Privacy Policy
Last updated: 29 August 2026
FlowScan is a warehouse management app for businesses. It is operated by Think Team Sdn Bhd, Tingkat 2 No 1 Jalan P4/8B, Palm Industrial Park, Bandar Teknologi Kajang, 43500 Semenyih, Selangor, Malaysia ("we", "us"). This policy explains what we collect when you use the FlowScan mobile app, why we collect it, and what you can do about it.
Who the data belongs to
FlowScan is sold to organizations. When you sign in, you join an organization workspace, and the warehouse records you create — inventory, orders, deliveries, quality checks, documents — belong to that organization, not to us. Your employer's administrators can see and manage that data. We process it on their behalf.
What we collect
| Data | Why |
|---|---|
| Email address, full name | To create your account, sign you in, send password resets, and show who performed an action to colleagues in your organization. |
| Account identifier and organization role | To decide what you are allowed to see and do in your workspace. |
| Warehouse records you enter (items, quantities, barcodes, orders, suppliers, customers, delivery details, notes) | This is the product. It is stored so your organization can run its operations. |
| Photos and documents you attach | To evidence quality checks, damage, and delivery proofs. |
| Diagnostic logs (errors, timestamps) | To find and fix faults. |
What we do not do
- We do not sell your data.
- We do not use it for advertising, and the app contains no ads.
- We do not track you across other companies' apps or websites, and we run no third-party analytics or advertising SDKs in the app.
- We do not use your organization's warehouse data to train machine learning models.
Camera, photos and biometrics
The camera is used only while a scanner screen is open, to read barcodes and QR codes, and to take photos you choose to attach. Barcode scanning happens on your device; camera frames are not uploaded.
If you turn on Face ID, Touch ID or fingerprint unlock, the check is performed by your device's operating system. FlowScan is told only whether the check passed. We never receive or store your biometric data.
Where your data is stored
Application data is hosted on Supabase (PostgreSQL and object storage). Transactional email — password resets, order and delivery notifications — is sent through Resend. These providers process data on our instructions as sub-processors. Data in transit is encrypted with TLS; data at rest is encrypted by the hosting provider.
International transfers
We are based in Malaysia, and the sub-processors named above operate data centres outside your country. If you use FlowScan from the United Kingdom, the European Economic Area, or another country with data export rules, your personal data will be transferred outside that country to be processed by us and by those sub-processors.
Where such a transfer is subject to the UK GDPR or the EU GDPR, we rely on the European Commission's Standard Contractual Clauses (together with the UK International Data Transfer Addendum where the UK GDPR applies), which we have in place with our hosting and email sub-processors. You can request a copy of the relevant transfer mechanism by emailing info@thinkteam.biz.
How long we keep it
Account and warehouse data is kept for as long as your organization has an active workspace. When you delete your account, your account record is removed immediately. If you were the only member of an organization, that organization and its records are deleted with you. Billing and invoice records are kept for as long as tax and accounting law requires. Deleted data may persist briefly in encrypted backups before those backups age out on their normal rotation.
Deleting your account
You can permanently delete your account from inside the app: Settings → Account → Delete Account. This cannot be undone. Full deletion instructions, including what is deleted and what is kept.
If you are the only administrator of an organization that still has other members, promote another administrator first — otherwise your colleagues would be locked out of their own workspace.
You can also email info@thinkteam.biz and we will action the deletion for you.
Controller and processor roles
For your own account details — your name, email address and organization role — we act as the data controller. For the warehouse records your organization enters into FlowScan, your employer is the controller and we act as a processor on their documented instructions.
Why we are allowed to process your data
Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:
| Processing | Legal basis |
|---|---|
| Creating and operating your account, providing the app to your organization | Performance of a contract (Art. 6(1)(b)), or our legitimate interest in serving our business customer where the contract is with your employer (Art. 6(1)(f)) |
| Keeping the service secure, diagnosing faults, preventing abuse | Legitimate interests (Art. 6(1)(f)) |
| Sending transactional email such as password resets and delivery notifications | Performance of a contract (Art. 6(1)(b)) |
| Meeting legal, tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
We do not process special category data, and we do not use your data for automated decision-making or profiling that produces legal effects.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to complain to a data protection authority. To exercise any of these, email info@thinkteam.biz. We respond within 30 days.
Because warehouse records belong to your employer, requests about that data may be forwarded to your organization's administrators to action.
If you are in the United Kingdom or the EEA
You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing carried out on the basis of our legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out. You will not be charged for exercising these rights, and we will not treat you differently for doing so.
If you are unhappy with how we have handled your data you may complain to your local supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk).
If you are in California
Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to know what personal information we collect and why, the right to request deletion or correction of it, and the right to not be discriminated against for exercising those rights.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" link; there is nothing to opt out of.
We collect the categories of personal information described in the table above — identifiers, and your own commercial and employment-related records — for the business purposes stated there. We retain them for the periods described under "How long we keep it". We do not knowingly collect or sell the personal information of minors under 16.
If you are in Australia
You may access and correct your personal information as described above. Complaints about our handling of your personal information can be sent to info@thinkteam.biz; if you are not satisfied with our response you may escalate to the Office of the Australian Information Commissioner.
Children
FlowScan is a workplace tool and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes
If we change this policy we will update the date above and, for material changes, notify account holders by email before the change takes effect.
Contact
Think Team Sdn Bhd
Tingkat 2 No 1 Jalan P4/8B, Palm Industrial Park,
Bandar Teknologi Kajang, 43500 Semenyih,
Selangor, Malaysia
info@thinkteam.biz