Flow Privacy Policy

Last Updated: September 8, 2026

FOL Management LLC and its affiliates (together, “Flow,” “we,” “us,” or “our”) respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, share, and handle your information when you use our websites, apps, products, and services, including our website at flow.life and its subdomains (the “Website”), our online store at shop.flow.life (the “Flow Store”), the Flow App (the “App”), our residential and short-term stay properties (together, “Flow Properties”), the Flow Trip subscription and related content, our events, promotions, and experiences, our co-living matching platform, the Flow Practice platform at flow.life/practice, and any other products or services we provide (collectively, the “Services”).

This Privacy Policy does not apply to Flow Practice's Notice of Privacy Practices issued under HIPAA, which is provided separately.

PERSONAL INFORMATION WE COLLECT

We collect personal information in several ways: directly from you, automatically when you interact with our Services, and from third-party sources. The categories and specific types of personal information we collect depend on how you interact with us.

Information We Collect from Tenant Applicants

When you apply for residency at a Flow Property, we collect:

• Identifiers and contact information, including your name, email address, phone number, and mailing address;

• Government-issued identification, including copies of your ID (from which we may derive your date of birth);

• Social Security Number (SSN), collected for background check and credit verification purposes and retained for potential eviction or collections proceedings;

• Passport information, collected for background check and credit verification purposes;

• If applicable, information relation to your dependents, including dependent name and date of birth;

• Financial and payment information, including income data and payment details for processing your application;

• Employment and professional information, used to verify your employment status and income;

• Gender, collected solely for our co-living roommate matching product, as permitted under applicable federal housing rules;

• Background check results, including criminal history, eviction history, and credit reports, obtained from third-party background check providers; and

• Profiles and inferences, including evaluations of your background and financial eligibility to facilitate approval determinations.

• Applicant data is managed within our app environment, encrypted at rest, and tied to a per-person encryption key.

Information We Collect from Residents (App Users)

Once you become a verified resident and use the Flow App, we may collect:

• Account and profile information, including your name, contact details, and profile data;
• Communications data, including in-app messages, message board posts, and communications with property staff (message boards are monitored by AI-powered moderation and human moderators for community safety);
• Maintenance request data, including tickets submitted and their status;
• Event and community participation data, including event RSVPs and attendance;
• Rent and payment history; and
• Co-living portal data, including your name, phone number, and social media handles, if you opt in to the co-living matching portal (this information may be visible to other participating residents).

Information We Collect from Site Shoppers and Hotel Guests

When you make purchases through the Flow Store or book hotel or short-term stays at Flow Properties, we collect:

• Identifiers and contact information, including your name, telephone number, physical address, and email address;
• Billing and payment information, processed via Stripe;
• Commercial information, including items placed in shopping carts, purchase history, and booking details (e-commerce on the Flow Store runs on Shopify, and hotel/short-term stay bookings run on Cloudbeds); and
• Audio and video recordings, captured by on-site surveillance systems at Flow Properties that record both audio and video footage throughout the properties for safety and security purposes.

Information We Collect from Job Applicants

When you apply for employment with Flow, we collect:

• Identifiers and contact information, including your name, email, phone number, and address;
• Professional and employment information, including your resume, work history, and URLs (e.g., LinkedIn);
• Education information, verified through Checkr;
• Internet activity data, including IP address and location data; and
• Information collected via cookies on our careers pages and through our Applicant Tracking System (Lever).

Information We Collect from General Website Visitors

When you visit our Website, we may collect:

• Identifiers, including your name, email (if voluntarily provided), and IP address;
• Internet and browsing activity, including pages visited, interaction data, and browsing behavior, collected through our proprietary API and third-party analytics and advertising platforms; and
• Approximate location information, derived from your IP address for analytics purposes.

Information We Collect from Individuals on Flow Properties

• If you are physically present at a Flow Property (as a resident, dependent of a resident, guest, visitor, or staff member), our on-site surveillance systems may capture audio and video footage throughout the properties. Access to surveillance footage is limited to IT personnel and relevant on-site building personnel on a need-to-know basis.

