Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account registration: name, username, email address, and hashed password.
• Profile updates: phone number, profile image (hosted via Cloudinary), and account preferences.
• Fund deposits: transaction reference numbers (RRN), payment method, and deposit amounts. We do not store full card or banking credentials.
• Orders: social media profile or post URLs you submit when placing a service order.
• Support tickets: any content you include in ticket descriptions or replies.

1.2 Automatically Collected Data

• Log data: IP address, browser type, operating system, referring URLs, pages visited, and timestamps.
• Device data: browser fingerprint and device identifiers used for security and fraud prevention.
• Cookies: session tokens (HTTP-only, secure) for authentication, preference cookies, and optional analytics. See Section 5.

1.3 Third-Party Sign-In (Google OAuth)

If you sign in via Google, we receive your name, email address, and profile picture. We do not receive or store your Google password.

2. How We Use Your Information

• To create, authenticate, and manage your account.
• To process and deliver the social media growth services you order.
• To manage your wallet balance, fund deposits, and payment history.
• To respond to support tickets and customer inquiries.
• To send transactional emails — order confirmations, password resets, fund notifications, and ticket replies. You cannot opt out of strictly transactional emails while your account is active.
• To detect, prevent, and investigate fraud, abuse, and unauthorized access.
• To analyze platform usage and improve performance and features.
• To comply with applicable laws, regulations, and legal obligations.

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share it only in these limited circumstances:

• Service providers who help operate our platform:
  • Cloudinary — image hosting and delivery
  • Resend — transactional email delivery
  • Binance Pay — optional cryptocurrency payment processing
  • Google — OAuth 2.0 authentication
  • External SMM API providers — we submit only the social media URL you provide; no personal identifiers are forwarded
• Legal obligations: when required by law, court order, or government authority.
• Business transfers: in the event of a merger, acquisition, or sale of assets.
• Safety and rights: when we believe disclosure is necessary to prevent fraud, protect our users, or enforce our policies.

4. Data Retention

We retain personal data for as long as your account is active or as needed to provide services. Upon account deletion requests, data is removed within 30 days, except where retention is required by law. Transaction records and payment logs may be retained for up to 7 years for financial and compliance purposes.

5. Cookies and Tracking Technologies

Disabling non-essential cookies through your browser may affect certain platform functionality.

6. Data Security

We implement industry-standard security measures, including:

• Passwords are hashed with bcrypt — we never store plaintext passwords.
• Authentication uses short-lived JWT access tokens paired with HTTP-only refresh token cookies.
• All data is transmitted over HTTPS / TLS encryption.
• Rate limiting and CAPTCHA (Cloudflare Turnstile) protect login, registration, and sensitive endpoints.
• Role-based access control protects admin routes and sensitive operations.

No security system is impenetrable. We are not liable for unauthorized access beyond our reasonable control.

7. Your Rights

Depending on your jurisdiction you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information via your account settings.
• Delete your account and associated data (subject to retention obligations).
• Restrict or object to certain processing activities.
• Data portability — request a copy of your data in a structured format.
• Withdraw consent for optional processing at any time.

To exercise any right, contact us at contact@flowmotionitservices.com. We will respond within 30 days.

8. Children's Privacy

Our Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from minors. If you believe a minor has created an account or submitted data, please contact us immediately and we will delete it promptly.

9. International Data Transfers

Our servers and third-party service providers may be located outside your country of residence. By using our Service, you consent to the transfer of your data to countries that may have different data protection laws. We take appropriate safeguards to protect your data throughout such transfers.

10. Third-Party Links

Our platform may include links to external websites or services. This Privacy Policy does not apply to those third-party sites. We encourage you to review their privacy policies independently.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent on-site notice. The "Last updated" date at the top reflects the most recent revision. Continued use of the Service after any update constitutes acceptance.

12. Contact Us

For questions, concerns, or requests related to this Privacy Policy: