Data processing and sub-processors

For customer, worker and end-customer records entered by a subscribing business, that business normally determines the purpose and means of processing. DONOW LIMITED provides the SharkFlows software and processes those records to deliver the contracted service, subject to instructions, product settings and legal obligations.

A customer business initiates Meta-hosted Embedded Signup, sees the requested assets and permissions, and grants access to its own business assets. SharkFlows uses received messages and business identifiers to provide the inbox, customer matching, work-request creation, authorised replies and support requested by that business.

Only data needed for the enabled workflow should be collected. AI features receive the minimum useful conversation context. Card and bank credentials remain with payment providers. Identity documents are private and restricted to authorised review.

Depending on enabled features, service providers may include Vercel for application hosting, Supabase for authentication/database/storage, Stripe for payments, Resend for service email, Meta for authorised messaging, Sentry for error monitoring and a configured AI provider for assisted summaries. Features that are not configured do not cause data to be sent to that provider.

Account and operational records are retained while the service is active and as needed for contracts, payments, warranties, disputes, security and applicable record-keeping duties. Customers can request export, correction or deletion. Revoking an integration stops new access; existing records are handled under the retention policy rather than silently erased where a lawful business record must remain.

Cloud suppliers may process data outside Hong Kong. Appropriate contractual, access and security measures are used according to the supplier and service configuration. A customer requiring a signed data-processing addendum can contact DONOW LIMITED before production onboarding.