Privacy policy

AppFlow serves two groups. Businesses use AppFlow to run bookings, payments and marketing. Their customers book and pay through a business's AppFlow-powered app or booking page. For most customer information, the business is the controller of that data and AppFlow acts as its service provider (processor). If you are a customer of a business that uses AppFlow, please also read that business's own privacy notice.

• Account information you provide, such as name, email, phone number, business name, role and login credentials.
• Business and client data you add to AppFlow, such as services, prices, schedules, staff, bookings, notes and details about your own customers.
• Payment information. Card payments and deposits are processed by our payment providers (Stripe and Square). We receive confirmation and limited details such as the last four digits and the amount; we do not store full card numbers on our systems.
• Location information. Where a business enables live job tracking or “on the way” updates, the app may collect a staff member's device location while they are on shift, and show an arrival estimate to the customer. Location is only collected with the relevant permission and can be turned off in the device settings.
• Photos and media. If you add job or before-and-after photos, we store the images you choose to upload. The app only accesses your camera or photo library when you use those features.
• Communications. Messages, reminders, confirmations and support enquiries sent through or to AppFlow.
• Device and usage information, such as app and site interactions, device type, and basic technical logs, to keep AppFlow secure and to improve it.

• provide, maintain, secure and improve AppFlow;
• set up and administer your account and business;
• take bookings and process payments, deposits and refunds;
• send confirmations, reminders and service messages;
• provide customer support and respond to your requests;
• detect, prevent and investigate fraud, abuse and security issues;
• meet our legal, tax and regulatory obligations.

We rely on the APPs and, as applicable, your consent, the performance of our contract with you, our legitimate business interests, and compliance with the law. We do not sell your personal information.

We share information only where needed to run AppFlow, and with providers bound to protect it and use it only for the services they provide to us. These include:

• cloud hosting and infrastructure providers;
• payment processing (Stripe and Square);
• email and SMS delivery providers;
• mapping and location services used for job tracking and directions;
• product analytics and error-monitoring tools.

We may also disclose information where required by law, to enforce our terms, or in connection with a business sale or reorganisation (with this policy continuing to apply). We do not sell personal information or share it for cross-context behavioural advertising.

Some of our providers store or process data outside Australia. Where that happens, we take reasonable steps to ensure the information is handled consistently with the APPs and this policy, including through the provider's contractual and security commitments.

Our mobile apps only request the permissions needed for features you use:

• Location, for live job tracking and arrival estimates when enabled by the business;
• Camera and photos, to add job or before-and-after images;
• Notifications, for booking confirmations, reminders and updates.

You can grant or revoke any of these at any time in your device settings.

We protect data with encryption in transit and at rest, access controls, network protections, monitoring and regular backups, and we limit access to staff who need it. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident. See our Trust and security page for more.

We keep personal information for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, tax and security obligations, then delete or de-identify it. Business and client data you store in AppFlow is kept while your account is open and removed after closure in line with these obligations.

You can access, correct, export or delete your personal information, and opt out of marketing messages at any time. To make a request, email hello@appflow.com.au. We will verify your identity and respond within a reasonable time. If you have a concern we have not resolved, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

You can delete your account and associated personal data at any time from your account settings, or by emailing hello@appflow.com.au with the subject “Delete my account”. We will delete or de-identify your personal information, except where we are required to retain it by law (for example, financial records) or for legitimate security and fraud-prevention purposes.

AppFlow is intended for businesses and adults. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact hello@appflow.com.au and we will delete it.

We use essential cookies to run the site and keep you signed in, and privacy-respecting analytics to understand how AppFlow is used. You can control cookies through your browser settings.

Our website and apps may link to third-party sites and services that we do not control. Their privacy practices are governed by their own policies.

We may update this policy from time to time. When we do, we will change the date above and, where the change is significant, take reasonable steps to let you know.

For any privacy question or request, contact AppFlow at hello@appflow.com.au. We are based in Australia.