HOW WE USE YOUR PERSONAL INFORMATION

We use the personal information we collect for the following purposes:

• Housing and property management: To process and evaluate tenant applications, verify identity and financial eligibility, conduct background and credit checks, manage lease agreements, process rent payments, handle eviction and collections matters, and manage property operations.
• Providing and improving our Services: To operate, maintain, and improve our Website, App, Flow Store, hotel/short-term stay properties, events, and other Services; to facilitate community features such as message boards and event coordination; to process transactions; and to fulfill maintenance requests.
• Co-living matching: To match residents with compatible roommates based on survey responses and profile information.
• Loyalty and rewards programs: To administer our Drops program, including tracking event attendance, rent history, and eligibility for rent discounts, gift cards, and other perks.
• Membership program: To administer our membership program and analyze the use of member benefits, and redemption of discounts or promotional offers available through participating Flow businesses.
• Marketing and advertising: To market our products and services, personalize and dynamically modify website content, and update our marketing materials.
• Employment: To evaluate job applications, verify employment and education history, and manage the hiring process.
• Safety and security: To maintain the safety and security of our properties and communities, including through surveillance, AI-moderated content review, and user blocking capabilities.
• Legal compliance: To comply with applicable laws, including issuing FCRA adverse action notices, responding to legal process, and exercising or defending legal claims.
• Analytics: To understand usage patterns, conduct internal analyses, and improve our marketing efforts.

HOW WE DISCLOSE YOUR PERSONAL INFORMATION

We may disclose your personal information to the following categories of third parties for the purposes described below:

• Background checks and verification: We may share applicant information, including identifiers and other relevant data, with service providers to conduct background checks (such as criminal, eviction, and credit history) and to perform identity and income verification.
• Payment processing: We use third-party payment processing providers to facilitate transactions in connection with application processes, bookings, and purchases.
• Booking and reservation management: We use service providers to support booking management and reservation operations.
• Applicant tracking and HR services: We use service providers to manage job applicant data and to conduct employment and education verification.
• Collections and legal services: We may share personal information with collections agencies and legal service providers in connection with collections, evictions, or related proceedings.
• Analytics and advertising: We use analytics and advertising technologies to measure performance, understand user behavior, and support marketing and advertising activities.

We may also disclose your personal information in the following instances:

• In the event of a corporate reorganization: In the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or other disposition of all or any portion of our business, assets or stock, we would share personal information with third parties, including the buyer or target (and their agents and advisors) for the purpose of facilitating and completing the transaction. We will also share personal information with third parties if we undergo bankruptcy or liquidation, in the course of such proceedings.
• With Third Parties: We may need to disclose your personal information to third parties, such as legal advisors, law enforcement agencies, or governmental/regulatory bodies to protect our legal interests and other rights, protect against fraud or other illegal activities, prevent harm, for risk management purposes, and to comply with our legal obligations.
• For legal purposes: We share your personal information where we are legally required to do so, such as in response to court orders, law enforcement or legal process, including for national security purposes; to establish, protect, or exercise our legal rights, as required to enforce our terms of service or other contracts; to defend against legal claims or demands; to detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person; or to comply with the requirements of any applicable law.

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising as those terms are defined under applicable law. All disclosures are made for our own marketing, verification, and operational purposes. We use and disclose sensitive personal information only as reasonably necessary to perform our Services, including processing and verifying tenant applications and facilitating related housing purposes. We do not use or disclose sensitive personal information for purposes beyond what is reasonably necessary and expected.

COOKIES AND TRACKING TECHNOLOGIES

We use cookies, pixels, software development kits (SDKs), and similar tracking technologies on our Website and App, including:

• Persistent device identifiers: We may place a persistent cookie on your device to help recognize your device and understand usage over time.

• Advertising and marketing technologies: We use tracking technologies, like Google Ads and Meta Pixel, to support advertising, measure campaign effectiveness, and better understand user interactions.

• Analytics tools: We use analytics technologies, like Google Analytics, to collect information such as approximate location data and information about how users interact with our Website and App.

• Payment-related tools: We use payment processing technologies within the application process to facilitate transactions.

