Applies to Flowence, the Flowence mobile applications, Alayrix, the BnR360 websites that link to this Policy, and related communications.
Loading
Loading
Legal
Personal Data the Company handles for its own purposes
1.1 The controller of Personal Data described in this Policy is BnR360, operating the Flowence and Alayrix brands ("we", "us" or "our"), of H#C-40, Karachi University Staff Town, Karachi, Pakistan.
1.2 Privacy contact: services@alayrix.com, subject Privacy Request. Data protection contact: services@alayrix.com.
1.3 EU and UK representatives. Where required by Article 27 of the GDPR and the UK GDPR, we will appoint EU and UK representatives and publish their details in this Policy. Until then, data subjects may contact us at services@alayrix.com.
2.1 Controller. We act as a controller (or "business") for the Personal Data we collect for our own purposes, such as managing accounts and subscriptions, billing, security, marketing, analytics, support and improving our services.
2.2 Processor. When our customers use Flowence or Alayrix to process Personal Data about their own audiences, employees, leads or customers, we act as a processor (or "service provider") on the customer's instructions under the Data Processing Addendum (Part 5). The customer is the controller of that data and is responsible for the notices and lawful basis. If you are an individual whose data was submitted by one of our customers, please contact that customer first. We will help the customer respond to your request.
2.3 Not covered. This Policy does not cover the practices of Third-Party Platforms (such as social-media networks) that our customers connect, or of third-party websites we link to, which have their own policies.
3.1 Account and profile data: name, business name, job title, email address, phone number, password (stored in hashed form), profile picture, language and time zone, role and workspace information.
3.2 Billing and transaction data: billing name and address, tax identifiers, plan, invoices and payment history, and limited payment information. Card details are collected and processed by our payment providers, and we do not store full card numbers.
3.3 Customer Content and Input data: content you upload, create, connect or publish, including text, images, video, audio, documents, brand assets, social-media posts and comments, Inputs and prompts you submit to AI Features, and the AI Output returned.
3.4 Connected-account data: with your authorisation, data from Third-Party Platforms you connect (such as profile identifiers, access tokens, page and post data, audience statistics and analytics).
3.5 Communications: messages you send us, support tickets, survey responses, feedback, and call or meeting notes where you take part in an onboarding or support session.
3.6 Technical and usage data: IP address, device identifiers, browser and operating-system type, app version, language, referring URLs, pages and features used, timestamps, crash logs, performance data, approximate location derived from IP address, and cookie and SDK identifiers described in the Cookie Policy (Part 6).
3.7 Mobile device data: with your permission, notification tokens, camera, photo and file access for uploads, microphone access for voice features, and biometric unlock results processed on your device (we do not receive your biometric data).
3.8 Marketing data: contact details of prospects and subscribers, preferences, and interactions with our emails and campaigns.
3.9 Acceptance records: records of your acceptance of our terms, including the version, date, time, IP address and device information.
3.10 Information from other sources: business contact information from publicly available sources, referral partners, and service providers such as payment providers and analytics providers.
3.11 Sensitive data. We do not intend to collect special-category or sensitive Personal Data for our own purposes. Please do not submit such data (including health, biometric, genetic, precise-location, government-identifier, payment-card, racial or ethnic origin, political, religious, sexual-life or criminal-record data) as Customer Content or AI Inputs unless a signed agreement provides for it.
We use Personal Data for the purposes below. Where the GDPR or UK GDPR applies, the lawful basis is shown in brackets.
We do not sell Personal Data for money, and we do not "share" Personal Data for cross-context behavioural advertising except as described in the Cookie Policy and subject to your choices.
5.1 What happens to your Inputs. When you use an AI Feature, we transmit your Inputs (and the minimum context needed) to one or more third-party AI Providers, currently including OpenAI, Google (Gemini) and DeepSeek, which process them and return AI Output. Providers act as our subprocessors and are contractually restricted from using Customer Content for their own purposes where commercial API terms allow. Providers may retain Inputs for a limited period for abuse monitoring and legal compliance.
