Privacy Policy — Corallium Flow

This policy explains what data Corallium Flow collects, why we collect it, where it is stored, and what you can ask us to do with it. It covers the Flow web app at www.corallium.my and the Corallium Flow Android app.

Corallium Flow is business software. It is built for small service businesses to manage customers, quotes, jobs, invoices and collections. It is not intended for children and is not directed at them.

1. Two kinds of people in this policy

The distinction matters because rights and responsibilities differ between them.

• You, the Flow user — you create an account, sign in, and run your business inside Flow. We collect your data directly.
• Your customers and staff — you enter their details into Flow. We store and process that information on your behalf. You decide whose information goes in and why; we provide the system.

You are responsible for making sure you have the right to enter customer and staff information into Flow, and for telling them how you use it.

2. What we collect

Your account and profile

• Your email address and password (passwords are stored hashed by our authentication provider, never as plain text)
• Your full name, if you fill it in
• An internal user identifier
• A terms consent record: the terms version, the date, and the user who accepted

Your business

• Business name and business phone number
• Business settings such as subscription plan and validity period
• Payment settings you fill in yourself: bank name, account holder name, account number, and the payment QR code image you upload
• If you subscribe through Google Play: the purchase token, order number, plan (monthly or yearly), subscription status, expiry date, whether it renews automatically, and its price

Data you enter about other people

• Customers — name, phone, email, company name, address, and any notes you write
• Staff — display name, phone, and role. Staff records are labels for your own reference; staff do not need accounts and do not sign in

Work documents

• Quotes and their line items, including public link tokens that let your customers view and accept a quote without an account
• Jobs: title, description, service address, contact notes, schedule, staff assignments, and a public report link token if you choose to share that job's report
• Invoices, invoice line items, and payment records
• Collection requests and the reminder queue
• Workflows, workflow runs, and their schedules

Photos and files

Job evidence photos and PDF documents you upload. You can take a photo directly with the device camera or pick an existing file. Files are capped at 15 MB and limited to JPEG, PNG, WEBP and PDF.

Technical data

• Session cookies that keep you signed in
• Server logs generated automatically by our hosting provider, which typically include IP address, request time and browser type

What we do NOT collect

Flow does not collect your location, does not read your contacts, does not read your messages, and contains no third-party analytics, advertising trackers or crash reporting.

The Android app declares the internet access and network state permissions. It also declares the permissions that come with its push notification component: showing notifications, receiving push messages, and briefly keeping the device awake. Push notifications are not switched on, so the app does not ask you for notification permission and does not register to receive push messages. App versions that offer Google Play subscriptions also declare the Google Play billing permission, which lets a subscription be bought through Google Play; it gives the app no access to your card or payment method. The app declares no location, contacts, microphone, camera or storage permission. Photos are taken through the device's camera app, and files are picked through the system file picker.

We also never see your card number or your customers' card numbers. Online payments happen entirely on the payment gateway's own pages or inside Google Play.

3. How we get this data

• Directly from you when you register, sign in, or type into Flow
• From your device when you take a photo or pick a file to upload
• Automatically when your browser or app contacts our servers
• From the payment gateway when it tells us a bill has been paid

4. Why we use it

• To run the product: show your work, produce quotes and invoices, and store your evidence
• To verify who you are and keep each business seeing only its own data
• To let your customers view quotes, pay invoices, and view job reports through a link
• To prepare the collection reminder queue so you know who to chase
• To issue subscription invoices to you and record your payments to us
• To investigate problems, prevent abuse, and keep the system running

We do not sell your data and we do not use it for advertising.

5. Who else processes this data

We use the following service providers. Each processes data only for the stated purpose.

We may also disclose data where the law requires it, or where it is necessary to protect the rights, safety or property of ourselves or others.

AI feature — not active

Flow contains an AI assistant feature that is switched off as of this policy's effective date. If we enable it later, text you send to the assistant would be sent to a third-party language model provider for processing, and we would update this policy and notify users before turning it on.

6. Payments

There are three distinct money flows in Flow, and each is treated separately.

