Privacy Policy
Last updated: 24 May 2026
KSHF is operated by FLOW PLUS FOR COMPUTERS AND INFORMATION SYSTEMS (فلو بلس لأنظمة المعلومات والحاسب الآلي), Dubai, United Arab Emirates. FLOW PLUS FOR COMPUTERS AND INFORMATION SYSTEMS is the data controller for the personal data described in this policy. Contact the controller at kshf@flowplus.ae.
1. Data we collect
We collect: (a) Account data — email address, name if provided via Google OAuth, and hashed password. (b) Website data — the URLs you submit for scanning, the HTML content of scanned pages (temporarily, for processing only), and scan results. (c) Payment data — we do not store card numbers; all payment processing is handled by Stripe. We receive a Stripe customer ID and payment intent ID. (d) Usage data — IP address (hashed), browser user-agent, timestamps of scan and fix-job events. (e) Cookies — a session cookie (httpOnly) and a language preference cookie (kshf_lang).
2. How we use your data
We use your data to: deliver the AEO scan report and fix package you requested; send transactional emails (email verification, password reset, delivery of your fix package); prevent abuse via rate limiting on hashed IP; improve service quality by reviewing aggregated (non-PII) scan metrics; comply with applicable UAE law.
3. Data sharing
We share data with: Stripe (payment processing, UAE/US data transfer under Stripe's DPA); Mailjet (transactional email delivery, EU region); Cloudflare R2 (fix package storage, UAE/EU region); Railway / Neon (infrastructure, US region). We do not sell your data to any third party.
4. Data retention
Scan HTML content: deleted from our systems within 30 days of fix-job completion. Scan results and fix packages: retained for 12 months after the order, then deleted unless you request earlier deletion. Account data: retained until you delete your account. Hashed IPs: retained for 90 days.
5. Your rights
You may request: access to your personal data; correction of inaccurate data; deletion of your account and associated data; export of your data in JSON format. Requests: kshf@flowplus.ae. We respond within 30 days.
6. Security
Passwords are hashed with Argon2id. Session tokens are hashed before storage. Fix packages are stored in Cloudflare R2 behind signed URLs valid for 24 hours. All traffic is TLS-encrypted.
7. Cookies
We use one session cookie (httpOnly, Secure, SameSite=Lax) and one language preference cookie (kshf_lang, non-httpOnly so the client can read it for RTL switching). No third-party advertising cookies.
8. Changes
We will notify registered users of material changes via email at least 14 days in advance. Continued use after the effective date constitutes acceptance.
9. Contact
FLOW PLUS FOR COMPUTERS AND INFORMATION SYSTEMS — kshf@flowplus.ae