie banner.
You can clear or block cookies in your browser at any time. Blocking essential cookies will break checkout.
9. Automated messages
If you comment a keyword on one of our posts, an automated system may send you a direct message with the resource you asked for. That message is triggered by your own comment. You can stop it by not commenting, or by telling us to stop, and we will not message you again.
We do not make decisions with legal effect about you by automated means alone.
10. Changes to this policy
If we change how we handle data, we update this page and change the date at the top. Material changes are announced by email to the list.