• Subscription fees you pay to Corallium Tech. We issue an invoice and you pay by bank transfer or FPX. We record billing events, amounts and dates.
• Subscriptions through Google Play. If you subscribe in the Android app, Google processes that payment; we do not see your card or payment method. Our server asks Google about the purchase to verify it, and checks it again every day so that renewals or cancellations are kept up to date. We record the subscription details listed in section 2 along with billing events, amounts and dates.
• Payments your customers make to you. When you send a pay link, we open a bill on the payment gateway. That money is between you and your customer; we record the bill status so your invoice shows the right balance.

To open a bill we send the customer's name, email address, the amount, and a short description to the payment gateway. If that customer has no email address on your records, we send a placeholder address that is undeliverable and belongs to nobody.

Your own payment details

Flow also lets your customers pay you directly, without going through a payment gateway. In Settings you can upload your own payment QR code image and enter your own bank account details — bank name, account holder name, and account number.

When you switch that method on, those details are shown to anyone who opens a valid payment link for your invoice. That is the point of them: they are the information your customer needs in order to pay you. The pay page shows nothing without a valid link token.

• Your QR code image is held in private storage. It has no public URL and cannot be reached by guessing an address.
• Each time the pay page is opened, the system generates an expiring signed link to that image. The link is valid for five minutes only, after which it expires.
• Payments made by QR code or bank transfer move directly from your customer to your account. Corallium does not hold and does not process those funds. Flow only displays the details you provide.

7. Photos and job evidence

Evidence photos and documents are held in private storage. None of them has a public URL. When one is displayed — to you inside Flow, or to a customer holding a job report link — the system generates a signed link valid for a few minutes only, after which it expires.

Evidence files are organised by business and job. By default only the business that uploaded them can read them.

Job reports you share

You can switch on a public job report for any job. When you do, Flow generates a secret link, and anyone holding that link can view that job without an account.

What the report shows: the job number and title, its status, the start and completion dates, the description you wrote, your business name and phone number, and the before and after photos with their captions plus any written notes you attached.

What it does not show: the service address, crew notes, PDF documents, staff assignments, and any money amounts.

Sharing is off until you switch it on, and you can stop it at any time. Stopping it deletes the link outright: the old link dies immediately and cannot be revived. Switching sharing back on issues a new, different link.

Like quote links and pay links, a report link is a transferable secret. Anyone your customer forwards it to can open it too. Bear that in mind before attaching photos that show the inside of someone's property.

8. Cookies and sessions

We use cookies for one purpose: keeping you signed in and your session secure. We do not use advertising or analytics cookies.

Signing out ends that session. In the Android app, clearing app data will also sign you out.

9. Security

• All traffic to Flow uses encrypted connections
• Each business's data is isolated at the database level, not merely hidden in the interface
• Evidence files sit in private storage and are reachable only through expiring signed links
• Server keys and credentials are never sent to the browser or the app

No system is completely secure, and we do not claim otherwise. If a data breach affects you, we will notify you by email.

10. How long we keep it

• Account and business data is kept for as long as your account exists
• Customers, quotes, jobs, invoices and evidence are kept until you delete them or your account is deleted
• Terms consent records are kept permanently because they are the proof that consent was given; they cannot be overwritten
• Records relating to invoices and payments may be kept longer where accounting or legal obligations require it
• Server logs are kept according to our hosting provider's retention period

11. Deleting your data

You can delete individual customers, jobs, evidence and workflows at any time directly inside Flow. Deleting evidence also removes its file from storage.

To delete your whole account and its associated data, submit a request through our Delete Account page at www.corallium.my/padam-akaun, or email us directly. That page explains what is deleted, what may be retained, and how long it takes.

12. Your rights

• Request a copy of the personal data we hold about you
• Request correction of data that is wrong
• Request deletion of your account and its associated data
• Withdraw consent by stopping use of the service and requesting deletion

Email us at arunghayatsports@gmail.com to exercise any of these. We may need to verify your identity first, so that we do not hand over or delete one person's data on someone else's say-so.

If your request concerns your customer or staff data, contact the business that entered it — they decide what is held there.

13. WhatsApp links

Flow builds WhatsApp links so you can send a quote or reminder in one tap. Flow does not send those messages itself and has no access to your WhatsApp account or messages. The tap opens WhatsApp with the text prepared; you press send.

14. Changes to this policy

If we change this policy in a way that affects your rights, we will update the effective date at the top and notify registered users by email.

15. Contact us

For any privacy question, data request, or account deletion request: arunghayatsports@gmail.com

Corallium Tech · Registration No.: SPA/2026/6433