DATA RETENTION

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Personal information is generally retained unless and until a deletion request is received or a business need no longer exists, at which point we effectuate deletion by shredding the per-person encryption key associated with the individual's data.

DATA SECURITY

We implement and maintain reasonable security measures, such as access controls and encryption, to protect the personal information that we collect and maintain from unauthorized access, destruction, use, modification, or disclosure. However, no security measure or modality of data transmission is 100% secure, and we are unable to guarantee the absolute security of the personal information we have collected from you.

YOUR INFORMATION CHOICES

You have the following choices with respect to your personal information:

• Correct or View Your Information. You may access your account to correct or view certain personal information you have provided to us and which is associated with your account.
• Opt Out of Google Analytics. To prevent your data from being used by Google Analytics, you can download the Google Analytics opt-out browser, which can be accessed here.
• Opt Out of Google Ads. To opt out of targeted advertising by Google and this sharing, you can go to Google’s Ad Settings, or you can install the DoubleClick opt-out browser plugin.
• Opt Out of Meta Pixel. You can opt out of displaying Facebook ads and this sharing by visiting your Meta Ad Settings.
• Opt Out of Advertising Cookies. All session cookies are temporary and expire after you close your web browser. Persistent cookies can be removed by following your web browser’s directions. To find out how to see what cookies have been set on your computer or device, and how to reject and delete the cookies, please visit: https://www.aboutcookies.org Please note that each web browser is different. To find information relating to your browser, visit the browser developer’s website and mobile application. If you reset your web browser to refuse all cookies or to indicate when a cookie is being sent, some features of our website may not function properly. If you choose to opt out, we will place an "opt-out cookie" on your device. The "opt-out cookie" is browser specific and device specific and only lasts until cookies are cleared from your browser or device. The opt-out cookie will not work for essential cookies. If the cookie is removed or deleted, if you upgrade your browser or if you visit us from a different computer, you will need to return and update your preferences. By clicking on the “Opt-Out” links below, you will be directed to the respective third-party website where your computer will be scanned to determine who maintains cookies on you. At that time, you can either choose to opt out of all targeted advertising or you can choose to opt out of targeted advertising by selecting individual companies who maintain a cookie on your machine.
• Association of National Advertisers opt-out registration: https://dmachoice.thedma.org/
• Network Advertising Initiative (NAI) Opt-Out: https://www.networkadvertising.org/managing/opt_out.asp
• Digital Advertising Alliance (DAA) Opt-Out: https://optout.aboutads.info
• European Union (EU) /European Economic Area (EEA) Opt-Out: http://www.youronlinechoices.eu
• In general, you can also disable cookies by setting your browser to refuse cookies or indicate when a cookie is being sent.

• Opt Out of Marketing Communications. You may opt out of receiving marketing emails from us by clicking the “unsubscribe” link provided at the bottom of each email we send. Please note that we will continue to send you notifications necessary to the Services.

• Opt Out of Push Notifications. You may opt out of receiving marketing push notifications from us by updating the Settings on your mobile phone. Please note, we may still continue to send you notifications necessary to the Services.

RIGHTS FOR CALIFORNIA RESIDENTS

The following rights apply solely to California residents to the extent required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). To the extent any right described below does not apply to you under the CCPA or its implementing regulations, we are not obligated to honor such request. Subject to applicable law, California residents may:

• Request to know the categories and specific pieces of personal information we have collected, used, disclosed, or sold or shared about them;

• Request deletion of their personal information, subject to the exceptions permitted by applicable law;
• Request correction of inaccurate personal information we maintain about them;
• Opt out of the sale or sharing of personal information (note: we do not currently sell or share personal information as those terms are defined under the CCPA);
• Request to limit the use and disclosure of sensitive personal information to uses that are necessary to perform our Services, to the extent we use such information beyond what is permitted without a limitation request; and
• Not be discriminated against for exercising any of the foregoing rights.

How to Submit a Request

California residents (or their authorized agents) may submit a verifiable consumer request by contacting us using the information in the "Contact Us" section below. We will verify the requestor's identity in accordance with applicable law before processing any request. We will respond to a verifiable request within 45 days of receipt, unless an extension is permitted under the CCPA. If an authorized agent submits a request on your behalf, we may require written proof of the agent's authorization and may independently verify the consumer's identity.

