Privacy Policy

1.Scope & who this covers

This Privacy Policy explains how Delien Media FZE, operating the FlowTracker.io platform (“FlowTracker”, “we”, “us”), collects, uses, discloses and protects personal data. It applies to: (a) visitors to flowtracker.io; (b) customers and authorised users of the FlowTracker platform; and (c) end users (“leads”) whose data is processed through the platform on behalf of our customers.

FlowTracker is an attribution, CRM and messaging platform used by performance-marketing businesses. Because the platform processes data about our customers’ end users, we act in different roles for different data — see section 15.

2.Summary

• We collect data you give us, data collected automatically through tracking technologies (including device and browser characteristics), and data we receive from advertising platforms, integration partners and enrichment providers.
• For advertising and cross-device attribution we rely on your consent. You can withdraw consent at any time.
• We share conversion data with advertising platforms (Meta, TikTok, Google, Snapchat) and other service providers strictly as described below, and never sell personal data.
• We are established in the UAE; some data is transferred internationally under appropriate safeguards (Standard Contractual Clauses).
• You have rights over your data, including access, deletion and objection. Contact privacy@flowtracker.io.

3.Personal data we collect

3.1 Data you provide

Account and contact details (name, email, company/brand, phone), the brokers or platforms you work with, your traffic sources and team size, billing details, support communications, and any content you submit through forms or chat.

3.2 Data collected automatically (website and tracked properties)

When you or a tracked end user interacts with a property running the FlowTracker pixel or server-side tracking, we may collect:

• Identifiers and online identifiers — IP address, FlowTracker IDs, advertising click identifiers (e.g. fbclid, ttclid, gclid), UTM and campaign parameters, and cookie identifiers.
• Device and connection characteristics — device type, operating system, browser type and version, language, screen and timezone settings, and similar technical signals that may be combined to form a device fingerprint (see section 6).
• Event and behavioural data — pages viewed, clicks, ad interactions, registrations, contacts, purchases, deposits and other conversion events, with timestamps.

3.3 Messaging and CRM data

Where a customer connects messaging channels (Telegram, WhatsApp, Messenger, Instagram, Live Chat), we process the conversation content, contact identifiers and metadata routed through those channels in order to provide the inbox, CRM and workflow features.

3.4 Integration data

Data exchanged with connected broker accounts and payment providers (e.g. registration and transaction signals such as deposit value and currency) used to attribute conversions. We do not seek or require full financial-account numbers or payment-card numbers for conversion attribution.

4.Where we obtain data (including third-party sources)

In addition to data collected directly, we obtain personal data indirectly from: advertising platforms (matching and measurement signals), our customers (who upload or route lead data to the platform), integration partners (brokers, payment providers, messaging platforms), and data-enrichment processes that cross-reference touchpoints to improve attribution accuracy. Where we obtain data about you indirectly, we provide this notice in satisfaction of Article 14 GDPR; the categories of such data are those listed in section 3, and the sources are those listed here.

5.How we use data & legal bases

Where we rely on consent, you may withdraw it at any time without affecting prior processing. Where we rely on legitimate interests, you may object (see section 11).

6.Cookies, fingerprinting & tracking technologies

FlowTracker uses cookies, pixels, software development kits, local storage, server-side (server-to-server) event collection and device fingerprinting. Device fingerprinting combines technical characteristics of a device and browser to recognise a user across sessions and devices, even where cookies are unavailable.

7.Advertising & conversion data sharing

A core function of FlowTracker is to send conversion and event data back to advertising platforms so that campaigns can be measured and optimised. This may include sharing data with Meta (Conversions API / Pixel), TikTok (Events API / Pixel), Google (Ads API / Enhanced Conversions / Consent Mode) and Snapchat.

• Where personal identifiers are shared for matching, they are hashed (SHA-256) and normalised before transmission wherever the platform supports it.
• We do not transmit special-category data, government identifiers, full financial-account numbers, payment-card numbers, or any data a platform designates as prohibited, and we keep event and parameter names free of sensitive descriptors.
• For EU/EEA, UK and other consent-required users, events are only transmitted where valid consent exists and, for Google, where the corresponding consent signals (Consent Mode v2) are passed.
• Each advertising platform is an independent recipient and, depending on the processing, may act as an independent or joint controller of the data it receives under its own terms and privacy policy.