5.2 International processing. AI Providers may process data in the United States, the European Union, Singapore or other countries. DeepSeek is a provider whose infrastructure and legal framework are located in or connected to the People's Republic of China, where government authorities may have broader access to data than in your country. You may ask us at services@alayrix.com to disable DeepSeek-backed features for your Account. We recommend you do not submit Personal Data or confidential information to those features.
5.3 Accuracy. AI Output may be inaccurate and should be reviewed by a person before use.
5.4 No solely automated decisions with legal effect. We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. If that changes, we will provide notice, a right to human review and meaningful information about the logic involved, as Applicable Law requires.
5.5 Mobile consent. The Mobile Application asks for your permission before first sending personal data to a third-party AI service, and you may withdraw permission in settings.
We and our providers use cookies, local storage, pixels and software development kits ("SDKs") as described in the Cookie Policy (Part 6), which explains the categories used, your choices, and how to withdraw consent. Where Applicable Law requires consent for non-essential cookies, we ask for it before setting them, and we honour recognised opt-out preference signals such as Global Privacy Control where required.
We share Personal Data only as described below, and we require recipients to protect it.
7.1 Service providers and subprocessors that help us operate the services, including: cloud hosting and infrastructure (DigitalOcean, Microsoft Azure); AI Providers (OpenAI, Google, DeepSeek); payment processors and collection agents; email, messaging and notification providers; analytics, crash-reporting and performance providers; customer-support and communication tools; security and fraud-prevention providers; and professional advisers. A current subprocessor list is available on request at services@alayrix.com.
7.2 Third-Party Platforms that you connect or to which you instruct us to publish (such as social-media networks), only as you direct.
7.3 Our customers and their authorised users, where you are an Authorised User within their Account or a person whose data appears in their Customer Content.
7.4 Affiliates and payment collection agents, which process Personal Data under this Policy. Payments may be collected through an affiliate acting as payment agent.
7.5 Legal and safety disclosures. We may disclose Personal Data to courts, regulators, law enforcement and other authorities, and to child-safety organisations (such as NCMEC, the Canadian Centre for Child Protection, the Australian eSafety Commissioner and the Internet Watch Foundation) where required or permitted by law, and where we believe disclosure is necessary to protect rights, safety, property or the integrity of the services.
7.6 Business transfers. In connection with a merger, acquisition, financing, reorganisation or sale of assets, subject to confidentiality and with notice where required.
7.7 With your consent or at your direction.
We do not sell your Personal Data and do not disclose it to data brokers.
8.1 We are based in Pakistan and use providers in other countries, so your Personal Data will be transferred to and processed in countries other than where you live, including Pakistan, the United States, the European Union, Singapore and other places where our subprocessors operate. Those countries may have data-protection laws different from those of your country.
8.2 Where required, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum or Agreement), adequacy decisions where available, the equivalent mechanisms recognised by Canada, Australia, Singapore, Saudi Arabia, the United Arab Emirates, Qatar and other countries, and your explicit consent where lawful and necessary. Pakistan has not been recognised as providing adequate protection by the European Commission, and we therefore use contractual safeguards and supplementary measures. You may request a copy of the relevant safeguards by contacting us.
9.1 We keep Personal Data only as long as necessary for the purposes described, to provide the services, and to meet legal, tax, accounting, security and dispute-resolution requirements. Typical periods are:
9.2 We delete or anonymise Personal Data when it is no longer needed, unless the law requires us to keep it. Retention periods are guidelines and may be extended where legally required or necessary for a legal claim.
We use administrative, technical and organisational measures designed to protect Personal Data, including encryption in transit and at rest, access controls and least-privilege access, multi-factor authentication for administrative access, logging and monitoring, vulnerability management, secure development practices, and confidentiality obligations on personnel and providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your Personal Data, we will notify you and the competent authorities as Applicable Law requires.
11.1 Our services are business tools and are not directed to children. We require users to be at least eighteen (18) years old, and we do not knowingly collect Personal Data from children under eighteen (18) for our own purposes, and in no case from children under thirteen (13), or under the higher age of digital consent that applies in the user's country (which is as high as sixteen (16) in some EU Member States).
