Privacy Policy
Effective date: 10 October 2026 | Last updated: 10 October 2026
BulkGate SMS by VoxFlow (the "Service") is a HighLevel Marketplace application that connects a HighLevel sub-account to the subscriber's own BulkGate account for sending and receiving SMS. This Privacy Policy explains what personal data the Service handles, in which role, for how long, and what rights people have. It is written to comply with the UK GDPR and the EU GDPR (2016/679).
| Company name | Mindful Momentum Ltd, trading as VoxFlow |
| Registered address | Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom |
| Company number | 14864005 |
| Contact email | bulkgate@voxflow.hu |
| Trading name | VoxFlow (voxflow.hu) |
| Product name | BulkGate SMS by VoxFlow |
Processor. The business that installs the Service (the "Subscriber", usually an agency or its client) decides whom it messages and why. For the phone numbers, messages and opt-out status of the people it messages, the Subscriber is the data controller and we act as its data processor, under our Data Processing Addendum. If you received an SMS through the Service and want to exercise your rights, please contact the business that messaged you; we will help them respond.
Controller. For the Subscriber's own account data (which sub-account installed the Service, its access tokens and BulkGate API credentials) and for our technical logs, Mindful Momentum Ltd is the data controller.
| Data | What we keep | How long |
|---|---|---|
| Message content (text of outbound and inbound SMS) | Passed through between HighLevel and BulkGate. Not stored by the Service. | — |
| Message references | HighLevel and BulkGate message IDs and delivery status, used to report delivery back. No phone number, no text. | 400 days |
| Opt-out list | A keyed cryptographic hash (HMAC) of the phone number of each person who replied STOP (or an equivalent keyword), per sub-account, so that they are not messaged again. The number itself is not stored in this list. Also added when the Subscriber turns on SMS do-not-disturb for a contact; removed when the person replies START or the Subscriber turns do-not-disturb off. | Until the opt-out is lifted, or the Service is uninstalled from that sub-account |
| Opt-out history | When an opt-out or opt-in happened and through which channel (SMS keyword or the Subscriber's do-not-disturb setting), with the same hashed number. Kept so the Subscriber can show when consent was withdrawn. | Until the Service is uninstalled from that sub-account |
| Duplicate-protection keys | One-way hashes of incoming events, so a retried webhook is not processed twice. | 30 days |
| Pending delivery reports | A delivery report that arrived before its message reference; message ID and status only. | 7 days |
| Subscriber account data | HighLevel location and company IDs; OAuth tokens and the BulkGate Application ID and token, all encrypted at rest (Fernet). | Until uninstall |
| Technical logs | Request and error logs. Phone numbers are masked and access tokens removed before logging. | Kept by our hosting provider for a limited period, currently up to 30 days |
| Backups | A daily encrypted copy of the database above, for disaster recovery. | Each copy is deleted after 30 days |
Contact names and conversation history stay in the Subscriber's HighLevel account; the Service does not copy them.
| Purpose | Legal basis |
|---|---|
| Sending and receiving SMS, reporting delivery status (as processor) | On the Subscriber's documented instructions — GDPR Art. 28; the Subscriber determines its own legal basis |
| Honouring opt-outs (STOP) and opt-ins (START), and mirroring them to the contact's SMS do-not-disturb setting (as processor) | On the Subscriber's instructions, enabling it to meet its legal obligations to stop messaging people who object |
| Managing the installation and the Subscriber's credentials (as controller) | Performance of a contract — Art. 6(1)(b) |
| Security, abuse prevention, debugging, backups (as controller) | Legitimate interest — Art. 6(1)(f) |
When the Service is uninstalled from a sub-account, HighLevel notifies us and we immediately and permanently delete that sub-account's installation, encrypted credentials, message references and opt-out list. The agency-level access token is deleted once no sub-account of that agency has the Service installed. Backup copies containing the deleted data expire within 30 days.
Opt-outs are also recorded as SMS do-not-disturb on the contact in HighLevel and on the Subscriber's BulkGate blacklist; those records remain in the Subscriber's own accounts after uninstall.
| Sub-processor | Purpose | Data location |
|---|---|---|
| Railway Corp. | Application hosting and database | EU (Netherlands data centre); US company |
| Cloudflare, Inc. (R2) | Daily database backup | EU (EU-jurisdiction storage); US company |
The following platforms are chosen and contracted by the Subscriber, not by us. The Service only connects them, using the Subscriber's own accounts:
| Platform | Role | Location |
|---|---|---|
| HighLevel Inc. | The Subscriber's CRM and conversations inbox, where messages are written and read | USA |
| TOPefekt s.r.o. (BulkGate) | SMS delivery through the Subscriber's own BulkGate account | EU (Czech Republic) |
Our database and backups are stored in the EU. Railway and Cloudflare are US companies; any access from the USA is covered by the EU Standard Contractual Clauses (with the UK Addendum) and/or the EU–US Data Privacy Framework, as applicable to each provider. Data received from EU Subscribers by Mindful Momentum Ltd in the UK relies on the EU adequacy decision for the United Kingdom.
If a personal data breach affects data we process for a Subscriber, we notify that Subscriber without undue delay. For data we control, we notify the competent supervisory authority within 72 hours where required.
Under the UK GDPR and the EU GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data. If you received a message through the Service, the quickest way to stop further messages is to reply STOP. For other requests, contact the business that messaged you (the controller); you may also write to bulkgate@voxflow.hu and we will forward your request to it and assist. For data we control, we respond within one month.
The Service itself sets no cookies. Its setup page runs inside HighLevel, which applies its own cookie policy.
The Service is a business tool and is not directed at individuals under 16.
You may lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or with the data protection authority of the EU country where you live or work.
We will announce material changes on this page at least 15 days before they take effect. The "Last updated" date above shows the current version.