پرائیویسی پالیسی

AquaFlow Privacy Policy

Version 1 — Last updated 30 August 2026

In short

• AquaFlow is made by COULTR (registration number 4220118816267), in Karachi, Pakistan.
• There are two different roles in this policy. For your business account and your staff, we decide how information is used. For your customers' information, you decide — we only hold and process it for you, on your instructions.
• A rider's location is recorded once per delivery, at the moment they tap to mark it, while the app is open on screen. There is no background tracking, and we never follow a rider between stops.
• If a rider refuses the location permission, the delivery still goes through. We record why there is no location instead of pretending there is one.
• Staff and customer records are strictly separated by business. One water supplier can never see another supplier's data.
• Very few outside companies are involved: an email service, and Expo for building and updating the mobile app. There is no push service, no SMS provider, no payment gateway, no advertising network and no analytics tracker in AquaFlow.
• We do not have an automatic delete-after-X-months system. If you want data removed or exported, email [email protected] and we do it by hand, normally within 30 days.

1. The most important thing in this policy: who decides what

AquaFlow holds two very different kinds of information, and the law treats them differently.

Where we decide (we are the controller)

• Your business account: business name, owner name, city and address, contact number and email, your plan, your bills and payments.
• Your staff accounts: name, mobile number, email, role, and sign-in records.
• Devices used to sign in, and technical logs of requests to our service.

For these, we decide what is collected and why, and this policy explains it.

Where you decide (you are the controller and we are the processor)

• Everything about your customers: their name, mobile number, delivery address, area, what they ordered, what they paid, what they owe, and the location captured at their door.

You put that information into AquaFlow. We store it, keep it safe, show it back to your staff, and calculate things with it — because you asked us to. We do not decide what to do with it, we do not use it for our own purposes, and we do not sell it or share it with other suppliers.

What this means for your customers: if one of your customers wants to see, correct or delete what is held about them, they should ask you first, because it is your record. If they ask us, we will point them to you and help you answer.

2. Information about your business

We hold: business name, owner's name, contact number and email, city, address and area, timezone and currency, your plan and status, your bills, the payments you made and how, and notes our support team writes when helping you.

We use it to open and run your account, to bill you, to support you, and to keep our own accounts.

3. Information about your staff

For every staff account you create we hold: name, mobile number (this is the sign-in), email if you add one, role, whether the account is active, when it was deactivated and the reason, the app version they are on, their language and light/dark preference, when they last signed in, failed sign-in attempts, and the encrypted form of their password. We never store a readable password.

We also hold employment-related records that you create in AquaFlow, because that is what the product is for:

• pay setup (salary amount, pay cycle, commission basis and rate);
• what each rider earned per delivery, and the pay runs that settled it;
• advances given and repaid; and
• performance figures per period — deliveries completed, how close the captured location was to the customer's home point, cash collected, and how often a location was captured at all.

Performance figures are evidence for a conversation, not an automatic decision. AquaFlow does not fire anyone, dock anyone's pay by itself, or make any decision about a person without a human in the middle.

4. Information about devices and sign-ins

When someone signs in we record: a device identifier the app generates, the platform (Android or iOS), the OS version, the brand and model of the phone, the app version, when the device was first and last seen, and whether it has been blocked.

For each session we record: the time it started, the time it was last used, when it expires, the IP address and the user agent of the request, and if it was revoked, when and why.

Why: to enforce the two-device limit, to let an owner see and block a lost or stolen phone, to sign out a device that should no longer have access, and to investigate a suspected account sharing or a security incident.

5. Information about your customers (which you enter)

For each customer of yours, AquaFlow holds:

• the mobile number, stored in international form;
• the name, email and delivery address as your business typed them — each supplier keeps their own copy, so if two suppliers serve the same household they never see each other's version;
• the area or locality;
• a "home point" — a latitude and longitude for the customer's door, built up from the locations captured at deliveries, or set by hand;
• their product subscription, price, discount and status;
• every delivery: what was handed over, how many, the amount, the time, the rider, and the location captured at that moment;
• money: deposits paid, cash collected, discounts given, debts written off, and the resulting dues; and
• notes your staff write on any of the above.

Your customers do not have AquaFlow accounts and do not sign in to anything of ours. We have built the account fields for a future customer app, but that app does not exist yet and nothing signs in through them today.

6. Rider location — exactly what happens, and nothing more

This section is deliberately precise, because location is the part people worry about most.

When it is captured. Once, at the moment a rider taps to mark a delivery. Not before, not after, not on a timer.

