Privacy policy

• Partners: people who hold an account here, for themselves or for a company or agency.
• People who click a partner’s link on their way to one of the apps.
• People who sign up to an app through a partner’s link or code. The app’s own privacy policy covers what the app does with their data; this policy covers the small part that reaches us.
• People who visit this website. We only keep totals of visits, which say nothing about you. See below.

We process the following about you when you have an account. Most of it you enter yourself.

Account

Name, email address, language, and a salted hash of your password (never the password itself). If you sign in with Google, the identifier Google gives us for your account. If you turn on two-factor authentication, its secret (encrypted) and hashed recovery codes.

BankID

If you use BankID: your name as BankID gives it, a keyed hash of your personal number (we do not store the number itself) and when you last identified. We read your age from the number at that moment, to check you are old enough.

Sessions and security

For each sign-in: IP address, browser user agent, when it was created and last used. We also email you when a new device signs in, or when your password, email address, two-factor setting or bank details change.

Partner profile

Display name, the kind of partner you are, country, audience language, company or agency name, and the channels you add: website, newsletter, social media profile addresses, usernames and audience sizes.

Leaderboard choice

Whether you chose to be listed on the public leaderboard on the programs page, and when. Only individual marketers can choose it, it is off until you turn it on, and visitors see only a place and a number of qualified sign-ups this month: never your name or anything else about you.

Programs

Your applications and the answers you give, the decision on each, your memberships, and each agreement you accept with its version, the time and your IP address.

Links and results

The tracking links and codes you create, their labels and sub-IDs, and the clicks, conversions and commissions credited to you.

Payee and payout details

Legal name, payee type, organisation number, VAT number, postal address, country, invoice email and currency. Bank account: account holder, country and the account number, which is stored encrypted; only the last four digits are displayed. Verification documents and invoices you upload. Settlements, statements, payouts and their references.

Communication

Notifications we send you, your notification settings, the emails we have queued or sent, disputes you raise and what was decided.

Consent and audit records

Which version of these terms and this policy you accepted, when, and from which IP address. An audit log of changes made to your account and money, by you or by our staff.

Internal notes and risk

Notes our partner managers write about the partnership, and signals raised by fraud checks on your traffic or conversions.

When someone follows a partner’s tracking link, our redirect records the click and sends them on: a phone to the app’s page in the App Store or Google Play, a computer to the app’s website or a page with a QR code. We record:

• which link was clicked, and when
• a one-way hash of the IP address (we do not store the address itself)
• the browser’s user agent and the page the click came from
• the country, as reported by our network provider
• a random identifier stored in a cookie in that browser
• whether the link was opened from a QR code, and whether it was on an iPhone, an Android phone or another device
• where the click was sent: the App Store, Google Play, the app’s App Clip or the app’s own link

We do not know who the person is. The IP hash and the user agent are removed 90 days after the click; the rest of the click record is kept as the history of the link. The cookie is described on the cookies page.

When you tap a partner’s Flow link on a phone, we also keep a keyed hash of your IP address (never the address itself), together with the phone’s model, screen size, operating system version, language and time zone, as far as the browser or our network provider gives them. If the app you install after the tap checks with us the first time it starts, we compare them, so that the partner who sent you can be credited even though the app store passes nothing on.

We keep them for 24 hours, or for the period the app has chosen, at most 72 hours, and then delete them. Once they have matched an install, they are not used to match anything else. At its first start the app sends the same kinds of details, with a random id for the installation, only for this comparison.

When they match, we keep a record with the tap: the installation’s random id, a score for how sure the match is, and which details agreed. It holds none of the details themselves, and is kept as long as the tap it belongs to.

The legal basis is legitimate interest: Flow Group’s and the advertiser’s interest in crediting the partner who brought the install (article 6.1 f).

We keep daily totals of views of the landing page, clicks on its buttons, views of the sign-up page, BankID identifications started and finished on the sign-in and sign-up forms, accounts created on the sign-up form, and views of the programs page and clicks on its sign-up button while we test a leaderboard there, by version of the page. A total is only a number for a day: it holds no IP address, browser details, cookie or identifier, and it cannot be connected to you or to any other count.

To add to a total, the server handles two things in passing and keeps neither: a one-way hash of your IP address, used for one minute to stop abuse, and the browser’s user agent, used to leave out search-engine crawlers. How it works is described on the cookies page.

When a person who came through a partner link or code signs up to an app, the app tells us so that the partner can be credited. The app sends its own identifier for that user, the type of event (for example a registration, a verified account, a purchase or a new subscription), the time, the country, any amount involved and the reference of the click. We do not receive their name, email address or other contact details.

Partners see that a conversion happened, when, and what it earned. They are never shown the app’s user identifier or anything else that identifies the person.

Some apps had their own invite-a-friend scheme before it moved here. For those we have imported the app’s identifiers for users who had invited others, with the country, the number of people they invited and the rewards they received, so that existing invites keep working.

To run your account and the programs you join

Creating the account, tracking links, crediting conversions, calculating commissions, settlements and payouts, handling disputes, sending service messages. Legal basis: the agreement with you (GDPR article 6.1 b).

