Privacy Policy

Flowvent powers event registration, attendance tracking, and workplace management. Legal roles vary depending on whether you are interacting with an event workspace or a workplace attendance organization:

• Event Workspaces (Conferences, Camps, Gatherings): When an organization or event host uses Flowvent to manage registrations and entry check-ins, that host organization is the independent Data Controller for all attendee, child, and guardian details. Flowvent acts as aData Processor processing that data strictly on the host's documented instructions.
• Workplace Attendance (Flowvent Bio Check-in): An organization (your employer or contractor) creates a workspace and registers staff. In data protection terms:
  • Your Employer/Organization is the Data Controller for attendance, shift records, work hours, payroll compensation settings, and internal staff notes. It determines why attendance records are kept and how long they are maintained under employment law.
  • Flowvent acts as the Data Controller for your direct platform account credentials, enrolled biometric face embeddings, consent audit logs, and hardware device public keys, and as a Data Processor for the organizational attendance ledger.
• Platform Account Holders: Flowvent serves as an independent Data Controller for direct account credentials of event organizers, officials, administrators, and visitors to our public marketing surfaces.

We collect only the minimum personal data strictly necessary to deliver event ticketing, safe attendance, and biometric check-in workflows:

The Flowvent Track mobile application provides real-time event check-in, ticket verification, and attendee safety for conferences, youth camps, and summits. To perform these native functions, the app may request the following operating system permissions:

Flowvent Bio Check-in provides enterprise workplace attendance verification, ensuring reliable, fraud-resistant clock-ins through facial verification, hardware fingerprint keys, and GPS geofence checks.

We process collected data under the following legitimate legal and contractual grounds:

• Biometric Processing (Face Embeddings & Verification): Processed solely upon your explicit consent (GDPR Art. 9(2)(a), NDPR). Consent may be freely revoked at any time.
• Attendance & Verification Records: Processed to perform the contractual attendance and workforce service ordered by your employer or event organizer (contractual necessity / legitimate organizational interest).
• Payroll & Compensation Transfers: Processed for organizations that activate the Payroll feature, to calculate compensation, disburse funds via Paystack, and fulfill statutory tax documentation.
• Event Ticketing & Access Control: Processed to issue digital tickets, enforce capacity limits, and facilitate automated house, squad, and dorm room sorting.
• Transactional Communications: To transmit login OTPs, ticket receipts, check-in confirmations, and account recovery links via automated email or push notification.
• Platform Security & Fraud Prevention: To detect malicious access attempts, prevent buddy-punching, and maintain database integrity.

We never sell, rent, monetize, or trade personal data or biometric information to data brokers, marketing agencies, or advertisers.

We share the minimum necessary personal data with vetted third-party subprocessors operating under strict data protection and confidentiality contracts:

Zero Biometric Sharing: We do not send your face photo, face embedding, or fingerprint key to any third party. Face matching runs strictly on our self-hosted infrastructure.

We retain personal data strictly according to defined schedules aligned with operational needs and legal requirements:

In full compliance with Apple App Store (Guideline 5.1.1) and Google Play Developer policies, Flowvent provides direct, autonomous mechanisms for users to manage their data:

Workplace Suite: Flowvent Bio Check-in is dedicated workplace software for verified personnel and employees. It is not directed at minors, and we do not knowingly enroll or process biometrics of children under 18.

Event Ticketing & Youth Camps: Certain events hosted on Flowvent (such as youth camps, religious retreats, and school competitions) involve minors. Registration of minors is restricted strictly to verified parents, legal guardians, or educational institutions holding documented parental consent. Real-time safety tracking in Flowvent Track is accessible solely by authenticated guardians of that specific child and authorized event officials.

Our web platform employs strictly necessary cookies and encrypted HTTP sessions partitioned by organization subdomain. We do not use tracking cookies or third-party behavioral advertising pixels.

Our mobile applications utilize secure operating system keychains (via expo-secure-store and native keystores) strictly to maintain authenticated session tokens, encrypted preferences, and biometric cryptographic keypairs.

Under applicable data protection legislation (including NDPR, UK/EU GDPR, and statutory privacy regulations), you possess the rights to:

• Request access to and a copy of personal information processed concerning you;
• Demand rectification of inaccurate, outdated, or incomplete data;
• Request permanent erasure of your personal data ("right to be forgotten");
• Revoke consent for biometric data processing at any time without penalty;
• Demand restriction of or object to specific processing operations;
• Request data portability in a structured, machine-readable format.

For workplace attendance records controlled by your employer, your employer is the primary Data Controller. Flowvent actively assists employers in fulfilling all data subject rights promptly.

We implement comprehensive technical and administrative defenses to safeguard your personal and biometric data:

• All web and API data transmissions are encrypted using modern Transport Layer Security (TLS 1.2/1.3);
• Passwords and session tokens are salted and cryptographically hashed;
• Biometric face embeddings are stored in isolated vector tables accessible only by internal verification logic;
• Evidence photos are held in private object buckets reachable exclusively via short-lived, signed URLs;
• System access adheres to strict least-privilege role-based access control (RBAC);
• Off-site database backups are encrypted prior to network transit.

We may update this Policy periodically to reflect technological advancements, product expansions, or regulatory changes. When updates occur, we revise the "Effective Date" at the top of this page. For any material modifications affecting biometric data handling, we will notify registered users via in-app notification or email and seek fresh consent where required by law.

For questions, privacy inquiries, data subject requests, or biometric concerns, contact our Data Protection Office:

This Policy applies to Flowvent, Flowvent Track, and Flowvent Bio Check-in.