11.2 If we learn that we have collected Personal Data from a child without the verifiable consent required by law, we will delete it promptly. A parent or guardian who believes a child has provided us data may contact services@alayrix.com.
11.3 Customers who use the services to process the Personal Data of children are responsible for obtaining parental or guardian consent where required and for complying with children's privacy laws, as set out in the Master Subscription Agreement and the Child Safety Standards Policy.
12.1 Rights. Depending on where you live, you may have the right to: (a) know whether we process your Personal Data and obtain access to it; (b) have inaccurate data corrected; (c) have your data deleted; (d) restrict or object to processing; (e) data portability; (f) withdraw consent at any time, without affecting earlier processing; (g) object to direct marketing; (h) not be subject to decisions based solely on automated processing with legal or similar effects; (i) lodge a complaint with a supervisory authority; and (j) not be discriminated against for exercising your rights.
12.2 How to exercise them. Email services@alayrix.com with the subject Privacy Request, or use the in-app privacy controls (Settings, Privacy). We may verify your identity before acting, using information we already hold, and will not ask for more than necessary. An authorised agent may submit a request on your behalf with written proof of authority.
12.3 Timing. We respond within the period required by law: one month under the GDPR and UK GDPR (extendable by two months for complex requests), forty-five (45) days under the CCPA (extendable once by forty-five days), thirty (30) days under the PIPEDA and Quebec Law 25 (extendable as the law allows), thirty (30) days under the Australian Privacy Principles for access requests, and as otherwise required in your country. We do not charge a fee unless the law permits it for manifestly unfounded or excessive requests.
12.4 Customer data. If your request concerns Personal Data we process on behalf of a customer, we will direct you to the customer or help the customer respond.
12.5 Limits. We may refuse or limit a request where permitted by law, for example where it would infringe others' rights, where we must retain the data for legal reasons or the establishment or defence of legal claims, or where the request is manifestly unfounded.
13.1 In the app. In the Flowence Mobile Application, go to Settings, Account, Delete Account, and confirm. You may also delete your account in the web application under Settings, Account.
13.2 By email. If you cannot access your account, email services@alayrix.com from the email address on the account, with the subject "Delete my account".
13.3 What happens. After we verify the request, we delete the account and associated Personal Data and Customer Content from active systems within thirty (30) days after your subscription ends, including from encrypted backups, except for data we must keep for legal, tax, accounting, fraud-prevention, security and dispute-resolution purposes, which we retain only for as long as necessary and then delete or anonymise. Deletion is permanent and cannot be undone. Deleting an account in the app does not cancel a subscription purchased through an app store, which must be cancelled through your app store account.
13.4 Alayrix clients. Deletion of Alayrix client data is handled under the Managed Services Terms, clause 34.
We send marketing messages only where permitted by law and, where consent is required (for example under the GDPR, ePrivacy rules, CASL and the Spam Act), only with your consent. Every marketing email includes a working unsubscribe link, and you may also opt out by emailing services@alayrix.com or changing your preferences in Settings. We act on unsubscribe requests promptly and no later than ten (10) business days. We will continue to send transactional messages (such as invoices and security notices).
15.1 European Economic Area, United Kingdom and Switzerland. The controller and contacts are in clause 1. Our lawful bases are listed in clause 4. You have the rights in clause 12, and may complain to your local supervisory authority (in the United Kingdom, the Information Commissioner's Office). International transfers use the safeguards in clause 8.
15.2 Canada. We handle Personal Data in accordance with the Personal Information Protection and Electronic Documents Act and applicable provincial laws, including Quebec's Act respecting the protection of personal information in the private sector (Law 25). We process data based on your consent (express where the data is sensitive) or as the law permits, and you may withdraw consent subject to legal and contractual restrictions. Personal information may be processed outside Canada and Quebec, including in Pakistan and the United States, and may be accessible to foreign courts and authorities. Quebec residents may request information about the personal information we hold, the purposes and the right to have it de-indexed or anonymised where the law provides. You may complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.