8.Recipients & sub-processors

We disclose personal data to the following categories of recipients, bound by contracts requiring appropriate protection:

• Advertising platforms — Meta, TikTok, Google, Snapchat (for measurement and optimisation).
• Payment processing — Stripe and similar providers (for billing and, where connected, transaction signals).
• Messaging platforms — Telegram, WhatsApp/Meta, Instagram and Live Chat providers (to deliver omnichannel features).
• Infrastructure & hosting — cloud hosting, storage, database, content-delivery and security providers.
• Operational tools — analytics, customer-support, email and logging providers.
• Professional advisers, authorities and acquirers — where required by law or in connection with a corporate transaction.

A current list of sub-processors is maintained and available to customers on request and in the Data Processing Agreement. We do not sell personal data, and we do not use advertising-platform data for any purpose other than providing our service.

9.International data transfers

FlowTracker is operated from the United Arab Emirates, and our service providers are located in various countries. Where personal data of individuals in the EU/EEA or UK is transferred to the UAE or to other countries that have not received an EU adequacy decision, we rely on appropriate safeguards, principally the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), supported by a transfer impact assessment. You may request a copy of the relevant safeguards by contacting privacy@flowtracker.io.

10.Data retention

We retain personal data only for as long as necessary for the purposes described, including providing the service to our customer, complying with legal obligations, resolving disputes and enforcing agreements. Lead and event data processed on behalf of a customer is retained according to that customer’s instructions and is deleted or returned on termination, subject to legal retention requirements. Where you ask us to delete data and we have no overriding legal basis to keep it, we will do so.

11.Your rights

Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; erase data; restrict or object to processing (including an absolute right to object to direct marketing); data portability; withdraw consent; and not be subject to solely automated decisions producing legal or similarly significant effects. Under US state laws you may also have rights to opt out of “sales”/“sharing” and targeted advertising and to non-discrimination for exercising your rights.

To exercise any right, contact privacy@flowtracker.io. Where data is processed on behalf of a customer (controller), we will refer your request to that customer or act on their instructions. You also have the right to lodge a complaint with a supervisory authority — in the UAE, the UAE Data Office; in the EU/EEA, your local data protection authority.

12.Automated decision-making & profiling

FlowTracker performs profiling for attribution and optimisation, including building confidence scores that link interactions to a likely user and campaign. These activities support measurement and do not, by themselves, produce legal or similarly significant effects on individuals. Where any solely automated decision would produce such effects, we will not carry it out without an applicable lawful basis and appropriate safeguards, including the ability to request human review.

13.Security

We implement technical and organisational measures appropriate to the risk, including encryption in transit, access controls, network protection, logging, and least-privilege practices. No method of transmission or storage is completely secure; we maintain procedures to detect, respond to and notify relevant parties of personal-data breaches as required by law.

14.Children

FlowTracker is a business-to-business service not directed to children, and we do not knowingly collect personal data from anyone under 18. Customers must not use the platform to process data of minors or to target advertising to minors. If we learn that we have collected a minor’s data without an appropriate basis, we will delete it.

15.Controller / processor roles

For the personal data of our own website visitors, account holders and business contacts, FlowTracker (Delien Media FZE) is the data controller. For end-user (lead) personal data that customers collect, upload or route through the platform, FlowTracker generally acts as a processor on the customer’s instructions, and the customer is the controller responsible for establishing a lawful basis (including obtaining consent) and for providing privacy notices to its end users. Where FlowTracker independently determines purposes and means — for example certain enrichment, fingerprinting infrastructure and product analytics — it acts as a controller for that processing. Our processor obligations are set out in the Data Processing Agreement.

16.Changes & contact

We may update this Policy from time to time. Material changes will be notified through the platform or by email, and the “last updated” date above will change. Continued use after an update constitutes acceptance where permitted by law.