Do Not Sell or Share
My Personal Information

01The short version

• We do not sell personal information for money or other valuable consideration.
• We do not provide personal information to data brokers.
• We do share limited website data with one third party (Meta Platforms, Inc.) for the specific purpose of measuring the effectiveness of advertising campaigns we run on Facebook and Instagram. This sharing meets the CPRA's definition of "sharing for cross-context behavioral advertising."
• The data shared with Meta includes hashed contact identifiers (email addresses cryptographically hashed before transmission), cookie identifiers, IP addresses, and page interaction data such as form submissions. Plaintext email addresses are never transmitted.
• We do not share data with any other advertising network, data broker, or third-party advertising tracker.
• You can opt out at any time. The fastest method is the Global Privacy Control signal — see Section 05 for full instructions, including how to enable GPC in your browser and how to submit a written request.

02What this page is

Under the CPRA and similar laws (including the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and several others), consumers have the right to opt out of the sale or sharing of their personal information. Businesses subject to those laws must:

• Provide a clearly labeled "Do Not Sell or Share My Personal Information" link in their website footer
• Allow consumers to submit an opt-out request through that link
• Honor the request within the law's required timeframe
• Honor Global Privacy Control (GPC) signals where applicable as opt-out preference signals

This page is our compliance with those requirements. We've tried to make it useful rather than just legalistic — if you actually want to opt out, Section 05 explains every method available to you, in order of speed.

03What "sell" and "share" mean here

"Sell"

Under the CCPA/CPRA, "sell" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information to a third party for monetary or other valuable consideration. It's a broader definition than the everyday meaning of "sell." We do not sell personal information under this definition.

"Share"

"Share" under the CPRA specifically means sharing personal information with a third party for cross-context behavioral advertising — meaning targeted advertising based on personal information obtained from the consumer's activity across businesses or services other than your own.

We do share personal information under this definition, but only with one specific provider (Meta Platforms, Inc.) for one specific purpose (measuring the effectiveness of our advertising campaigns on Meta's platforms). See Section 04 for the scope and details.

What's not "selling" or "sharing"

The following activities are not sales or sharing under the CPRA:

• Disclosing personal information to service providers (like our hosting provider, payment processor, or email tool) that process the data on our behalf under contractual restrictions — see our Subprocessors page for the list
• Disclosing information at the consumer's direction (for example, when you ask us to integrate with your CRM)
• Disclosing information to comply with legal obligations
• Transferring information as part of a business merger, acquisition, or asset sale (with appropriate notice to affected consumers)
• Web analytics performed by Google Analytics 4, which we have configured for measurement only and have not enabled for data sharing with Google's broader advertising products

None of these are sales or sharing. They're disclosed in our Privacy Policy for transparency.

04What we share and why

HighFlowAI shares personal information with one third party for advertising measurement purposes:

Meta Platforms, Inc.

We use the Meta Pixel and Conversion API to measure the effectiveness of paid advertising campaigns we run on Meta's platforms (Facebook, Instagram). This sharing allows us to understand which ads bring people to our site, which campaigns generate contact form submissions, and how to allocate our advertising budget effectively.

Categories of data shared:

• Identifiers — hashed email addresses (SHA-256 hashed in your browser before transmission, so plaintext email is never sent), browser cookie identifiers, IP addresses
• Internet activity — pages visited, page interactions, and conversion events such as contact form submissions
• A unique event identifier per conversion, used to deduplicate measurement signals between browser-side and server-side tracking

Purpose: Advertising attribution and conversion measurement only. We do not use this data to build behavioral profiles for retargeting, do not export it to other advertising networks, and do not allow Meta to use it for purposes beyond measuring our campaigns. The data is subject to Meta's own privacy practices once received; see Meta's Privacy Policy for how they handle it on their side.

Legal characterisation: Under the CPRA, this transmission constitutes "sharing for cross-context behavioral advertising." Under similar state laws (Colorado, Connecticut, Virginia, and others) it falls within those laws' "targeted advertising" opt-out rights. You have the right to opt out — see Section 05.

What we don't do

• We do not sell personal information for any kind of consideration.
• We do not share personal information with any third party for cross-context behavioral advertising other than the Meta sharing described above.
• We do not participate in advertising exchanges, lookalike audience marketplaces, or third-party data marketplaces.
• We do not allow third-party advertising trackers from networks other than Meta on this Site.
• We do not make personal information available to data brokers.
• We have not knowingly shared the personal information of consumers under 16 years of age.