15.3 United States. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws may have the rights to know, access, correct, delete, obtain a portable copy, opt out of targeted advertising, sale and certain profiling, and limit the use of sensitive personal information, and to appeal a refusal. In the past twelve months we have collected the categories of Personal Data in clause 3 (identifiers, commercial information, internet and device activity, professional information, and inferences), for the purposes in clause 4, and disclosed them to the recipients in clause 7. We do not sell Personal Data for money. To the extent that analytics or advertising cookies amount to a "sale" or "sharing", you may opt out through the cookie settings or a recognised opt-out preference signal such as Global Privacy Control, which we honour. We do not knowingly sell or share the data of anyone under sixteen (16). We use and disclose sensitive personal information only to provide the services you request and as the law permits. California residents may submit requests through the methods in clause 12.2 and may use an authorised agent. We do not discriminate against you for exercising your rights. California residents may also request information about disclosures for third-party direct-marketing purposes.
15.4 Middle East. We handle Personal Data in line with applicable data-protection laws where they apply, including Saudi Arabia's Personal Data Protection Law, the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and the laws of Qatar, Bahrain, Kuwait and Oman. Where those laws require it, we process Personal Data on a lawful basis, provide the rights in clause 12 and rely on lawful transfer mechanisms for international transfers. Some of these laws impose data-localisation or transfer restrictions for certain categories of data, and enterprise customers who require in-region hosting should contact us before onboarding.
15.5 South East Asia. We handle Personal Data in line with applicable laws where they apply, including Singapore's Personal Data Protection Act 2012, Malaysia's Personal Data Protection Act 2010, Indonesia's Personal Data Protection Law (Law No. 27 of 2022), Thailand's Personal Data Protection Act B.E. 2562, the Philippines' Data Privacy Act of 2012 and Vietnam's Law on Personal Data Protection. You have the rights those laws provide, including access, correction, withdrawal of consent and complaint, which you may exercise as described in clause 12. Our Data Protection contact is stated in clause 1.
15.6 Australia and New Zealand. We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and the New Zealand Privacy Act 2020. Personal information may be disclosed to overseas recipients in Pakistan, the United States and other countries listed in clause 8, and we take reasonable steps to ensure that they handle it in line with those principles. You may complain to us and, if unresolved, to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.
15.7 Pakistan. Pakistan does not currently have an enacted comprehensive data-protection statute. We handle Personal Data in accordance with the laws of Pakistan applicable to us, including the Prevention of Electronic Crimes Act, 2016, the Electronic Transactions Ordinance, 2002 and the Unsolicited Commercial Communication Regulations, and we will comply with any comprehensive data-protection law once enacted and in force. Residents of Pakistan may exercise the rights in clause 12 as a matter of our policy.
16.1 Google user data. Flowence's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve user-facing features that are visible in the Flowence interface, do not transfer it to others except as necessary to provide those features, comply with law or as part of a merger or sale with notice, do not use it for advertising, and do not allow humans to read it except with your consent, for security purposes, to comply with law or where the data is aggregated and anonymised.
16.2 Other platforms. Our use of data obtained from other Third-Party Platforms (including Meta, LinkedIn, X and TikTok) complies with their developer terms. You can revoke our access through the platform's settings or in Flowence and request deletion of data we obtained through that connection.
16.3 Apple and Google disclosures. The privacy information we provide in the Apple App Store ("App Privacy" labels) and in the Google Play "Data safety" section describes the data collected and shared by our Mobile Application, including account and contact information, content, identifiers, usage data and diagnostics, and whether data is shared with third parties such as AI Providers. That information is kept consistent with this Policy.
We respond to recognised opt-out preference signals, such as Global Privacy Control, as required by Applicable Law. Our services do not otherwise respond to "Do Not Track" browser signals, because there is no common standard.
We may update this Policy to reflect changes in our practices, technology or the law. We will post the updated Policy with a new effective date and, for material changes, give at least thirty (30) days' notice by email or in the service before the change takes effect, and obtain fresh consent where the law requires. Prior versions are available on request.
To contact us about this Policy or to complain: services@alayrix.com, or by post to BnR360, H#C-40, Karachi University Staff Town, Karachi, Pakistan. We will acknowledge complaints within five (5) business days and respond within thirty (30) days. You also have the right to complain to the supervisory authority in your country.