Privacy & how I found you

Plain-language notice for anyone who received a Flowleaks outreach email. It covers what is required by GDPR / UK GDPR Article 14, PECR and CAN-SPAM.

Who is contacting you

The controller of your data is House Arrow (KvK 42070994, Netherlands). Flowleaks is a House Arrow service operated through an agent-run technical workflow. House Arrow's authorized legal representative handles contracts, client access and data-rights requests. You can reach the service at report@flowleaks.com.

Postal address: Meilag 24, 1619XX Andijk, Netherlands.

What data we hold about you

Only the minimum needed for one short business-to-business email sequence:

• your name and professional role;
• the business email address of one commercial contact per company;
• a few facts about your store observed through ordinary customer actions - for example, which flow emails arrived, went to spam, or were not observed.

Where we got it, and whether it was public

Your details come from these routes, each publicly accessible business information:

• your company website contact page (public);
• your LinkedIn profile (public);
• public pages of your store visited through ordinary customer actions (public).

Why we are using it

For one purpose only: a short business-to-business email sequence - one initial message and at most two follow-ups - about email-delivery defects observed on, or relevant to, your store. The legitimate interest pursued is the direct marketing of a technical QA service that is directly relevant to your business.

My legal basis

Legitimate interests (GDPR / UK GDPR Article 6(1)(f)). House Arrow has carried out an assessment weighing that interest against your rights and freedoms; a copy is available on request.

There is no solely automated decision-making with legal or similarly significant effects. Prospects are selected using business-role relevance and public company and store criteria, with evidence checked before a message is sent.

Who receives it

The current provider inventory is:

• Cloudflare, Inc. provides website hosting, DNS and inbound email forwarding. It processes connection data needed to serve the site and route messages.
• Google Ireland Limited / Google LLC provides the Gmail destination for messages forwarded to report@flowleaks.com and stores the resulting correspondence.
• House Arrow keeps the working prospect and suppression records in access-restricted local files on its own machine. No external list-storage provider is currently used.

No outbound mailbox, sending platform or email-address-verification provider is connected yet. This notice will name the selected provider before any outreach begins. Prospect data will not be sent through an unnamed provider.

House Arrow does not sell, rent or trade your data to anyone.

International transfers

Cloudflare may process data in the United States and other locations. For transfers from the EEA or UK, Cloudflare states that it relies on the EU-U.S. Data Privacy Framework and its UK Extension where applicable, with the European Commission's Standard Contractual Clauses as an additional or fallback safeguard under its Data Processing Addendum.

Google may process Gmail data on servers outside the EEA or UK. Google states that it uses applicable adequacy decisions and the EU-U.S. Data Privacy Framework and UK Extension for covered U.S. transfers; its current framework statement is available in Google's data-transfer terms.

The outbound mailbox and sending transfer mechanism will be added here before any prospect data is processed by that provider.

How long we keep it

Outreach records for anyone who does not respond are deleted no later than 24 September 2026. The only thing kept afterwards is a minimal suppression record - a normalized address, the date, the scope, and minimal provenance - retained while House Arrow carries out marketing to which your objection applies, and reviewed annually, so that we can honour your request never to be contacted again.

Your right to object to marketing

You have the absolute right to object to direct marketing. Send one email to report@flowleaks.com, or simply reply "no", and we will stop and suppress your address the same working day - at no cost and with no need to log in anywhere.

Your other rights

As they apply to this processing, you also have the right to access, rectification, erasure and restriction of your data.

Complaints

If you are unhappy with how House Arrow has handled your data you can complain to your supervisory authority: the Information Commissioner's Office (ICO) in the UK, or the Autoriteit Persoonsgegevens in the Netherlands.

Note for US recipients (CAN-SPAM)

Every email we send is identified as an advertisement, identifies House Arrow and Flowleaks as the sender, carries the postal address above, and includes a working opt-out. Reply to opt out and we will honour it within 24 hours.

Last updated 15 July 2026.