Privacy
Last updated: October 2026
What we collect
When you request a diagnostic or contact us, we collect what you type into the form: your name, email, business name, city, Instagram handle, optional phone number and your answers. Website inquiries also include your preferred design, business type, website goal and timing, plus any current website, existing system, budget or project notes you choose to share. We use these to discuss and scope your project. We also note which page or link brought you to the site.
Our fictional website demos do not send reservations, appointment requests or payments. The example Objects shopping bag uses your browser's session storage to remember sample products while you explore.
If you arrive from one of our ads, our one-page diagnostic form saves your salon's Instagram handle as soon as you enter it, with the link that brought you, even if you don't send the form. We use it only to see where the form loses people, and we don't email or message anyone who didn't send the form. If you ask for your diagnostic by Instagram DM, we send it from @heywinflow.
If you use our free Google review QR code tool, we collect your email, your Google review link, your salon name if you add it, your choice on the optional tips box and the time. Your logo is never uploaded: the stickers are made in your browser.
Our free Google review reply tool runs entirely in your browser. The review and names you type are not sent to us or stored.
How we use it
To prepare your diagnostic, reply to you and follow up about working together. If you tick the optional tips box on one of our forms, we also send occasional salon growth tips by email; we only send these to people who ticked it, and every email lets you unsubscribe. We look at your salon's public online presence (such as your Google profile, Instagram and booking page) to prepare the diagnostic.
What we don't do
We don't sell or rent your information. We don't add you to any mailing list unless you ticked the optional box. You can ask us to stop contacting you at any time and we will.
Analytics and cookies
We use two analytics tools to see which pages are useful and where visitors come from. Cloudflare Web Analytics counts visits without cookies. Google Analytics uses first-party cookies to measure visits, the pages you view and actions such as requesting a diagnostic or booking a call. We don't send Google your name, email or anything you type into our forms, and we don't use advertising cookies.
If you visit from the UK, the European Economic Area or Switzerland, Google Analytics cookies stay off unless you accept them in the banner. If you don't accept, your browser still sends Google basic signals without cookies (such as that a page was viewed), which can't be tied to you across visits. You can at any time. Anywhere else, you can opt out with Google's opt-out add-on or by blocking cookies for this site.
While you browse, your browser keeps a note of which link brought you here (in session storage, cleared when you close the tab) so we know where requests come from. Our forms use Cloudflare Turnstile to block spam.
Where it's stored
Submissions are stored in our business Google Workspace and handled only by the Winflow team.
Your choices
Email [email protected] to see, correct or delete what we hold about you.