05Opt out

You have three ways to opt out of the sharing described in Section 04. The browser signal method is the fastest and most reliable — it takes effect immediately and applies to every subsequent visit while the signal is sent.

1. Browser signal (fastest, recommended)

If your browser sends a Global Privacy Control (GPC) signal, we treat that as a valid opt-out preference under California, Colorado, Connecticut and other state laws that recognise it. When we detect a GPC signal:

• No data is transmitted to Meta (Pixel or Conversion API) from your visit
• No data is transmitted to Google Analytics from your visit
• No advertising attribution cookies are set
• The opt-out applies for the duration of your current visit and every subsequent visit while GPC remains enabled

You don't need to also send us a written request — the GPC signal is enough on its own. If you're already visiting this page with GPC enabled, you're already opted out; no further action is needed.

How to enable GPC:

• Brave — enabled by default. Confirm at brave://settings/shields
• Firefox — enabled by default in private windows; can be turned on globally at about:config by setting privacy.globalprivacycontrol.enabled to true
• DuckDuckGo browser — enabled by default
• Chrome — install the official Global Privacy Control extension
• Edge — same Chrome extension works
• Safari — install a privacy extension that supports GPC, such as DuckDuckGo Privacy Essentials

2. By email

Send an email to privacy@highflowai.com with the subject line "Do Not Sell or Share Request." In the body, please include:

• Your full name
• The email address you've used to interact with us (if any)
• The state or country of residence relevant to your request
• A short note confirming you'd like to opt out of advertising-measurement sharing

A written opt-out will be recorded against the contact details you provide. Note that because most of our advertising-measurement data is identified by browser cookie rather than email, the most effective opt-out remains enabling GPC in the browsers you use to visit our site — written requests are honoured but cannot retroactively stop transmission that occurred before the request was processed.

3. By phone

Call +1 (832) 924-7478 and leave a message indicating you'd like to submit a Do Not Sell or Share request. Include your name and a callback email or phone number.

Authorized agents

You may designate an authorized agent to make a request on your behalf. The agent must provide written authorization signed by you, and we may require you to verify your identity directly. Without verification, we cannot process the request.

Verification

For written and phone requests, our standard verification is matching the contact details you provide against information we hold. For requests requiring stronger verification (such as deletion of all data we hold about you), we may ask for additional confirming information. GPC signal-based opt-outs do not require verification — the signal itself is the request.

No discrimination

Submitting an opt-out request — by any method — will never affect the price, quality, or availability of any service we provide to you. We will not penalise you in any way for exercising any of your privacy rights.

06What happens after you submit

For GPC signal opt-outs

The opt-out is immediate. Our website detects the GPC signal at the moment your browser requests the page and prevents any data from being transmitted to Meta or Google Analytics for the duration of that visit. The opt-out re-applies on every subsequent visit while GPC remains enabled in your browser — there's nothing further you need to do.

For written or phone requests

1. We acknowledge your request within 10 business days of receipt, confirming we've received it.
2. We process the request within 15 business days for opt-out requests, or up to 45 days (extendable once where reasonably necessary) for broader access/deletion requests as required under California law.
3. We confirm the outcome in writing by email. For Do Not Sell or Share requests, we'll record your opt-out preference against the contact details you've provided and ensure any future direct-from-us interactions (such as email campaigns) respect that preference.
4. We retain a record of the request for 24 months as required under California regulations.

For maximum effectiveness in stopping advertising-measurement sharing across all your visits, enabling GPC in the browsers you use is more reliable than a one-time written request, because most of the sharing we describe is keyed to browser cookies rather than identifiable email addresses. We honour both methods.

07Your other privacy rights

The "Do Not Sell or Share" right is one of several privacy rights you have. Others include:

• Right to know — what personal information we collect, why, and who we share it with
• Right to access — request a copy of the personal information we hold about you
• Right to correct — fix inaccurate information
• Right to delete — request deletion of your personal information
• Right to portability — receive your data in a portable, machine-readable format
• Right to limit use of sensitive personal information (we don't collect any sensitive personal information as defined under the CPRA)
• Right to opt out of profiling for decisions producing legal or similarly significant effects (we don't engage in such profiling)

To exercise any of these rights, see our Privacy Policy, Section 09.

If you're an Australian resident, your rights are governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. See our Privacy Policy, Section 12 — Australian residents for the specifics.

08Contact us

Questions about this page, your request, or our privacy practices generally: