Privacy Policy

1. Identity of the data user

JetFlow Limited ("JetFlow", "we", "us") is the data user under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486, the "PDPO") for personal data collected through the JetFlow platform. Our Data Protection Officer can be reached at [email protected].

2. What we collect

• Account data — name, email, password hash, employer / company role, locale preference.
• Billing data — billing contact, billing address, last-4 of card / bank account; full payment instruments are held only by our payment processor (Stripe).
• Usage data — pages visited, actions taken, timestamps, IP, user-agent. Used to keep the service running and to debug.
• Content you upload — invoices, bills, receipts, employee records, vendor records, contracts, contacts, fapiao, etc.
• Communications — support tickets and replies, in-app chat with the AI Advisor.
• AI inputs and outputs — the prompts you send to AI features and the responses returned. Held only as long as needed for delivery + 30 days.
• Mobile device data — if you install the JetFlow mobile app and allow notifications, we store that device's push token (an address issued by Expo, and behind it by Apple or Google, that lets a notification reach that specific handset), the platform it runs (iOS / Android), and when it was last seen. It is how a notification finds your phone; it is deleted when you sign out of that device or delete your account. The app also sends a build identifier (app version + build number + platform) with each request so a fault can be traced to a specific release.
• Camera and photo library (mobile app) — the app asks for camera and photo-library permission so you can photograph a receipt, a document or a business card. Only the image you choose to capture or pick is uploaded, and once uploaded it is "Content you upload" above. We never scan or index your camera roll.
• Biometric unlock (mobile app) — if you turn on Face ID / Touch ID / fingerprint unlock, the check is performed by your device's operating system, which answers only "matched" or "not matched". No fingerprint, face or other biometric data is ever transmitted to or stored by JetFlow — all we hold is a flag on the device recording that you enabled the feature.
• Cookies and similar tech — see Cookie Policy.

3. Purposes of collection (DPP1 & DPP3)

We collect personal data only for purposes that are directly related to providing JetFlow:

• Authenticating you and providing the JetFlow service.
• Processing payments and managing your subscription (PDPO s.35: separate consent for direct marketing).
• Operating individual modules (Finance, HR, etc.) — every record is tenant-scoped.
• Customer support, fraud prevention, security incident response.
• Legal and accounting record-keeping (HK Inland Revenue, statutory audit).
• Where you opt-in: improving AI features by reviewing model failures.

4. Lawful bases / consent

We rely on your consent (granted at sign-up — see our Personal Information Collection Statement) and on contractual necessity (we cannot deliver the service without the data). For direct marketing we obtain a separate s.35 consent, which you can withdraw any time at /account/privacy.

5. Third parties we share with

The three push processors are engaged only if you install the mobile app AND grant notification permission. Declining notifications, or signing out of the app, means no token exists and nothing is sent to them.

Messaging and workspace processors

These processors are engaged only where your organisation connects the channel or connector named. Where it is not connected, nothing is sent to them and no account with them exists.

This list is derived from the code paths a request can actually reach, not maintained by hand. Adapters exist in the codebase for Slack, Microsoft Teams, WeChat Work, DingTalk, Twilio SMS and the WhatsApp Business Cloud API, and none of them is reachable: no part of JetFlow calls them, so no personal data goes to any of the six. They are named here rather than listed as processors precisely so that the table above stays a statement of where your data goes.

Accuracy note (2026-08): this list was corrected to match what the platform actually runs. It previously named Anthropic as the only AI processor, and listed Amazon Web Services as our host and Vercel and Sentry as processors. Those were wrong: AI requests are routed through OpenRouter by default, hosting is a self-managed VPS behind Cloudflare rather than AWS, Vercel is not used, and Sentry is not used for our error reporting (it appears in JetFlow only as an integration you may connect to your own Sentry account, in which case you are the one sending data to it).

Accuracy note (2026-08, second pass): the list above still omitted three processors the product can genuinely reach. Microsoft was absent entirely although two of the four connectors JetFlow then offered (Outlook Mail, OneDrive) were Microsoft's and Microsoft Entra ID is a supported sign-in; and Google appeared only as the Android push service, not as the Gmail and Google Drive connectors it also provided. Those rows are now derived from the connectors the product actually offers and the sign-in providers it can enable, rather than maintained by hand — see lib/pdpo/privacy-processors.test.ts, which fails if an offered connector's processor is missing from this table. A row for Finverse Ltd. (bank-statement retrieval) also stood here and was removed in 2026-09 when that integration was deleted from the product: no bank data can reach Finverse from JetFlow any more, and naming a recipient that cannot receive anything would be a false statement in this notice rather than a cautious one. Bank statements now reach JetFlow only from a file you upload yourself.

Accuracy note (2026-10): the Google and Microsoft rows above also described Gmail and Outlook Mail connectors that sent invoices, purchase orders, outreach, approval requests and onboarding email from your own mailbox. Both connectors were retired on 2026-09-27 with the Funding inbox import that used them, and JetFlow no longer sends or reads mail through a Gmail or Outlook account. The rows then described only the two connectors that remained, Google Drive and OneDrive / SharePoint (see the next note). A mailbox linked before that date can still be disconnected; nothing is read from it.

