Last updated: 15 October 2026
This Privacy Policy explains how Hushflow collects, uses, shares and protects your personal data when you visit hushflow.co (including when you arrive from one of our ads), contact us, submit a form, or book a call with us. We keep it plain and specific: what we collect, why, who we work with, which cookies we use, and the rights you have.
Hushflow ("Hushflow", "we", "us") is the trading name of HUSHFLOW LTD, a private limited company registered in England and Wales (company number 17442822), registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We build automation and AI systems for service businesses. HUSHFLOW LTD is the data controller responsible for the personal data described in this policy.
If you have any questions about this policy or your data, contact us at hello@hushflow.co.
Information you give us. When you fill in a form on our site, request a call or a price estimate, complete our pre-call brief or a client questionnaire, or email us, you may provide:
We also note the language of the page you used and which button you clicked to open the form.
Scheduling data. When you book a call, our scheduling provider (Calendly) collects your name, email, chosen time, time zone and any answers to its booking questions (such as your company and phone number), and shares them with us. If you cancel or move the call, we receive that too, with any reason you give. On some of our pages the calendar opens inside the page, with the name and email you have just entered already filled in.
Advertising and campaign data. If you come to our site from an ad or from a link with campaign tags, the page address can contain UTM tags (which campaign, ad group and keyword brought you) and a Google ad click ID (gclid, gbraid or wbraid). When you send us a form, we receive these with it, together with the version of the page you saw, the address you arrived at and the page you came from. If you book a call, the UTM tags are passed to Calendly with your booking.
Your cookie choices. We store which kinds of cookies you allowed and when you chose, in a cookie in your browser (see section 6). We may also note with your enquiry whether you had allowed advertising cookies at that moment, so that we only report it to Google Ads if you had.
Information we collect automatically. When you use our website, our hosting provider processes technical data such as your IP address, device and browser type to deliver and protect the site. If you allow it in our cookie settings, our analytics and advertising providers also collect usage data such as your approximate location, pages viewed, referring links, which ad brought you, and how you interact with the pages (see section 6).
Messages. When you write to us or reply to our messages on WhatsApp, Telegram or by email, we keep the conversation and the delivery status of our messages, so we can answer you and never write again after you ask us to stop.
Call recordings. We may record and transcribe video calls with you, using Fireflies, to prepare a summary and the next steps. If you do not want the call to be recorded, tell us at the start of the call.
| Purpose | Legal basis (GDPR) |
|---|---|
| Respond to your enquiry, send the price estimate you asked for, arrange and prepare for a call (including the pre-call brief and questionnaires), and provide our services | Steps taken at your request before a contract / performance of a contract, and our legitimate interest in answering you |
| Send you follow-up messages and information related to your enquiry | Legitimate interest, or your consent where required |
| Send you news about our services, special offers and events by WhatsApp, Telegram or email (see section 12) | Your consent, or our legitimate interest where the law allows it |
| Sort replies to our messages with the help of an AI service, so the right person answers you quickly | Legitimate interest |
| Record and transcribe calls to prepare a summary and the next steps | Legitimate interest |
| Know which campaign, ad and page version brought your enquiry (from the campaign data sent with your form), so we can decide where to spend our advertising budget | Legitimate interest |
| Measure our ads with Google Ads and Meta: count the visits, enquiries and booked calls that come from them, and report an enquiry or booked call back to Google Ads using its ad click ID. Google and Meta may also use this data to deliver and personalise ads, as their own policies describe | Your consent ("Advertising" in cookie settings) |
| Understand how the site is used through analytics (Google Analytics, Hotjar) | Your consent ("Analytics" in cookie settings) |
| Remember your cookie choices | Legal obligation, and our legitimate interest in respecting your choice |
| Operate, secure and improve our website | Legitimate interest |
| Comply with legal obligations and protect our rights | Legal obligation / legitimate interest |
If we start using Google's enhanced conversions, we will also send Google a hashed (one-way coded) copy of your email address with a reported enquiry, and only if you allowed advertising cookies. The events our site sends to analytics and advertising tools do not include the answers you type into our forms.