Only while the app is open. The app asks only for the "while using the app" permission. There is no background location permission, no location tracking service, and no code anywhere in the app that watches position over time. When the rider closes AquaFlow or puts the phone in their pocket, AquaFlow is not recording where they are.

What is stored with the delivery.

• latitude and longitude;
• the phone's own estimate of how accurate that reading is, in metres; and
• a short status code saying whether a location was obtained and, if not, why.

When the rider says no. The delivery is never blocked. A rider standing at a door with the permission refused can still record the delivery and get on with their round. Instead of a location we save the reason:

• the permission was refused;
• location is switched off on the whole phone;
• the phone was allowed to look but no signal arrived in about eight seconds; or
• the phone could not provide a location at all.

Asking again. Before the phone's own permission dialog appears, the app explains in plain words what location is for. If the rider says no, the app does not ask again for seven days, and never twice in one session. If the rider has permanently refused, the app stops asking and simply points to the phone's settings, because the system dialog will not appear again.

Weak readings are kept, not hidden. A reading accurate to only a few hundred metres is saved and marked as weak. "Weak" is a fact the office can act on. Pretending it is a good reading, or dropping it silently, would not be.

Who sees it. The rider who made the delivery, and the owner, manager and accountant of that same business. Nobody at another supplier. We at COULTR can see it only when we need to investigate a fault or a support request.

What we do not do. We do not build a route history. We do not have a live map of where riders are. We do not share rider location with any advertiser, insurer or third party. We do not use it for anything other than showing your business where a delivery was marked.

7. Delivery records and the home point

Each delivery keeps its captured location permanently, as the evidence for that stop.

Separately, AquaFlow keeps a small number of recent captures per customer to work out where that customer's door actually is. Older ones are dropped as new ones arrive. Once several independent captures agree, the home point is treated as confirmed and later deliveries are measured against it. Until then, no rider is scored against a point they supplied themselves.

8. Information from our website

If you fill in the trial request form on our website we collect your business name, your name and your WhatsApp number, plus the page you came from, your IP address and your browser's user agent. We keep that as a record of the enquiry and use it to contact you about setting up a trial. We do not run advertising trackers or analytics scripts on the site.

9. Why we hold each kind of information

• To run the service — accounts, sign-ins, deliveries, dues, payroll, reports.
• To keep it secure — device limits, session records, rate limits, sign-in lockouts, and logs we can look at after an incident.
• To bill you and keep our books — plans, invoices, payments.
• To support you — support tickets, notes, and the emails we send you about your account.
• To meet legal duties — records we are required to keep, and lawful requests we are required to answer.

We do not use your data, or your customers' data, for advertising.

10. Who can see what inside AquaFlow

Between businesses: nothing is shared. Every record is tied to one supplier account and every request is filtered by it. If two suppliers happen to serve the same household, each sees only their own name, address, orders and dues for that person, and neither can see the other exists. This is tested by an automated isolation check before releases.

Inside your business, by role:

• Admin — everything, including plan and billing.
• Manager — everything operational, but not plan changes.
• Accountant — customers, sales, cash, expenses, salaries and the ledger. Can give a discount; cannot write off a debt.
• Rider — their own deliveries, their own sales, and only the customers assigned to them.

The same rules apply to work recorded offline and sent later. There is no path that skips them.

At COULTR: a small number of our staff can reach production data through our support panel, so we can investigate faults and answer your questions. Administrative actions are written to an audit log.

11. Other companies that help us run AquaFlow

We keep this list short on purpose, and it lists only what the software actually uses.

• Email delivery. We send account, billing and support emails through an email delivery service. That service sees the recipient address and the contents of the message.
• Expo (Expo Application Services). We build the mobile app with Expo and deliver app updates through it. When the app checks for an update it contacts Expo's update service. No customer records are sent to Expo.
• Our hosting and connectivity providers, who operate the server and network the service runs on.

There is no push-notification service, no SMS gateway, no payment gateway, no advertising or analytics platform, and no crash-reporting service connected to AquaFlow. Notifications inside the app are fetched by the app from our own service and shown by the phone itself; they never travel through a third-party push network.

If we add a sub-processor that handles personal data, we will update this policy and, where the change is material, ask you to accept the new version.

12. Where the service runs

AquaFlow runs on a server we manage, with a PostgreSQL database, reached over HTTPS at api.aqua.coultr.com.

Some of the services listed above may process data outside Pakistan. If we move the main service to hosting outside Pakistan, we will say so in an updated version of this policy before we do it.