To keep accounts and pay tax

Statements, invoices, payouts, VAT treatment and the ledger behind them. Legal basis: legal obligation (article 6.1 c), mainly the Swedish Accounting Act and tax law.

To attribute clicks and conversions

Recording clicks and matching them to sign-ups reported by the apps, for people who are not our partners. Legal basis: our and the partner’s legitimate interest in paying the right partner for a referral (article 6.1 f).

To see whether the landing page works

Daily totals of visits, which are not personal data. The brief handling of a hashed IP address and the user agent while counting rests on our legitimate interest in understanding how the site is used and keeping the counting free from abuse (article 6.1 f).

To prevent fraud and keep the service secure

Sign-in records, new-device alerts, IP hashes on clicks, risk signals, the audit log. Legal basis: legitimate interest (article 6.1 f).

To prove what was agreed

Records of accepted terms and agreements. Legal basis: legitimate interest in being able to show what was agreed (article 6.1 f).

To tell you about programs and activity

Emails about applications, commissions and payouts. Legal basis: the agreement with you. You can turn off every category except security messages under Settings → Notifications.

Whether a conversion qualifies is decided automatically from the published rules of the program, and automated checks can flag traffic for review. Decisions that affect money you have already been approved for are made by a person. You can dispute any commission or rejection from the portal and a member of staff will review it.

We do not sell personal data and we do not share it for anyone else’s marketing. It is disclosed to:

• The apps you promote, which are part of Flow Group: the link or code and click reference, so the app can report sign-ups back, and any in-app reward it should credit to one of its own users.
• Our staff who manage partners, programs and finance, limited by role.
• Companies that process data for us under a data processing agreement, listed below.
• Banks, auditors and authorities, such as the Swedish Tax Agency, where a payout or the law requires it.
• Google, only if you choose to sign in with Google, and only to confirm who you are.
• The provider of our BankID connection, only if you choose to use BankID, and only to confirm who you are.

Hosting and database

[Hosting and database provider, with region]

Email delivery

[Email delivery provider]

File storage

[File storage provider, with region]

Error monitoring

[Error monitoring provider, or "none"]

Payouts

[Bank used to make payouts]

Accounting

[Accounting system]

BankID connection

[Provider of the BankID connection: the API uses YFlow’s authentication service; confirm its role and region]

Transfers outside the EU/EEA

[Confirm against the final list: whether any provider processes personal data outside the EU/EEA, and the safeguard used, such as the EU standard contractual clauses]

Sessions

Expire after 30 days and are then deleted. One-time links (email verification, password reset) are deleted a week after they are used or expire.

Click details

The IP hash and user agent are removed after 90 days. The click itself is kept without them.

Install matching

The IP hash, phone model, screen size, operating system version, language and time zone kept from a tap are deleted after 24 hours, or after the app’s chosen period of at most 72 hours.

Visit totals

The daily totals hold nothing about a person and have no set end date. The hashed IP address used while counting is forgotten after a minute.

Email records

Records of emails we have sent are deleted after 30 days.

App events

Events an app sends about a user who did not come through a partner count for nothing and are deleted after 30 days. Events about users who did are kept with their conversion.

Your account and profile

For as long as you have an account. See below for what happens when you delete it.

Financial records

Commissions, settlements, statements, invoices, payouts and the payee’s legal details are kept for 7 years after the end of the calendar year in which the financial year closed, as the Swedish Accounting Act requires. This applies even after your account is deleted.

Consent and agreement records

Kept after deletion as proof of what was accepted, without the IP address.

Get a copy

Download everything we hold about your account as a JSON file under Settings → Privacy. This also serves as data portability.

Correct

Change your name, email address, profile, channels and payee details yourself in the portal. Write to us for anything you cannot change there.

Delete

Request deletion under Settings → Privacy. The account is closed after 30 days, and you can cancel during that time. Your name, email address, sign-in details, profile, channels and application answers are then erased, and your links stop working. Financial records are kept as described above, attached to an anonymous account. Deletion waits while approved commissions are still to be paid out.

Object or restrict

You can object to processing based on legitimate interest, such as click tracking and fraud checks, and ask us to restrict processing while a question is being resolved.

Email choices

Turn off any notification category except security under Settings → Notifications.

If you do not have an account, for example because you clicked a link, write to [privacy contact email]. We answer within one month. Because we do not know who clicked a link, we may need details from you to find the record.

You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or to the authority in the EU country where you live.

• Passwords are stored only as salted hashes. Bank account numbers and two-factor secrets are encrypted in the database.
• Two-factor authentication is available to every partner and required for our staff.
• You are told by email when your password, email address, two-factor setting or bank details change, and when a new device signs in.
• Staff access is limited by role and recorded in an audit log.
• You can see where you are signed in, and end any session, under Settings → Security.

When we change this policy we publish the new version here with its version number and date. If a change affects how we use your data in a way you would not expect, we tell you by email or in the portal before it takes effect. The version you accepted is saved with your account.