We do not sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects on you.
We share personal data only with service providers who help us run our business, and only as far as needed. Most of them process data on our behalf under agreements that require them to protect it. Google (for Google Ads), Meta and Calendly (for its own cookies) also use some of the data they receive for their own purposes, as separate controllers under their own privacy policies; for the Meta Pixel, Meta and we are jointly responsible for collecting the data on our site and sending it to Meta.
| Provider | What they do |
|---|---|
| Airtable | Stores our contact and lead records: your name, email, phone, website, language, call booking details and the answers you give in our brief and questionnaires |
| Telegram | Internal notifications to our team about new enquiries, bookings and briefs, with the details you sent (including the campaign data that came with a form and any files attached to a questionnaire) |
| Calendly | Call scheduling; on some pages the booking calendar opens inside our page |
| Google (Analytics & Tag Manager) | Website analytics, only with your consent, and loading of our analytics and advertising tags |
| Google Ads | Measures which of our ads lead to visits, enquiries and booked calls, only with your consent |
| Hotjar | Heatmaps and recordings of how visitors scroll and click on our pages, with the text you type into form fields hidden, only with your consent |
| Meta (Facebook, Instagram, WhatsApp) | Lead forms in our ads, delivery of WhatsApp messages, and the Meta Pixel, which measures our Facebook and Instagram ads, only with your consent |
| Cloudflare | Website hosting, delivery and security, and the processing of our forms on their way to our records |
| Wazzup (SIA Wazzup, Latvia) | WhatsApp and Telegram messaging with you |
| Google Workspace | Our email |
| Anthropic | AI service that helps us sort replies to our messages |
| Make | Moves enquiries from our Facebook and Instagram forms into our records |
| Fireflies | Records and transcribes calls and prepares a summary |
We may also disclose data if required by law, to enforce our terms, or to protect the rights, safety and property of Hushflow or others. If our business is ever transferred or reorganised, personal data may be transferred as part of that process.
We serve clients and visitors worldwide, and some of the providers above are located outside the UK and the EEA, including in the United States. Some, such as Hotjar and Wazzup, are based in the EU. When personal data is transferred across borders, we rely on appropriate safeguards, so your data stays protected wherever it is processed:
Transfers between the UK and the EEA rely on the adequacy decisions the two have granted each other. You can ask us which safeguard applies to a particular provider.
Cookies are small files that a website stores in your browser. We also use similar storage in your browser (local storage and session storage). Some of these are necessary for the site to work. The others are used only if you allow them. We do not use cookies to personalise the site.
Your choice. On your first visit, a bar at the bottom of the page asks for your consent. "Accept all" and "Reject all" are equal choices, and "Settings" lets you switch Analytics and Advertising on separately; both are off until you switch them on. Until you choose, only necessary cookies are used. We save your choice for 180 days in the hf_consent cookie and then ask again, or sooner if we add a new kind of cookie. Your choice is stored only in your browser: we do not keep a log of it on our servers, so if you clear your cookies or use another browser, we will ask again.
Changing your mind. You can change or withdraw your consent at any time with the "Cookie settings" link at the bottom of every page, or open cookie settings here. When you switch a category off, we delete its cookies on hushflow.co (_ga, _hj…, _gcl_…, _fbp, _fbc), and its tags stop from the next page you open.
Categories.
Google Consent Mode. Before any Google tag runs, our site tells Google that analytics and advertising storage are refused, and changes this only when you allow it. While a category is refused, Google's tags do not set or read cookies for it. They may still send Google limited signals without cookies, such as that a page was viewed, your consent choice and basic technical data. While advertising is refused, we ask Google to remove ad click identifiers from these signals, and the ad click ID can be carried from page to page of our site in the page address instead of a cookie. It is then used only if you allow advertising later in your visit, or if you send us a form (see section 2).
