Cookie Policy

1. What Are Cookies

Cookies are small text files placed on your device when you visit a website. This policy also covers similar technologies we use for the same purposes, including browser localStorage, which stores information on your device in the same way a cookie does.

This policy covers two different places:

• Our marketing website at flowstate.mortgage, which anyone can visit
• The FlowState application at app.flowstate.mortgage, which requires an account and a login

They do not use the same cookies, and we describe them separately below.

2. Cookies on Our Marketing Website

Essential

Required for the site to work and to keep it secure. These cannot be switched off.

• Session management and load balancing
• Form submission and spam prevention (we use a honeypot technique, which sets no third-party cookies)
• Storing your cookie choices, so we do not ask you again on every page

Analytics and Performance

Used to understand how visitors find and use the site so we can improve it.

• Google Tag Manager — a tag manager that loads our Google analytics and measurement tags
• Vercel Analytics — page and performance measurement provided by our hosting platform. It runs for every visitor, whatever you choose in the cookie banner. By Vercel's account, it sets no cookies and does not identify individual visitors.
• PostHog — website analytics. PostHog sets a cookie and uses browser storage to recognize your browser from one visit to the next. It records the pages you view and leave and what you click on, builds heatmaps of where visitors move their mouse, click and scroll, and makes session recordings: replays of how you moved through the site, with anything you type into a form field masked. PostHog is listed as a sub-processor in Section 5 of our Privacy Policy.

Unless you have turned analytics off, when you give us your email address on our website we also send it to PostHog and use it to identify you there. This happens when you sign up for FlowState, and when you ask for your playbook by email after completing our assessment. PostHog then links your activity on our website to your email address, including later visits from the same browser. For the assessment, PostHog also stores a summary of your result with it.

Marketing

Used to measure whether our marketing reaches the right people. Google's advertising and personalization storage is enabled through Google Tag Manager unless you opt out.

• Apollo.io — a tracker, loaded through Google Tag Manager, that identifies the companies that visit our website, for our sales and marketing. Apollo may also use this information to verify and enrich its own business contact database. If you turn marketing off, the tracker does not load.

We do not sell data from your FlowState account, and we do not use it — including your clients, your loans, your email or your calendar — for advertising. That commitment is in Section 3 of our Privacy Policy and it is not changed by anything in this policy.

3. Cookies in the FlowState Application

Once you log in to app.flowstate.mortgage, we use the following.

Essential

• Authentication session — set by Auth0, our identity provider, to keep you securely signed in. Without it you cannot use the application.
• Payment processing — Stripe sets cookies on our checkout and billing pages to process payments and prevent fraud.

Functional

• Interface preferences — for example, whether your sidebar is expanded or collapsed.

Product Analytics

• PostHog — product analytics that tell us which features are used and how often, so we can decide what to build and fix. PostHog is listed as a sub-processor in Section 5 of our Privacy Policy.

We deliberately limit what product analytics collect in the application. There, we do not record your screen, we do not automatically capture the contents of pages or the text of what you click, and we do not send your name, your email address, or any client, loan or financial information to our analytics provider. Events identify you only by an internal account identifier and your organization's identifier. Our marketing website works differently; see Section 2.

4. How Long Cookies Last

Cookies are either session cookies, deleted when you close your browser, or persistent cookies, which remain for a set period or until you delete them.

• Essential: session, or up to 1 year
• Analytics and performance: up to 2 years
• Functional: up to 1 year
• Marketing: up to 1 year

5. Managing Your Choices

On our marketing website

The first time you visit flowstate.mortgage you will see a cookie banner. You can accept everything, or open preferences and choose by category — analytics and marketing can each be turned off. Essential cookies cannot, because the site does not work without them. You can change your choices at any time by clearing your browser storage for our site, which makes the banner appear again.

Because we operate in the United States, non-essential cookies are on by default until you opt out.

In the FlowState application

The application does not show a cookie banner. Its essential and functional cookies are required to sign you in and to run the product you have subscribed to, and its product analytics are covered by the Privacy Policy you accept when you create an account. If you want your usage excluded from product analytics, email us at privacy@flowstate.mortgage and we will exclude your account.

In your browser

Most browsers let you block all cookies, block third-party cookies, delete existing cookies, or warn you before one is set. Blocking cookies in the FlowState application will prevent you from signing in.

Opting out of Google's advertising cookies

You can opt out of Google Analytics measurement using the Google Analytics Opt-out Browser Add-on, and you can control Google advertising personalization at Google Ad Settings.

6. If You Disable Cookies

• On our marketing website, the site will still work; some measurement and preference features will not.
• In the FlowState application, you will not be able to sign in, because the authentication session is a cookie.

7. Updates to This Policy

We may update this Cookie Policy to reflect changes in our practices or in the law. The version and effective date shown at the top of this page tell you which version is current. We will post any updated policy on this page.

8. Contact Us

Questions about our use of cookies:

Email: privacy@flowstate.mortgage

FlowState Mortgage 3839 McKinney Ave, Suite 155 Dallas, TX 75204