13. How we protect information

These are measures that are actually in place today:

• Encrypted connections. All traffic between the apps and our service is over HTTPS. A production build of the mobile app refuses to be built without a secure address.
• Passwords are never stored in readable form. They are stored as a salted scrypt hash.
• Sign-in tokens are not stored. Only a SHA-256 hash of each session's secret is kept, so even a copy of our database would not hand over a live session. Sessions can be revoked one at a time, per device, or all at once.
• Short-lived access, rotating refresh. An access token lasts 8 hours; renewing it rotates the refresh token. A blocked device is checked at sign-in, at renewal and on every single request.
• Two devices per account, with blocking, as described in the Terms.
• Sign-in protection. Five wrong passwords lock an account for fifteen minutes, and sign-in attempts are rate limited by both number and network address. Wrong number, wrong password and locked account all return the same message, so nobody can use the sign-in screen to find out which numbers are registered.
• Role-based permissions enforced on the server for every action, including actions replayed from a phone that was offline.
• Tenant isolation — every query is scoped to one supplier.
• On the phone, the offline copy is encrypted. The mobile app keeps its local cache and its queue of unsent work in a SQLCipher-encrypted database, with the key held in the phone's secure storage (Android Keystore / iOS Keychain). Sign-in tokens are kept in the same secure storage, not in ordinary app files.
• Standard web hardening on the service: security headers, a restricted cross-origin policy, request rate limits, and input validation on every endpoint.
• Audit logging of administrative actions.

No system is perfectly secure, and we do not claim to hold any security certification.

14. How long we keep information

We are honest about this rather than tidy: AquaFlow does not delete anything by itself.

• Business and customer records are kept for as long as your account exists, and after it ends, until you ask us to remove them.
• Delivery records, including their captured locations, are kept permanently as the evidence for that delivery.
• Money records — invoices, payments, deposits, adjustments — are never deleted by the product. A correction is recorded as a new entry that reverses the old one, so the trail stays complete.
• Staff who leave are deactivated, not deleted. Their history stays with your business and their number is freed for their next employer.
• Sessions expire on their own and revoked sessions stop working immediately, but the session record remains.
• We keep invoices and related accounting records for as long as the law requires.

There is no automatic purge after a fixed number of months. If you want that for your account, tell us and we will do it as a manual task.

15. Getting a copy of your data, or having it deleted

AquaFlow does not yet have a self-service export or delete button. We do this by hand.

Email [email protected] from the owner's registered email address or number and tell us what you want:

• a copy of your business's data;
• correction of something we hold about your business or your staff; or
• deletion of your data, in whole or in part.

We will confirm your identity, then aim to complete the request within 30 days. If a request is unusually large we will tell you and agree a timetable.

What we cannot do: delete records we are legally required to keep, and delete data on behalf of another business.

16. Rights of your staff

If you are a member of staff using AquaFlow at work:

• You can see and change your own name, email, language and theme in the app.
• You can see every device signed in to your account, and remove any of them.
• Your employer can see your deliveries, the locations captured with them, the cash you collected, your pay setup and your performance figures. That is the purpose of the product, and your employer decides how those records are used.
• To see, correct or delete your employment records, ask your employer first — they are the controller for that information.
• If your employer will not help, or the question is about the account itself, write to us at [email protected] and we will do what we reasonably can.

17. Rights of your customers (the households you deliver to)

If you are a household that receives water from a supplier using AquaFlow:

• Your details are held by your supplier, not by us. Your supplier decides what is recorded and how it is used.
• To see, correct or delete your details, or to ask why a location was recorded at your address, please contact your water supplier. They can make the change themselves in the app.
• If you cannot reach them, or you believe your details are being misused, write to us at [email protected]. We will pass the request to the supplier and support them in answering it. We will not change or delete another business's records without their instruction, unless the law requires us to.

18. Children

AquaFlow is a tool for businesses and is not meant for children. We do not knowingly collect information about children. Staff accounts must belong to people aged 18 or over. If you believe a child's information has ended up in AquaFlow, tell us and we will work with the supplier concerned to remove it.

19. If something goes wrong

If we discover a security incident that affects personal data, we will:

• act to contain it;
• tell the affected businesses without undue delay, and in any event within 72 hours of confirming it, describing what happened, what data was involved and what we are doing;
• help you tell your own customers where that is needed; and
• report it to any authority we are legally required to report it to.

20. Changes to this policy

Every version of this policy has a number and a date. When we make a material change — new information collected, a new purpose, a new sub-processor — the app shows you the new version and asks you to accept it before you carry on. Small corrections are published with an updated date.

21. Contact

COULTR — AquaFlow Registration number: 4220118816267 Karachi, Pakistan Email: [email protected]

We do not have a formally appointed data protection officer. Privacy questions go to the address above and are answered by us directly.