Privacy

What we hold, and how to
make us stop holding it.

Last updated August 2026.

---

Where your address came from

If we wrote to you without being asked, we found the address in a public place — a company website, a business directory, an industry listing, a public professional profile — and we wrote to a work address about work.

We have not bought a list, and we do not intend to. If you would like to know exactly where a particular address came from, ask and we will tell you.

What we hold

For somebody we have contacted but who is not a customer, that is:

• a business email address, and usually a name and a company;
• where it was found;
• what we sent, and when;
• whether it opened or was replied to.

If you unsubscribe we also record the address, the time, and the IP address the request came from — the last only so that a flood of forged requests would be visible. It is used for nothing else.

How to make it stop

Use the unsubscribe page. It takes one request, needs no reply, and removes the address from every list we hold including any campaign already scheduled.

We keep the address on a suppression list rather than deleting it, and that distinction matters: a deleted address can be re-added by the next import, and a suppressed one cannot. If you would rather it were erased outright, say so and we will, accepting that we then have no way to recognise it if it appears again.

Who else sees it

Our email provider, in order to deliver the message. Nobody else. We do not sell, rent, or share contact details, and there is no advertising network on this site — no analytics, no tag manager, no third-party script beyond the web font.

How long we keep it

Contact details for somebody who has not replied are removed within twelve months. Suppression entries are kept indefinitely, because that is what makes them work. Customer records are governed by the agreement with that customer and by the tax law that requires an invoice to survive.

Your rights

Under India's Digital Personal Data Protection Act 2023 — and, where it applies, the UK and EU GDPR — you may ask what we hold about you, have it corrected, have it erased, and object to us using it. Write to hello@rosflow.info and we will answer within thirty days. There is no charge and you do not need to give a reason.

If we have not dealt with you properly you may complain to the Data Protection Board of India, or to your own supervisory authority if you are in the UK or the EU.

Cookies

This site sets none. Your choice of light or dark theme is kept in your own browser's local storage and never sent to us.

Who is accountable

This notice describes what we actually do. It is not legal advice, and it has not been reviewed by a lawyer — if you are relying on it commercially, have one read it.