Privacy Policy

1. Introduction

Fast Flow Management, trading as Data Form Solution ("we", "us", "our"), operates the Data Form Solution platform (dataformsolution.com). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and what rights you have in relation to it.

This policy applies to all users of our platform and our mobile apps (DFS Companion and DFS Health), including Brand Partners and their customers, regardless of location. We have designed this policy to comply with applicable data protection laws including the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA) in the United States, the Act on the Protection of Personal Information (APPI) in Japan, and the Australian Privacy Principles (APPs).

2. Information We Collect

2.1 Information You Provide

• Account information: First name, last name, email address, mobile phone number, and username when you register as a Brand Partner.
• Order information: Name, email, phone number, date of birth, shipping address, product selections, and subscription preferences submitted through order forms.
• Payment information: Subscription payments are processed by Stripe, our third-party payment processor. For product orders, billing details (card number, card holder name, expiry date, and CVV) submitted via order forms are stored using strong encryption (AES-256) and are held for a maximum of 24 hours only. After that period, all sensitive billing information is permanently and irreversibly deleted from our database. We do not retain payment card details beyond this 24-hour window under any circumstances.
• Communication preferences: Your separate opt-in choices for email notifications and SMS notifications. Email and SMS consent are captured independently — opting in to one never enrolls you in the other. Standard message and data rates may apply to SMS, and you may reply STOP at any time to opt out.

2.2 Information Collected Automatically

• Session data: We use essential session cookies to maintain your login state and remember your display preferences (e.g., light/dark mode).
• Usage data: Basic server logs including IP address, browser type, and pages visited, used solely for security monitoring and service improvement.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your Brand Partner account
• Process and manage orders placed through the platform
• Share customer order data (including personal information, billing address, and payment details) with the Brand Partner associated with the order, so they can create a LifeWave account on the customer's behalf and process the product purchase
• Process subscription payments via Stripe
• Send order notifications via email and/or SMS based on your preferences
• Provide one-time login codes for passwordless authentication
• Provide customer support and respond to inquiries
• Maintain the security and integrity of the platform
• Monitor usage patterns (such as invite frequency and notification volume) to enforce our fair usage policy and prevent abuse
• Comply with legal obligations

4. Third-Party Service Providers

We share your information with the following trusted parties, solely for the purposes described:

4.1 Brand Partners (Order Data Sharing)

4.2 Third-Party Service Providers

• Stripe (stripe.com) — Payment processing for subscription fees. Stripe collects and processes payment card information in accordance with PCI-DSS standards. See Stripe's Privacy Policy.
• Twilio (twilio.com) — Delivery of SMS notifications. Phone numbers are shared with Twilio solely for message delivery. See Twilio's Privacy Policy.
• Postmark (postmarkapp.com) — Transactional email delivery for login codes and notifications.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

4.3 Mobile Numbers and SMS Consent

We do not share, sell, or provide your mobile phone number or your SMS consent to third parties or affiliates for marketing or promotional purposes. Your number is passed to our SMS provider (Twilio) only to deliver the text messages you agreed to receive: order invitations and links your LifeWave Brand Partner shares with you. Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help. See our SMS Messaging Terms.

5. Data Retention

We retain personal data only for as long as it is necessary to provide the service or to comply with a legal obligation. Specific retention periods:

• Account data: Retained for as long as your account is active. Upon account deletion, personal data is removed within 30 days, except where retention is required by law.
• Completed order data: Retained for the duration of the Brand Partner's account for operational, accounting, and tax-record purposes.
• Abandoned order data: If an order form is started but never submitted, the personal information you entered is automatically anonymized 90 days after the form was abandoned. After anonymization only non-identifying aggregate fields (currency, product selections, totals, brand-partner attribution) are kept for analytics; your name, email, phone, address, and date of birth are permanently and irreversibly removed.
• Sensitive billing details: Payment card information (card number, card holder name, expiry date, and CVV) is encrypted at rest and stored for no longer than 24 hours from the time of order submission. An automated process permanently deletes all billing details after this retention period. This data cannot be recovered once deleted.
• One-time login codes (OTP): Expire within 5 minutes and are invalidated after use or on a new code request.
• API session tokens (mobile app): Expire 60 days after issue. Tokens that have not been used for 30 days are also automatically revoked. You can review and revoke active sessions at any time from within the mobile application.
• Server logs: Standard request logs (IP address, user agent, request path) are retained for up to 30 days for security monitoring and abuse prevention, then rotated and discarded.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including encrypted connections (HTTPS/TLS), hashed authentication tokens, encryption of sensitive data at rest (AES-256), and strict access controls. Billing information is encrypted the moment it is submitted and is automatically purged from our systems within 24 hours — it is never stored in plain text. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Objection: Object to processing of your data in certain circumstances.

