1. Introduction

This Privacy Policy explains how Flow Rewards collects, uses, stores, shares, and protects personal data when Users access or use the Flow App and its related services and features.

By using the App or creating an account, you acknowledge that you have read and understood this Privacy Policy and that your personal data will be processed in accordance with this Policy and the applicable laws and regulations in the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Implementing Regulations.

This Privacy Policy forms an integral part of the Terms and Conditions for using the Flow App.

2. Definitions

Flow / we / us / our: Flow Rewards or any legal entity affiliated with it or responsible for operating the App.

App: The Flow mobile application and all related digital platforms, systems, and electronic services.

User / you: Any person who creates an account or uses the App.

Personal Data: Any data that may directly or indirectly identify the User, such as name, mobile number, email address, city, gender, profile photo, location data, or interaction history inside the App.

Partners / Merchants: Commercial entities participating in the Flow ecosystem that provide offers, vouchers, points, tasks, or content to Users.

Tasks / Interactions: Actions performed by the User inside the App or with merchants, such as watching videos, viewing catalogs, scanning QR codes, checking in, completing surveys, following merchants, inviting friends, or redeeming rewards.

3. Personal Data We Collect

We may collect and process different types of personal data depending on how you use the App, including:

Account data: such as name, mobile number, email address, city, gender, nationality, profile photo, and account ID.

Verification and login data: such as verification code, account status, account creation date, and last login date.

Device and technical data: such as device type, operating system, device identifiers, IP address, App language, App version, and crash or technical error logs.

Location data: such as approximate or precise location when using location-based features, including check-in, branch display on the map, or location-based alerts, subject to your permission.

Interaction data: such as watching videos, opening catalogs, scanning QR codes, checking in, completing surveys, following merchants, inviting friends, joining challenges, or using interactive reward features.

Points and rewards data: such as points balance, earned points, used points, expired points, redeemed vouchers, redemption details, and transaction history.

Survey and feedback data: such as your answers to surveys, ratings, comments, and feedback forms submitted inside the App.

Support and communication data: such as messages, requests, or complaints you send to Flow or support teams, and any information required to process your request.

Notification and marketing data: such as notification preferences, merchants followed, marketing consents, and subscription or opt-out records.

4. How We Collect Data

We collect personal data through the following methods:

When you create an account or update your profile.

When you use App features, such as watching content, scanning QR codes, checking in, participating in surveys, or redeeming rewards.

When you enable location services or notifications.

When you follow a merchant or interact with a merchant offer or task.

When you contact support or submit a complaint or inquiry.

When you provide explicit consent to share specific data with a merchant or partner.

Through technical systems that operate automatically to improve the service, prevent fraud, protect accounts, and analyze performance.

5. Purposes of Using Personal Data

We use personal data for the following purposes:

Creating and managing User accounts.

Operating the App and providing core services.

Verifying completed tasks and interactions.

Calculating, adding, deducting, or correcting points.

Allowing Users to redeem points for vouchers or rewards.

Displaying relevant merchants, branches, offers, and tasks.

Operating features such as check-in, QR scanning, video watching, surveys, following, referrals, and challenges.

Improving User experience and personalizing content and offers inside the App.

Sending operational, security, and transaction notifications.

Sending offers or marketing messages where consent or another appropriate legal basis exists.

Preventing fraud, misuse, location manipulation, or points abuse.

Analyzing App, campaign, and task performance.

Supporting Users and responding to complaints and inquiries.

Sharing specific reports or data with merchants and partners in accordance with this Policy and User consent where required.

Complying with legal, regulatory, or security requirements.

6. Legal Basis for Processing

We process personal data based on one or more of the following legal bases:

User consent, especially when sharing profile data with a merchant or sending direct marketing communications.

Performance of the service requested by the User, such as account creation, awarding points, verifying tasks, or redeeming rewards.

Flow’s legitimate interests, such as improving services, preventing fraud, protecting the App, and analyzing performance, provided this does not override the User’s rights.

Compliance with legal or regulatory obligations where required by law or competent authorities.

7. Sharing Data with Merchants and Partners

Flow may share specific data with a merchant or partner when the User starts or completes an interaction or transaction linked to that merchant or partner, such as watching content, viewing a catalog, checking in, scanning a QR code, completing a survey, following a merchant, or redeeming a reward.

User profile data is shared with the merchant only to the extent necessary for the specific purpose shown to the User, such as verifying the activity, awarding points, fulfilling redemption, providing support, improving service, or allowing the merchant to view the interaction record related to that merchant.

Depending on the type and purpose of the interaction, shared data may include name, mobile number, email address, city, gender, nationality, profile photo, interaction type, branch or location, date and time of interaction, points earned or used, survey responses, and redemption details.

Flow may request the User’s explicit consent before sharing certain data with the merchant. The User may refuse consent; however, refusal may prevent the User from completing the interaction or receiving the related points or reward where data sharing is necessary for verification or fulfillment.

The merchant or partner must use shared data only for the disclosed purposes and must not sell the data, use it for unauthorized purposes, or share it with other parties except in accordance with applicable laws and required consents.

8. Marketing and Notifications

Flow may send operational, security, account, or transaction-related notifications, such as points earning confirmations, reward redemption updates, account updates, or important alerts.

Flow may also send offers, marketing messages, or updates about merchants, tasks, and rewards according to the User’s preferences and applicable consents.

Acceptance of the Terms and Conditions or this Privacy Policy alone does not constitute consent to receive direct marketing from merchants or partners. Separate marketing consent may be requested where required.

The User may modify notification settings, withdraw marketing consent, or unsubscribe where this feature is available inside the App, through unsubscribe methods included in messages, or through support channels.