Accuracy note (2026-10, second): Google Drive and OneDrive / SharePoint were the last two connectors JetFlow offered. Both are now held for a later release and cannot be connected, so the Google and Microsoft rows above describe sign-in only. The rows will be restored before a connector is offered again.

Each processor is bound by a written contract containing PDPO-equivalent or stricter protections (DPP3 voluntary compliance language). We will publish a Sub-Processor list update before adding any new third party that touches your data.

6. Cookies

We classify cookies into four buckets — strictly necessary, functional, analytics, and marketing. Only strictly necessary cookies are set without your consent. The cookie banner persists your choice; revisit at /legal/cookies.

7. Security (DPP4)

• TLS 1.3 in transit; HSTS preload eligible.
• Stored secrets and credentials — AI provider API keys, connector OAuth tokens and connector credentials, bank-statement connection tokens, and Companies Registry e-filing credentials — are encrypted with AES-256-GCM at rest under a dedicated field-encryption key.
• Full HKID numbers and full bank account numbers are kept in exactly two places, each encrypted field by field with AES-256-GCM under the same field-encryption key and decrypted only to produce the form or file that needs it, or when an authorised user downloads that file: an employee's IR56 tax profile (to prepare the IR56 employer returns) and the payment details of a supplier or of your own bank account (to generate a bank payment file). The generated forms and payment files are stored encrypted in the same way. Screens show these numbers masked.
• Everywhere else — employee, supplier, bank-account and company-officer records — JetFlow keeps only the last 4 characters of an HKID or account number, as plain display identifiers from which the full number cannot be reconstructed. (Card details for paying JetFlow itself are held only by our payment processor — see section 2.)
• Auth.js JWT sessions, argon2id password hashing.
• Tenant isolation at the query layer (every read filters on company_id) plus row-level security policies on the most sensitive tables.
• Audit log on every mutation. A second, separate PII read log records who looked at the records we judge most sensitive: staff records (the HR directory, an individual employee's file, HKID and bank last-4), payroll and salary reports, bank accounts (balances and masked account numbers), vendor banking details, the company officers register (director and secretary HKID last-4), and every data-subject export. Each entry names the person who read, when, from where, how many records were disclosed and which. It does not cover every read in the product — ordinary reads elsewhere are protected by tenant scoping and role checks and are recorded only when they change something.
• Quarterly access review; offboarding triggers immediate revocation.

Accuracy note (2026-08): this line previously read "PII audit log on every read of sensitive fields". It was not every read — the bank account register and the vendor banking card both disclosed masked account numbers and wrote nothing to the log. Those two paths now write to it, and the sentence has been narrowed to name the surfaces that are actually covered rather than claiming a completeness we do not have. If the coverage widens, this list widens with it; a policy that overstates a safeguard is a defect in its own right, not a harmless rounding-up.

Accuracy note (2026-08): this section previously said the HKID and bank-account fields were themselves stored with AES-GCM, and that the full numbers were held in a "separate encrypted vault". Neither was true: no such vault exists, and the last-4 fields are stored as plain display identifiers precisely because the full numbers are never collected in the first place. The list above now states exactly what is encrypted. If a vault for full identifiers is ever built, this section will be updated when it ships — not before.

Accuracy note (2026-09): that update is the two items above. From 28 September 2026 the IR56 forms and bank payment files need the full numbers, so they are now kept for those two purposes only, encrypted field by field; the earlier sentence that no full number was kept at all stopped being true on that date and has been replaced.

8. Retention (DPP2)

Accuracy note (2026-08): the AI row previously carried an exception for users who chose to keep their AI history. No such setting exists in JetFlow and none ever has, so the exception described a control you could not exercise. The purge is unconditional at 30 days for everyone, and the wording now says so. The mobile push-token row is new: the token was always collected, and was not previously listed here.

9. Cross-border transfer

Some of our processors are outside Hong Kong (USA, Ireland, Singapore). PDPO s.33 prohibiting cross-border transfers without prescribed safeguards has not commenced as of writing, but we voluntarily comply: every transfer is governed by a DPA equivalent to the EU Standard Contractual Clauses or the PCPD's Recommended Model Clauses.

10. Your rights (DPP6)

• Access — request a copy of the personal data we hold about you. Self-service at /account/privacy; on-demand JSON export.
• Correction — ask us to correct inaccurate data. Most fields are user-editable; for HKID / banking fields, file a Data Access Request via /account/privacy.
• Deletion — ask us to delete your account. We honor unless retention is statutorily required, in which case we soft-delete and notify you of the retention period.
• Withdrawal of consent — withdraw at any time; consequences depend on the data class.

SLA: we respond within 40 days per the PCPD's recommendation. Email [email protected] for anything not handled by self-service.

11. Direct marketing (PDPO s.35)

We will never use your personal data for direct marketing without your separate, opt-in consent. The opt-in tickbox at sign-up is distinct from the privacy / PICS consent. Withdraw at /account/privacy; effective immediately, no fee.

12. Children

JetFlow is a B2B product. We do not knowingly collect personal data from anyone under 18. If we learn we have, we will delete it.

13. Changes

When we make material changes we bump POLICY_VERSION and re-prompt your consent on next sign-in. Non-material wording changes are noted in the version history below.

14. Version history

• v1 — 2026-04-28 — initial publication.

This document is provided as a legal-risk-reducing template. JetFlow recommends a Hong Kong solicitor review the deployed text before going live.