European Union Residents (GDPR)

You additionally have the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection authority. Our legal basis for processing is contractual necessity (to provide the service) and legitimate interest (to maintain platform security).

California Residents (CCPA)

You have the right to know what personal information is collected, the right to request deletion, and the right to non-discrimination for exercising your privacy rights. We do not sell personal information as defined under the CCPA.

Japan Residents (APPI)

You have the right to request disclosure, correction, or cessation of use of your personal information. We handle personal information in accordance with the Act on the Protection of Personal Information.

Australia & New Zealand Residents (APPs)

You have the right to access and correct your personal information under the Australian Privacy Principles and the New Zealand Privacy Act. You may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) or the New Zealand Privacy Commissioner.

8. Cookies

We use only essential cookies required for the functioning of the platform. These include session cookies for authentication and a preference cookie for your display theme (light/dark mode). We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

9. International Data Transfers

Your data may be processed in countries other than your own, including the United States (where Stripe and Twilio are headquartered). Where data is transferred internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent mechanisms, in compliance with applicable data protection laws.

10. Children's Privacy

Our platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a minor, we will take steps to delete it promptly.

11. The DFS Health App

DFS Health is our mobile app (iOS and Android) for the customers of LifeWave Brand Partners and for anyone else who wants to track their well-being. This section explains what DFS Health adds to the rest of this policy. Where it says something different, this section applies to DFS Health.

11.1 What the app collects

• Account: your email address, and the name, phone number and address you enter in your profile. If a Brand Partner already has you as a contact under the same email address, your account is linked to that contact.
• Health and wellness data:what you record in the tracker, such as your mood, scores for energy, sleep, stress, pain and well-being, weight, waist, water, exercise and your 30, 60 and 90-day check-ins, as well as your patch plan, patch placements, exercise plan and sessions and your daily ritual.
• Messages: the messages you exchange with your Brand Partner in the app, and the tracker summaries you choose to share with them.
• Orders: if you order products in the app, the same order and billing information as described in section 2.1, handled in the same way.
• Device information: a push-notification token for your phone, if you allow notifications, and the app version and operating system with each request.

DFS Health does not use your location, your contacts, Apple Health or Health Connect, and it contains no advertising and no third-party analytics or tracking. Face ID or fingerprint sign-in is handled by your phone; we never receive biometric data.

11.2 How we use it

• To show you your own tracker, progress, plans and reminders.
• To deliver messages between you and your Brand Partner, and plans they send you.
• To place orders you submit, as described in section 4.1.
• To send you sign-in codes by email and the notifications you allow.

We do not use your health and wellness data for advertising or marketing, we do not sell it, and we do not share it with LifeWave or any other third party.

11.3 What your Brand Partner sees

Your Brand Partner can see your contact details, your orders and the messages you exchange with them. They cannot see your tracker, scores, check-ins or plans. They only see the tracker summaries you choose to send them in a message. Your Brand Partner is an independent business and is responsible for how they handle what you share with them.

11.4 Legal basis for health data

Information about your health is a special category of personal data. We process it only with your explicit consent, which you give when you start using the tracker. You can withdraw your consent at any time by deleting your account; this does not affect processing that took place before you withdrew it. We process your other DFS Health data because it is necessary to provide the app to you.

11.5 Service providers

In addition to the providers in section 4.2, push notifications are delivered through Expo (expo.dev) and Apple's or Google's notification services. They receive only your device's push token and the text of the notification.

11.6 Retention and deletion

• Your tracker, plans, messages and app settings are kept while your account exists.
• Sign-in codes expire after 10 minutes. App sessions expire after 60 days.
• You can delete your account at any time in the app (Profile, then Delete account). This permanently deletes your tracker, plans, messages, sign-in sessions and push tokens straight away; it cannot be undone. Orders and your Brand Partner's own contact record are kept as described in section 5.

For step-by-step instructions, including how to request deletion without the app, seeDFS Health account deletion.

11.7 Age

DFS Health is intended for adults aged 18 and over, in line with section 10.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of any material changes via email or through a notice on the platform. Your continued use of the service after changes are posted constitutes acceptance of the revised policy.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a complaint, please contact us at:

Business name: Fast Flow Management (trading as Data Form Solution)
Email: [email protected]
Website: dataformsolution.com