After marketing consent is withdrawn, Flow or the relevant merchant will stop sending related marketing communications in accordance with reasonable operational procedures, while operational, security, account, or transaction-related messages may continue.

9. Location Data

The App may use location data to operate certain features, such as check-in, showing nearby branches, verifying that the User is within a specific merchant location range, or sending location-based alerts where enabled.

Precise location data is used only when the User grants the required permission through the device or the App.

The User may disable location sharing at any time through device settings. However, some features such as check-in or nearby branch display may not function properly when location is disabled.

Certain location data linked to interactions may be retained for verification, fraud prevention, dispute resolution, or compliance purposes.

10. Surveys and Feedback Forms

When the User participates in a survey or feedback form inside the App, responses may be used for analytical, operational, marketing, or user experience improvement purposes.

Survey results or User responses may be shared with the merchant or partner linked to the survey if this is disclosed to the User or where sharing is necessary to complete the interaction, award points, or improve service.

Survey results may be analyzed individually or in aggregate, and aggregated or anonymized data may be used for performance measurement and service improvement.

11. Referrals and Inviting Friends

When the User uses the invite friends feature, we may process data such as invitation link, QR code, mobile number or User ID, referral status, registration date, and points earned from the referral.

This data is used to verify the referral, award points, prevent fraud, and measure referral feature performance.

Referral data must not be used to create fake accounts, send spam, or violate applicable laws or third-party platform policies.

12. Interactive Rewards and Challenges

Flow may process data related to interactive reward features, such as Spin & Win, leaderboard, challenges, and User rankings.

Data used for these features may include first name, profile photo, city, number of points, ranking, completed tasks, or engagement level, depending on App settings and User options.

This data is used to operate interactive features, display results, prevent fraud, and improve User experience.

13. Data Protection

Flow takes appropriate technical and organizational measures to protect personal data against unauthorized access, loss, modification, disclosure, damage, or unlawful use.

These measures may include access restrictions, technical protection systems, monitoring of abnormal activity, record keeping, and internal controls applicable to employees or service providers.

However, no electronic system can be guaranteed to be completely secure. The User is responsible for keeping login credentials confidential and not sharing them with others.

14. Data Retention and Deletion

Flow retains personal data for as long as necessary to achieve the purposes described in this Policy, operate the account, meet legal, accounting, security, or operational obligations, prevent fraud, or resolve disputes.

When an account is deleted, personal data associated with the account will be deleted or disabled to the extent permitted by applicable laws and operational requirements.

Flow may retain certain limited, indirect, or anonymized records where necessary for legal, security, accounting, or fraud-prevention purposes.

The User acknowledges that account deletion will result in the loss of unused points, vouchers, and rewards in accordance with the App’s Terms and Conditions.

15. User Rights

Subject to applicable laws, the User may exercise rights related to personal data, which may include:

The right to be informed about how personal data is collected, used, and processed.

The right to access personal data held by Flow.

The right to request correction, completion, or updating of inaccurate or incomplete data.

The right to request deletion or destruction of personal data when the lawful purpose of processing has expired, subject to any legal or operational obligations.

The right to withdraw consent where processing is based on consent, without affecting processing carried out before withdrawal.

The right to object to or request restriction of certain processing activities where legally available.

The User may exercise these rights through App settings, support channels, or Flow’s approved email address.

16. Withdrawal of Consent

The User may withdraw consent for certain processing activities, such as direct marketing or sharing specific data with a merchant, through App settings, support channels, or available unsubscribe methods.

Withdrawal of consent may disable some features or prevent certain interactions from being completed if processing or data sharing is necessary to provide the service, verify the activity, or award points.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal date.

17. Sharing Data with Service Providers

Flow may share specific data with service providers that help operate the App or deliver services, such as hosting, cloud storage, analytics, notifications, messaging, technical support, security, and voucher or reward processing.

Service providers must use data only according to Flow’s instructions and for the specified purposes, apply appropriate protection measures, and not use the data for their own purposes.

18. Data Transfer Outside the Kingdom

Some data may be processed or stored through service providers or technical systems inside or outside the Kingdom of Saudi Arabia, depending on operational and technical requirements.

Where personal data is transferred outside the Kingdom, Flow seeks to comply with applicable legal requirements and to apply appropriate safeguards to protect the data and ensure it is used only for the specified purposes.

19. Children’s Data

The App is intended for Users aged 18 years and above.

Flow does not target children or persons under the age of 18 and does not intend to collect their personal data.

If Flow becomes aware that an account has been created by a person below the permitted age, Flow may suspend or delete the account and take appropriate action.

20. External Links and Third-Party Services

The App may include links, content, offers, or pages belonging to merchants, partners, or third parties.

Flow is not responsible for the privacy policies or data processing practices of third parties outside the Flow ecosystem.

Users are encouraged to review the privacy policies and terms of any third party before interacting with them or sharing data with them.

21. Updates to this Privacy Policy

Flow reserves the right to amend or update this Privacy Policy from time to time in line with App updates, services, legal requirements, or operational requirements.

The updated version will be published inside the App or through any official channel determined by Flow.

Continued use of the App after publication of the updates shall be deemed acceptance of the updated Privacy Policy, unless applicable laws require additional consent.

22. Contact and Complaints

The User may contact Flow regarding any privacy or personal data inquiry, request, or complaint through the support channels available inside the App or by email: info@flow-rewards.com

Flow will review requests and complaints and respond within a reasonable period in accordance with internal procedures and applicable legal requirements.

If the User is not satisfied with how the request or complaint is handled, the User may submit a complaint to the competent authority in accordance with the applicable laws of the Kingdom of Saudi Arabia.