Opt-Out Preference Signals

For California residents, and solely to the extent required by the CCPA and its implementing regulations, we will treat opt-out preference signals, such as Global Privacy Control ("GPC"), as valid requests to opt out of the sale or sharing of personal information. We are in the process of implementing technical recognition of GPC signals across our Services for users accessing them from California. This section does not extend opt-out preference signal obligations beyond what California law requires.

FINANCIAL INCENTIVE PROGRAMS

We offer the Drops loyalty program to current tenants at Flow Properties, which provides rent discounts, gift cards, and other services and perks (such as our coffee program) in connection with your tenancy. Participation in the Drops program involves our use of your rent payment history, event attendance records, and related participation data, which is shared with our internal Drops team to administer the program and determine eligibility for rewards. The Drops program is available exclusively to current tenants at a Flow Property. You may opt out of the Drops program at any time by contacting us. We have made a good-faith estimate that the value of your data in connection with the Drops program is reasonably related to the value of the discounts and rewards provided.

DO NOT SELL OR SHARE MY PERSONAL INFORMATION

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising. Because we do not engage in these practices, there is no need to opt out; however, if you have questions or concerns about our data practices, please contact us using the information below.

ADDITIONAL STATE LAW DISCLOSURES

Certain other U.S. state privacy laws may grant residents of those states’ rights with respect to their personal information. We will honor only those rights that are legally required of us under the specific state law that applies to you based on your state of residence. Nothing in this Privacy Policy is intended to confer rights beyond those required by applicable law. If you are a resident of a state with an applicable consumer privacy law, you may submit a request by contacting us using the information in the "Contact Us" section below. We will evaluate and respond to your request in accordance with, and only to the extent required by, the law of your state of residence.

CHILDREN’S PRIVACY

The Services are not intended for anyone under the age of thirteen (13). We do not knowingly collect the personal information of anyone under the age of thirteen (13). If we learn that we have collected or received personal information from individuals under the age of thirteen (13), we will delete their personal information. If you believe we have personal information on individuals under the age of thirteen (13), please contact us at the contact information provided below.

KINGDOM OF SAUDI ARABIA PRIVACY DISCLOSURES

The following additional provisions apply if you are located in the Kingdom of Saudi Arabia. Providing personal information directly to us is optional, but if you do not provide it, we may be unable to provide certain Services to you.

Legal basis. We process your personal information: to perform our contract with you; with your consent (including for marketing communications); to comply with our legal obligations; and for our legitimate interests, such as providing and improving the Services, responding to your inquiries, personalizing content and advertising, analyzing usage, and detecting and preventing fraud and illegal activity.

Your rights. Subject to applicable law, you may have the right to: access and receive a copy of your personal information; correct inaccurate or incomplete information; request deletion; restrict processing to storage only; object to processing, including for marketing (opt out at any time using the unsubscribe link in our communications); and withdraw consent at any time. Some of these rights apply only in certain circumstances and may be limited by law. To exercise them, contact [email protected]; we will respond within the timelines required by applicable law. You may also lodge a complaint with the data protection supervisory authority in your jurisdiction.

International data transfers. We store and process personal information in various jurisdictions, including the United States, and may share it with our affiliates and third-party service providers outside the country where it was collected, where privacy laws may be less stringent. We take the steps required by applicable law to keep transferred information secure, such as transferring to jurisdictions considered adequate for data protection purposes or putting in place standard contractual clauses.

Data retention. We retain your personal information as long as necessary to fulfill the purposes for which it was collected, protect our interests, maintain the integrity of our Services and operations, and comply with legal requirements.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated Privacy Policy on our Website and updating the "Last Updated" date above. We encourage you to review this Privacy Policy periodically.

CONTACT US

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

FOL Management LLC, Legal Department, [email protected], 1170 Kane Concourse Ste 300, Bay Harbor Islands, FL 33154

Individuals in the Kingdom of Saudi Arabia may alternatively contact us by written notice to Flow MENA Real Estate Management, 8730 Al Olaya 2779 Riyadh, Postal Code 12214.