Privacy Policy and Collection Notice

1. Our role

When a subscribing business uses SharkFlows to manage its customers, workers and contractors, that business normally determines why and how those records are used. DONOW LIMITED provides the software and processes those records on the business's instructions. We act as controller for account registration, subscriptions, security, support and product operations that we determine.

2. Data we collect

Depending on enabled features, we process company and account details, names, email addresses, phone numbers, service addresses, WhatsApp or app messages, quotations, approvals, work orders, photos, signatures, invoices, payment status, HVAC equipment records, technical logs and work location when a worker explicitly enables an on-duty status. We do not ask users to enter passwords, complete card details or unnecessary identity numbers into free-text fields.

3. Purposes

We use data to verify and operate accounts, receive enquiries, create customer and asset records, prepare inspections and quotations, schedule and dispatch work, record arrival and evidence, obtain customer approval, record payment and invoices, support warranties, provide support, prevent abuse, respond to incidents and improve the service. We do not sell personal or Meta platform data to data brokers.

4. Meta and WhatsApp data

A customer business must initiate Meta-hosted Embedded Signup and authorise access to its own selected business and WhatsApp assets. SharkFlows uses the resulting identifiers, messages and authorised capabilities only to provide the inbox, customer matching, work-request creation, authorised replies and related support requested by that business. Unknown phone-number assets are quarantined rather than assigned to another tenant. Revoking or disconnecting the integration stops new access.

Optional Meta channels: supplementary notice, 24 September 2026

A business may separately authorise Facebook Page Messenger, an Instagram professional account or Threads. For enabled and authorised features, we process account, Page and user identifiers, usernames, granted permissions and access tokens stored in encrypted form. Messenger and Instagram messages and attachments support that business's inbox and enquiry replies.

Threads features read public posts owned by the connected account and public replies to those posts. They do not provide a Threads private-message inbox, save retrieved posts or replies as private conversations, or automatically create or merge customer records. Each public reply requires confirmation by an authorised person. We retain confirmed reply text, related identifiers and execution results for traceability and duplicate prevention. A wa.me link in a reply lets the recipient voluntarily open WhatsApp; clicking it does not cause SharkFlows to send a WhatsApp message automatically.

Businesses can disconnect an account in SharkFlows and revoke authorisation in the relevant Meta account settings. The access, retention and deletion provisions of this policy also apply to these records. This notice does not indicate platform approval or availability to every business.

5. AI assistance

Businesses may enable AI to organise conversations, extract details, suggest candidate causes, draft options and flag missing information. AI output can be incomplete or inaccurate and is not a final diagnosis, price, parts-fitment, structural, electrical, braking or safety decision. Responsible personnel must review consequential outputs.

6. Service and marketing messages

Appointment, quotation, work-order, payment, warranty and safety notifications are service messages. Promotions and non-essential campaigns should be sent only with the appropriate choice or consent. Recipients can opt out of direct marketing without losing necessary service messages.

7. Worker location and call recording

Location should be collected only after notice and consent while the worker is online, assigned or performing work. The app provides an off-duty control. SharkFlows does not enable call recording by default; a business enabling a future recording provider must give an appropriate notice and configure access and retention.

8. Providers and international processing

We disclose data to providers only as needed for enabled services and apply contractual, access and technical safeguards. Processing may occur outside Hong Kong.

• • Vercel: application hosting and content delivery
• • Supabase: authentication, database and private file storage
• • Stripe: subscription and card-payment processing when enabled
• • Resend: transactional and service email when enabled
• • Meta: authorised WhatsApp messaging after a customer business connects its assets
• • DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.): text and image understanding, enquiry extraction, reply drafting and operational suggestions when AI features are enabled
• • Alibaba Cloud Model Studio (Qwen ASR): voice-message transcription when enabled, using a Singapore endpoint

AI service update, 24 September 2026: When the relevant features are enabled, DeepSeek receives selected enquiry text, related conversation or service context and images. This content may include customer names, phone numbers or addresses. Alibaba Cloud receives audio selected for transcription, and the resulting text may also be used in subsequent DeepSeek analysis. Please avoid submitting personal information unrelated to the service.

DeepSeek's published privacy policy identifies China as a processing and storage location. Its Open Platform Terms also explain that this general policy does not cover the full processing rules for end users of developers' downstream applications; it is therefore not an API-specific residency or retention commitment for this service. Our Alibaba Cloud transcription configuration currently uses a Singapore endpoint. The inference location depends on the specific model and the provider's deployment scope. These AI features do not guarantee that all data is processed only in Hong Kong.

9. Retention and deletion

Short-lived OTP, temporary suggestions and location records use shorter retention periods. Contracts, approvals, work orders, payments, warranties, disputes and security records may be retained for the period required by the business relationship and applicable obligations. When data is no longer needed, it is deleted, anonymised or restricted.

10. Security and incidents

Controls include encrypted transport, tenant scoping, server-enforced roles, private storage, protected secrets, signed webhooks, expiring public tokens, rate limiting and audit records. No online service can promise zero risk. We investigate, contain, document and remediate incidents and provide notifications where required.

11. Your choices and contact

You may request access, correction, export, marketing opt-out or deletion through the Data Choices and Account Deletion page. We verify identity through an existing account email or phone before disclosing or deleting records. Questions may be sent to admin@sharkflows.com.hk.