Privacy Notice

This notice applies to the FlowGrid public website, demo and contact requests, newsletter subscriptions, and personal information FlowGrid handles for its own business operations. In those situations, FlowGrid decides why and how the information is used.

When a hotel, restaurant, retailer, or other business uses a FlowGrid product to manage its guests, customers, employees, or transactions, that business controls the information and FlowGrid processes it on the business's instructions. The customer agreement and data processing terms govern that activity. Individuals should normally direct product-data requests to the business that collected their information.

Please do not put passport numbers, payment-card details, health information, or other sensitive information into a general website form.

Depending on the modules a customer enables, FlowGrid may process the following categories on that customer's behalf:

• Business and user data: property or outlet details, user names, business contact details, roles, permissions, authentication records, settings, and audit events.
• Guest and reservation data: contact details, booking source, stay dates, room and rate information, communications, preferences, special requests, and identity details where the property is legally required to collect them.
• POS and customer data: orders, items, discounts, taxes, refunds, receipt contact details, loyalty activity, and transaction history.
• Staff operations data: employee name, role, location, permissions, shift activity, and actions recorded in system audit logs.
• Payment data: transaction status, amount, currency, payment method, and a processor-issued token or masked card reference. Full card credentials should be handled by an approved payment provider, not general FlowGrid forms.
• Support and usage data: support correspondence, device and connection details, feature events, errors, and diagnostics.

The customer is responsible for providing required notices, choosing lawful settings and retention periods, and responding to its guests, customers, and employees.

FlowGrid uses personal information only where needed to:

• respond to an inquiry or take steps toward a contract;
• provide, maintain, support, and secure contracted services;
• administer accounts, billing, customer service, and essential product communications;
• detect abuse, investigate incidents, and protect FlowGrid, customers, and users;
• comply with tax, accounting, regulatory, and lawful authority requirements;
• improve the website using analytics when the visitor has consented; and
• send marketing only where permitted, with an unsubscribe in every message.

Depending on the context and applicable law, the legal basis may be steps requested before a contract, performance of a contract, legal obligation, legitimate interests in operating and securing the service, or consent. Consent can be withdrawn at any time.

FlowGrid may provide limited information to vendors that help host and secure the website, manage content, deliver requested communications, operate customer support, process payments, or provide consented analytics. These providers may use the information only for the contracted purpose and under appropriate confidentiality and data-protection terms.

The public website currently uses Sanity for managed website content and may use Google Analytics after analytics consent. Other product subprocessors must be identified in the applicable customer agreement or subprocessor list before the relevant product processing begins.

Information may also be disclosed to professional advisers, regulators, courts, or authorities where legally required, and during a legitimate corporate transaction subject to suitable safeguards. FlowGrid does not sell personal information and does not currently use the public website for targeted advertising.

FlowGrid uses a language cookie and local storage to remember cookie choices. Google Analytics is blocked unless analytics permission is given. Visitors can reject analytics without losing access to the website and can change the choice later from the footer.

The Cookie Policy lists the technologies, purposes, providers, and expected durations.

FlowGrid keeps personal information only for the purpose for which it was collected, while an account or business relationship remains active, and for any additional period required for security, dispute resolution, tax, accounting, or legal obligations.

• Website consent choices are stored for up to 180 days before a fresh choice is requested.
• Marketing subscriptions are retained until withdrawal, plus a minimal suppression record needed to honour the opt-out.
• Sales inquiries should be reviewed and deleted when no longer active or relevant.
• Product data follows the customer's configured retention and deletion instructions, subject to the customer agreement and legal requirements.

Information may be anonymised so that it can no longer identify a person. Properly anonymised information may be retained for statistics and service planning.

Depending on location and context, a person may ask to access, correct, delete, restrict, or receive a portable copy of their information; object to certain processing; or withdraw consent. Identity may need to be verified before a request is completed.

For information held by a FlowGrid customer, contact that hotel, restaurant, retailer, or other business first. FlowGrid will assist the customer where required by the applicable data processing terms.

To make a request about information FlowGrid controls, email hello@flowgridsuite.com with the subject “Privacy request.” You may also complain to the competent privacy or consumer-protection authority where a right to do so exists.

FlowGrid uses administrative, technical, and organisational measures appropriate to the information and risk. These should include access control, secure transmission, logging, backups, vulnerability management, incident response, and vendor review. No online service can guarantee absolute security.

Providers may process information outside Pakistan or the visitor's country. Where law requires it, FlowGrid and its customers must use an approved transfer mechanism and contractual safeguards.

The public website is intended for business users and is not directed to children. A hospitality customer may enter information about a minor guest when needed for a lawful booking or stay; that customer remains responsible for the legal basis and notice.

This notice may change when FlowGrid adds a provider, product, or data use. Material changes will be highlighted through an appropriate notice, and the effective date above will be updated.

FlowGrid is based in Karachi, Pakistan. Privacy questions and requests can be sent to hello@flowgridsuite.com.