Privacy Policy

1. Introduction

Jiaflow ("we", "us", or "our") operates Jiaflow Sales — a cloud-based point-of-sale and business management platform — accessible via jiaflow.com and associated sub-applications. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have over your data.

By creating an account or using any part of the Jiaflow platform, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

a) Account Registration

When you sign up for Jiaflow, we collect:

• Full name
• Email address
• Password (stored in hashed/encrypted form — we never store plain-text passwords)
• Business name and contact details (when provided during onboarding)

b) Sign-In with Google (Google OAuth)

You may choose to register or log in using your Google account. When you do, Google shares the following information with us based on the permissions you grant:

• Your name as registered with Google
• Your Google account email address
• Your Google account profile picture (avatar)
• A unique Google account identifier (used solely to link your Google account to your Jiaflow account)

We do not receive access to your Google password, Google contacts, Google Drive, Gmail, or any other Google service data. The information obtained via Google OAuth is used exclusively to create or authenticate your Jiaflow account and to personalise your in-app experience.

Jiaflow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

c) Point-of-Sale & Business Data

When you use Jiaflow Sales, we store data you enter into the platform, which may include:

• Product catalogue, inventory, and pricing information
• Sales transactions and order history
• Customer records (name, contact information) you create within the POS
• Staff and user role assignments within your account
• Payment method types used (we do not store full card numbers)

d) Usage and Technical Data

We automatically collect certain technical information when you use our platform, including:

• IP address and approximate geographic location (country/region)
• Browser type, version, and operating system
• Device identifiers
• Pages visited, features used, and session duration
• Error logs and crash reports

e) Communications

If you contact our support team or send us an email, we retain those communications and any information you include in them to resolve your request and improve our services.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the service: To create and manage your Jiaflow account, operate Jiaflow Sales features, and deliver the functionality you use.
• Authentication: To verify your identity when you sign in, including via Google OAuth.
• Account personalisation: To display your name, profile picture, and business details within the app.
• Communication: To send transactional emails (password resets, account alerts), product updates, and — where you have opted in — marketing communications.
• Support: To respond to enquiries, troubleshoot issues, and improve user experience.
• Security & fraud prevention: To detect, investigate, and prevent unauthorised access, abuse, and other harmful activity.
• Analytics & improvement: To understand how the platform is used and to improve performance, reliability, and features.
• Legal compliance: To meet our legal obligations and enforce our agreements.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Legal Basis for Processing

Where applicable privacy laws require a legal basis for processing personal data (e.g., GDPR), we rely on:

• Contract: Processing necessary to provide the services you have signed up for.
• Legitimate interests: Improving the platform, maintaining security, and preventing fraud.
• Consent: For optional features such as marketing emails (you may withdraw consent at any time).
• Legal obligation: Where we are required to process data by law.

5. Data Sharing and Third Parties

We do not sell your personal data. We may share limited data with trusted third-party service providers who assist us in operating our platform, subject to strict confidentiality and data-processing agreements. These categories of providers include:

• Cloud hosting & infrastructure: Servers and storage infrastructure used to run the platform.
• Authentication: Google OAuth 2.0 for sign-in (Google LLC).
• Payment processing: Payment gateway providers to process subscription and transaction payments. We never receive or store full payment card numbers.
• Email delivery: Transactional email services used to send system notifications and support responses.
• Analytics: Aggregated, anonymised analytics tools to measure platform performance.

We may also disclose data where required by law, court order, or government authority, or to protect the rights, property, or safety of Jiaflow, our users, or the public.

We do not share your business data (product catalogue, transactions, customer records) with any third party except as necessary to provide the service or as required by law.

6. Google API Services — Limited Use Disclosure

Jiaflow's use of information received from Google APIs is limited to the practices disclosed in this Privacy Policy. Specifically:

• We only request the minimum Google account data necessary for authentication and account creation (name, email, profile picture).
• We do not use Google user data to serve advertising.
• We do not allow humans to read your Google data unless you have explicitly granted us permission, it is necessary for security purposes, or we are required to do so by law.
• We do not transfer Google user data to third parties except as necessary to provide and improve Jiaflow's user-facing features, or as required by law.

7. Cookies and Tracking Technologies

Jiaflow uses cookies and similar technologies for the following purposes:

• Session cookies: To keep you logged in during your session.
• Preference cookies: To remember settings such as language and display preferences.
• Security cookies: To detect and prevent fraudulent activity.
• Analytics cookies: To understand usage patterns and improve the platform (where applicable, we use anonymised data).

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the platform.

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/HTTPS
• Hashed storage of passwords (we never store plain-text passwords)
• Access controls limiting data access to authorised personnel only
• Regular security reviews and monitoring

No method of electronic storage or transmission is 100% secure. If you believe your account has been compromised, please contact us immediately at [email protected].

9. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide the services. If you close your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it for legal, tax, or compliance purposes.

Data obtained via Google OAuth is retained only as long as it is needed to maintain your account. You may request deletion at any time (see Section 10).

10. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data ("right to be forgotten").
• Portability: Request your data in a structured, machine-readable format.
• Objection / Restriction: Object to or request restriction of certain types of processing.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Revoke Google access: You may revoke Jiaflow's access to your Google account at any time via your Google Account permissions page. Revoking access will not delete your Jiaflow account, but you will need to set a password to continue logging in.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

11. Children's Privacy

Jiaflow Sales is a business-oriented platform intended for use by individuals aged 16 and older. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

12. International Data Transfers

Your data may be processed and stored on servers located outside your country of residence. We take steps to ensure that such transfers are made in compliance with applicable data protection laws and that your data remains protected to the standard described in this policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. We encourage you to review this policy periodically.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: