Data Processing Information

1. Introduction

This Data Processing Information explains how Funded with Flow L.L.C. (Funded with Flow, the Platform, we, us) processes personal data in connection with our simulated prop-trading practice platform, and the role of the service providers we engage to help operate it.

This document supplements, and should be read together with, our Privacy Policy, our U.S. State Privacy Rights & Region-Specific Disclosures, and our Subprocessors list.

2. Roles of the Parties

For personal data we process about you, Funded with Flow acts as the business or controller — that is, we determine the purposes and means of the processing.

The service providers listed in our Subprocessors page act as service providers or processors on our behalf, processing personal data only to provide their services to us and in accordance with our instructions and applicable agreements. In some cases, a provider may act as an independent controller for limited purposes under its own terms; we encourage you to review the providers' own privacy practices.

3. Categories of Data Processed

Depending on how you use the Platform, we may process the following categories of personal data:

• Account and profile data (such as name and contact details);
• Authentication and session data;
• Trading activity and performance data within the simulated environment;
• Device and browser information;
• Cookies and similar technologies;
• AI support conversation logs;
• MCP/API access logs;
• Referral and attribution tracking data; and
• Payout and KYC information where applicable.

4. Purposes and Legal Bases

We process personal data for purposes including: providing and operating the Platform; authenticating users and securing accounts; running simulated trading, evaluations, and challenges; providing AI support and MCP/API access; processing payments and payouts; preventing fraud, abuse, and security incidents; complying with legal obligations; and improving the Platform.

Where a legal basis is required, we rely, as applicable, on: performance of a contract with you; our legitimate interests (such as security, fraud prevention, and service improvement); your consent where required (such as for certain cookies or communications); and compliance with legal obligations. The specific legal basis depends on the processing activity and your jurisdiction. [ATTORNEY REVIEW: confirm legal-basis mapping and applicability per jurisdiction.]

5. Service Providers and Subprocessors

We engage a limited set of service providers to help operate the Platform. These currently include providers for payment processing, content delivery and edge security, authentication, AI features, real-time market data, and transactional email.

For the current list and the purpose of each provider, see our Subprocessors page.

6. International Transfers

Our service providers may process personal data in the United States and other regions. As a result, your personal data may be transferred to, stored in, or accessed from countries other than your own, which may have different data-protection laws.

Where required, we seek to ensure that such transfers are subject to appropriate safeguards. [ATTORNEY REVIEW: confirm transfer mechanism(s) (e.g., Standard Contractual Clauses, applicable adequacy) and disclosures.]

7. Processor Obligations and Safeguards

Where we engage service providers to process personal data on our behalf, we seek to put in place arrangements requiring them to process personal data only for the purposes of providing their services, to maintain appropriate confidentiality and security measures, and to handle personal data consistently with applicable law. [ATTORNEY REVIEW: confirm data-processing agreements are executed with each provider and reflect required terms.]

8. Handling Data Requests

Depending on your jurisdiction, you may have rights regarding your personal data. We handle such requests as described in our Privacy Policy and our U.S. State Privacy Rights & Region-Specific Disclosures, including how to submit and verify a request. We may need to verify your identity before acting on a request.

9. Retention

We retain personal data for as long as reasonably necessary to provide the Platform, to fulfill the purposes described here, and to meet our legal, security, and compliance obligations, after which we take steps to delete or de-identify it. [ATTORNEY REVIEW: define specific retention periods or criteria per data category.]

10. Contact

For questions about how we process personal data, contact us at [email protected].