| Name | Provider | Purpose | Category | Lifetime |
|---|---|---|---|---|
| hf_consent (cookie, with a copy in local storage) | Hushflow | Remembers which kinds of cookies you allowed and when you chose. It contains no identifier that tells you apart from other visitors | Necessary | 180 days |
| hf_brief_id (session storage) | Hushflow | Carries the name and email you just entered in a form to the pre-call brief, so you do not have to type them again | Necessary | Until you close the tab |
| hf-q-… (local storage) | Hushflow | Keeps your unsent answers to a client questionnaire on your device, so they are not lost if you leave the page | Necessary | Until you send the answers or clear your browser data |
| _ga, _ga_… | Google Analytics | Keep a random ID for your browser and the state of your visit, to count visitors, visits, pages viewed and clicks | Analytics | Up to 2 years |
| _hjSessionUser_… | Hotjar | Keeps a random ID, so that later visits from the same browser are linked together | Analytics | 1 year |
| _hjSession_… and other _hj… cookies | Hotjar | Keep the current visit together and check that the browser supports Hotjar | Analytics | Up to 30 minutes, or the session |
| hf_zoho_booked (session storage) | Hushflow | Makes sure a booked call is counted only once in our measurement | Analytics or Advertising (stored only if you allowed either) | Until you close the tab |
| _gcl_au | Google Ads | Links visits and enquiries to our Google ads | Advertising | 90 days |
| _gcl_aw, _gcl_gb | Google Ads | Remember the Google ad click that brought you (gclid, gbraid or wbraid) | Advertising | 90 days |
| _fbp | Meta | Recognises your browser to measure our Facebook and Instagram ads | Advertising | 90 days |
| _fbc | Meta | Remembers the Facebook or Instagram ad click that brought you | Advertising | 90 days |
| hf_zoho_attr (session storage) | Hushflow | Keeps the campaign tags and ad click ID from the address you arrived at, so they reach us with your enquiry even if you reload the page | Advertising | Until you close the tab |
Lifetimes of Google, Hotjar and Meta cookies are set by those providers and may change. When the booking calendar opens inside our page, it is loaded from calendly.com, and Calendly may use its own cookies and show its own cookie notice in it (see Calendly's privacy notice). Google explains how it uses data from sites that use its services here, and Meta in its privacy policy.
You can also control or delete cookies through your browser settings, and you can opt out of Google Analytics using Google's opt-out browser add-on. Blocking necessary cookies may affect how the site works.
We keep personal data only as long as we need it for the purposes in this policy, unless a longer period is required by law:
You can ask us to delete your data at any time (see section 8).
Depending on where you live, you have rights over your personal data. Under the EU/UK GDPR these include the right to:
To exercise any of these rights, email us at hello@hushflow.co. We will respond within the timeframe required by applicable law.
If you are in the EU/EEA: you have the right to lodge a complaint with your local data protection authority. In Spain, this is the Agencia Española de Protección de Datos (www.aepd.es).
If you are in the UK: you have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).
If you are in California or another region with its own privacy law: you may have the right to know what personal data we collect, request its correction or deletion, opt out of the "sale" or "sharing" of your personal data, and not be discriminated against for exercising your rights. We do not sell your personal data. If you allow advertising cookies, Google and Meta receive data about your visit through their tags to measure our ads, and under California law this may count as "sharing" for cross-context behavioural advertising. You can opt out at any time with "Reject all", or by switching off Advertising in "Cookie settings". For any other request, contact us at the same address.
We take reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and we work with reputable providers who do the same. No method of transmission or storage is completely secure, but we act quickly if we identify a risk.
Our website and services are intended for businesses and are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.
Our site may link to other websites, such as LinkedIn, Facebook or our scheduling tool. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.
HUSHFLOW LTD may send you messages about your enquiry, as well as news about our services, special offers and events, by WhatsApp, Telegram and email. We only write to people who contacted us or shared their contact details with us themselves, and we keep these messages rare.
You can unsubscribe at any time, free of charge: reply "STOP" to any message, or email hello@hushflow.co with the subject "Unsubscribe". After that we will not send you marketing messages on any channel. Messages about a service you have ordered from us are not affected.
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. For significant changes, we will take reasonable steps to let you know.
For any question about this policy or your personal data, email hello@hushflow.co.
