Personal Information Collection Statement

This statement is given to you when JetFlow Limited (the "data user") collects your personal data, in compliance with Data Protection Principle 1 of the Hong Kong Personal Data (Privacy) Ordinance.

1. Purpose

We collect your personal data to:

• Create and maintain your JetFlow account.
• Process payments and manage your subscription.
• Operate the modules you use (Finance, HR, etc.) on a tenant-scoped basis.
• Provide customer support, prevent fraud, and respond to security incidents.
• Comply with statutory record-keeping obligations (e.g. Inland Revenue, statutory audit).
• Where you opt in: improve AI features by reviewing model failures.

2. Obligatory or voluntary

Provision of name, email, password and (for paid plans) billing details is obligatory. Without these, we cannot deliver the service.

Provision of marketing-channel preferences, analytics cookie consent, optional profile fields (e.g. avatar, locale) is voluntary. Refusing has no impact on the core service.

In the mobile app, the following are also voluntary and separately permissioned by your device — you may decline any of them and keep using the app:

• Notifications — granting them causes the device's push token, platform and last-seen time to be collected so a notification can reach that handset. It is deleted when you sign out of the device or delete your account.
• Camera and photo library — used only to capture or pick a receipt, document or business card that you then upload. We do not scan or index your camera roll.
• Face ID / Touch ID / fingerprint unlock — the check runs on your device and returns only matched / not matched. No biometric data is transmitted to or stored by JetFlow.

3. Classes of persons to whom the data may be transferred

• Our hosting provider (Hostinger — virtual private server) and our DNS / reverse-proxy provider (Cloudflare — global edge, traffic in transit).
• Our email-delivery provider (Amazon Web Services SES — Asia-Pacific), where the deployment has email configured.
• Our payment processor (Stripe — EEA / USA).
• Our AI providers, only when you actively use AI features: OpenRouter (USA), which is the default gateway and routes each request onward, and the model providers behind it — Anthropic and OpenAI (USA), DeepSeek, Moonshot (Kimi) and Alibaba Cloud (Qwen) (Mainland China), and Voyage AI (USA, search embeddings only). Which of these receives your data depends on the model selected for that request.
• Our push-notification providers, only if you install the mobile app and allow notifications: Expo (650 Industries, USA), which issues your device's push token and relays each notification, and then Apple (APNs) for iPhone / iPad or Google (Firebase Cloud Messaging) for Android, which deliver it to the handset. Each receives the device token and the notification's title and body.
• Professional advisers (legal, accounting, audit) where strictly necessary.
• Hong Kong governmental and regulatory authorities where required by law.

Corrected 2026-08: this list previously named AWS as our host and Anthropic as the sole AI provider, and listed Sentry as our error-monitoring provider. Hosting is a self-managed server behind Cloudflare, AI requests are routed through OpenRouter by default, and Sentry is not used for our error monitoring.

4. DPP1 / DPP3 compliance language

We will use your personal data only for the purposes set out above and any directly related purpose. We will not transfer your data to any other party without your prescribed consent under PDPO s.50A and DPP3.

5. Right of access and correction (DPP6)

You may request access to, or correction of, the personal data we hold about you. Self-service tools are at /account/privacy. For other matters, contact our Data Protection Officer at [email protected].

We respond within 40 days per the PCPD's recommendation. We may charge a reasonable fee where permitted under s.28(2)(b).

6. Cross-border transfer notice

Some of your personal data will be transferred outside Hong Kong (USA, Ireland, Singapore) to the processors listed in §3. PDPO s.33 has not commenced as of writing, but each transfer is governed by a Data Protection Agreement equivalent to the EU Standard Contractual Clauses or the PCPD's Recommended Model Clauses.

7. Retention period

We keep your account data for the active relationship plus one year after closure (longer where Hong Kong statutes require — Inland Revenue 7 years). AI inputs / outputs are purged after 30 days, unconditionally. A mobile push token is deleted when you sign out of that device or delete your account. HTTP request logs purge after 90 days. See Privacy Policy §8 for the full table.

8. Direct marketing (PDPO s.35)

By default we do not use your personal data for direct marketing. The sign-up form contains a separate, unticked opt-in. You may withdraw at any time, free of charge, at /account/privacy.

9. Mandatory consent statement (shown on every collection point)

By proceeding, I confirm that I have read and agreed to the JetFlow Privacy Policy and this Personal Information Collection Statement.

Template document. Have a Hong Kong solicitor review before going live.