Flowsnix POS — App Privacy Policy

Who the app is for

Flowsnix POS is an internal tool for staff of businesses subscribing to the Flowsnix platform (car wash cashiers and workers). It is not used by end customers, and runs only on a device activated by the business, signed in with a staff account the business created.

Data the app processes

• Staff account data: name, mobile number or email, and role — for sign-in and permissions.
• Device activation data: a per-installation identifier and a server-issued activation token binding the device to a business and branch.
• Operational data: invoices, sales, shifts and worker commissions generated by using the POS.
• Business customer data entered by staff at the point of sale (name, mobile number, loyalty and package balances) — owned by the business, processed by the app on its behalf.

What the app does NOT collect

• No location data, and no location permission is requested.
• No camera, microphone, contacts, files or photos.
• No usage analytics, no crash reporting, and no tracking of any kind.
• No advertising identifiers, no ads, and no data shared for marketing purposes.
• No personal data is sold to anyone.

Permissions

The only permission the app declares for itself is internet access, to reach the service. Standard Google libraries additionally add network-state and wake-lock permissions; neither is used to collect personal data.

On-device storage

• The device activation token is stored encrypted in the Android Keystore using AES-256-GCM.
• Backup is fully disabled at the application level, so app data is not copied to cloud accounts outside the service.
• Deactivating the device or uninstalling the app clears the locally stored data.

Transmission and hosting

All data travels over an encrypted connection (HTTPS/TLS) to Google Cloud / Firebase and is processed in the europe-west1 region. The app never writes to the database directly; every change goes through server functions that verify permissions.

Sharing

• Google Cloud / Firebase as infrastructure provider (authentication, database, server functions).
• Authorities where a legal obligation exists.
• No sharing with third parties for their own purposes, and none for advertising.

Retention and deletion

Invoice and financial records are retained as Saudi regulations require (ZATCA — six years by default). To request deletion of a staff account or personal data, email admin@flowsnix.com or ask the business that created the account. Records the law requires us to retain cannot be deleted before their retention period ends.

Children

The app is a professional work tool, not directed at children under 18, and knowingly collects no data about children.

Your rights

Under the Saudi Personal Data Protection Law (PDPL) you may request access to, correction of, or deletion of your data via the address above. This page supplements, and does not replace, the platform privacy policy.

Changes

This policy may be updated; the last-updated date appears at the top of this page.