Privacy Policy and Collection Notice

1. Our role

When a subscribing business uses SharkFlows to manage its customers, workers and contractors, that business normally determines why and how those records are used. DONOW LIMITED provides the software and processes those records on the business's instructions. We act as controller for account registration, subscriptions, security, support and product operations that we determine.

2. Data we collect

Depending on enabled features, we process company and account details, names, email addresses, phone numbers, service addresses, WhatsApp or app messages, quotations, approvals, work orders, photos, signatures, invoices, payment status, equipment or vehicle records, technical logs and work location when a worker explicitly enables an on-duty status. We do not ask users to enter passwords, complete card details or unnecessary identity numbers into free-text fields.

3. Purposes

We use data to verify and operate accounts, receive enquiries, create customer and asset records, prepare inspections and quotations, schedule and dispatch work, record arrival and evidence, obtain customer approval, record payment and invoices, support warranties, provide support, prevent abuse, respond to incidents and improve the service. We do not sell personal or Meta platform data to data brokers.

4. Meta and WhatsApp data

A customer business must initiate Meta-hosted Embedded Signup and authorise access to its own selected business and WhatsApp assets. SharkFlows uses the resulting identifiers, messages and authorised capabilities only to provide the inbox, customer matching, work-request creation, authorised replies and related support requested by that business. Unknown phone-number assets are quarantined rather than assigned to another tenant. Revoking or disconnecting the integration stops new access.

5. AI assistance

Businesses may enable AI to organise conversations, extract details, suggest candidate causes, draft options and flag missing information. AI output can be incomplete or inaccurate and is not a final diagnosis, price, parts-fitment, structural, electrical, braking or safety decision. Responsible personnel must review consequential outputs.

6. Service and marketing messages

Appointment, quotation, work-order, payment, warranty and safety notifications are service messages. Promotions and non-essential campaigns should be sent only with the appropriate choice or consent. Recipients can opt out of direct marketing without losing necessary service messages.

7. Worker location and call recording

Location should be collected only after notice and consent while the worker is online, assigned or performing work. The app provides an off-duty control. SharkFlows does not enable call recording by default; a business enabling a future recording provider must give an appropriate notice and configure access and retention.

8. Providers and international processing

We disclose data to providers only as needed for enabled services and apply contractual, access and technical safeguards. Processing may occur outside Hong Kong.

• • Vercel: application hosting and content delivery
• • Supabase: authentication, database and private file storage
• • Stripe: subscription and card-payment processing when enabled
• • Resend: transactional and service email when enabled
• • Meta: authorised WhatsApp messaging after a customer business connects its assets
• • Configured AI provider: assisted extraction, drafting and operational suggestions when enabled

9. Retention and deletion

Short-lived OTP, temporary suggestions and location records use shorter retention periods. Contracts, approvals, work orders, payments, warranties, disputes and security records may be retained for the period required by the business relationship and applicable obligations. When data is no longer needed, it is deleted, anonymised or restricted.

10. Security and incidents

Controls include encrypted transport, tenant scoping, server-enforced roles, private storage, protected secrets, signed webhooks, expiring public tokens, rate limiting and audit records. No online service can promise zero risk. We investigate, contain, document and remediate incidents and provide notifications where required.

11. Your choices and contact

You may request access, correction, export, marketing opt-out or deletion through the Data Choices and Account Deletion page. We verify identity through an existing account email or phone before disclosing or deleting records. Questions may be sent to admin@sharkflows.com.