Who we are
BuffyFlow (“BuffyFlow,” “we,” “us,” or “our”) is a mobile point-of-sale (POS), invoicing, and inventory application operated by Grapzian (Pvt) Ltd (“Company”).
Contact: support@grapzian.com · No 957/A/1, Paradise lane, Ragama · Website: buffyflow.grapzian.com
This Privacy Policy explains how we collect, use, store, share, and protect information when you use the BuffyFlow mobile app (Android/iOS) and related services (the “Service”).
Scope
This policy applies to:
- The BuffyFlow mobile application
- Account setup, business configuration, and optional cloud sync
- Communications related to the Service
It does not cover third-party websites, payment processors, or Google services beyond what we receive through Google Sign-In / Firebase.
1. Information we collect
A
Account & identity (Google Sign-In)
When you sign in with Google, we may receive:
- Google account identifier
- Name
- Email address
- Profile photo URL (if provided by Google)
We use Google Sign-In / Firebase Authentication. We do not receive or store your Google password.
B
Business & organization data
You or your organization may provide:
- Business/shop name and profile details
- Payment method preferences, bank details, VAT/tax identifiers (if entered)
- Invoice branding and display settings
- Organization/shop membership and plan-related settings
C
Operational / POS data (created by you)
Depending on how you use BuffyFlow, this may include:
- Products, SKUs, barcodes, prices, images, stock levels, batches
- Customers (e.g. name, mobile number, email, address, notes)
- Sales, quotations, invoices, payments, discounts, delivery amounts
- Inventory movements, restocks, adjustments
- Printer pairing preferences and similar device settings
Important: On Basic / offline use, much of this data is stored on your device. With paid cloud sync enabled, selected data may also be synced to our cloud systems.
D
Device & technical data
We may collect:
- Device identifiers generated by the app (e.g. install/device ID)
- Platform, OS version, model/manufacturer
- App version / build number
- Locale, timezone
- Approximate last-seen time for registered devices
- Push notification token (FCM/APNs), if notifications are enabled
- Basic diagnostics/crash/analytics events (when monitoring is enabled)
E
Network / sync metadata
When cloud features are enabled, we may process sync-related metadata such as sync status, timestamps, and conflict-resolution identifiers needed to keep devices consistent.
F
Permissions
With your permission, the app may access:
- Camera (product photos, barcode scanning)
- Photos/media (product images)
- Bluetooth (receipt/thermal printers)
- Notifications (alerts)
You can revoke permissions in device settings; some features may stop working.
2. How we use information
We use information to:
- Create and manage your account and organization
- Provide POS, inventory, invoicing, printing, and dashboard features
- Save data locally on your device and, where enabled, sync to the cloud
- Authenticate you securely via Google/Firebase
- Register devices for security, support, and (where applicable) plan/device limits
- Send push notifications you have allowed
- Improve reliability (crash reporting / analytics, if enabled)
- Comply with law and enforce our Terms
- Communicate service-related notices
We do not sell your personal information.
3. Legal bases (where applicable)
If required by applicable law (e.g. GDPR-style regimes), we process data based on:
- Contract — to provide the Service you requested
- Legitimate interests — security, fraud prevention, product improvement
- Consent — notifications, certain device permissions, optional analytics where required
- Legal obligation — where we must retain or disclose information by law
4. Where data is stored
On-device (local-first)
BuffyFlow is designed so sales, stock, and invoices can be stored locally on your phone/tablet first. Local storage may include databases and caches on the device.
Cloud (when enabled)
Depending on configuration and plan, we may use:
- Firebase (e.g. Authentication, configuration templates, monitoring)
- Supabase (e.g. organization/membership data and paid cloud sync of POS-related records)
Cloud infrastructure may be hosted in regions operated by those providers. Exact regions depend on our provider configuration.
6. Retention
- Account/profile data: while your account is active and as needed afterward for legal/security purposes
- Local device data: until you delete it in-app, clear app data, or uninstall (uninstall may not remove cloud copies)
- Cloud-synced business data: while your organization uses the Service and for a reasonable period after deletion/closure, unless law requires longer
- Device/push tokens: while the device is registered / active, and until refreshed or revoked
- Logs/diagnostics: for limited operational periods
If you request account deletion, we will delete or de-identify personal data we control, subject to legal retention needs and residual backups for a limited time.
7. Your choices & rights
Depending on your location, you may have rights to:
- Access, correct, or update your information
- Delete your account/data using the in-app flow described in Delete data (irreversible)
- Export or receive a copy of certain data (where available)
- Withdraw consent (e.g. notifications/permissions)
- Object to or restrict certain processing
- Lodge a complaint with a supervisory authority
To exercise rights, contact support@grapzian.com. We may need to verify your identity.
Organization data: If you are a staff member, some requests may need to go through your business owner/admin.
8. Children
BuffyFlow is intended for business use by adults. We do not knowingly collect personal information from children under 16 (or the minimum age in your country). If you believe a child provided data, contact us to delete it.
9. Security
We use reasonable technical and organizational measures, including:
- Authentication via Google/Firebase
- Encrypted transit (HTTPS/TLS) for cloud communication
- Access controls and least-privilege practices for backend systems
- Local-device storage protections provided by the OS
No method of storage or transmission is 100% secure. Protect your Google account and device lock screen.
10. International transfers
If you access the Service from outside the country where our providers host data, your information may be transferred internationally. Where required, we rely on appropriate safeguards offered by our providers or applicable legal mechanisms.
11. Push notifications
If you enable notifications, we store a push token against your registered device to deliver messages (e.g. operational alerts). You can disable notifications in device settings; the token may remain until refreshed or cleared.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date and, where required, provide additional notice in the app or by email.
13. Delete data
You can permanently delete your BuffyFlow data from inside the app. This is irreversible. Sign out only ends your session; it does not delete your data.
Delete from the BuffyFlow app
- Open BuffyFlow on the phone or tablet where you are signed in with Google.
- Tap More in the bottom navigation bar.
- Scroll to the bottom of the More screen. You will see Sign Out, then a red delete button.
- If you are the business owner, tap Delete Account & All Data. If you are a team member (not the owner), tap Delete My Account.
- Read the warning. The app will ask you to confirm.
- Type DELETE in the confirmation field (all capitals), then tap Delete. You can tap Cancel to stop.
- Wait while the app shows Deleting your account…. Do not close the app until it finishes.
- On success you are signed out and returned to the login screen. On failure you will see Could not delete your account — stay signed in and try again with a connection, or contact us.
If you are the business owner
Delete Account & All Data permanently deletes your business, including all shops, products, inventory, invoices, team members, and synced cloud data.
If you are a team member
Delete My Account permanently removes your access and deletes your local data and Google login for BuffyFlow. The owner’s business data stays unless they delete it themselves.
What is deleted
- Local data on this device (sales, stock, invoices, caches, and stored settings)
- For owners: organization and shop records in the cloud, including products, customers, invoices, memberships, and synced backups
- For team members: your membership in that business
- Your BuffyFlow Google Sign-In session for this app
What this does not do
- Uninstalling BuffyFlow or clearing Android/iOS app storage removes local data only. It does not delete a cloud-synced business. Use the in-app delete flow for that.
- Signing out does not delete data.
- Deleting a single product or invoice in the catalog is not the same as deleting your account.
- Residual backups we control may remain for a limited time, and we may keep records where law requires it.
Use a network connection so cloud records can be removed while you are still signed in. If you cannot open the app, email support@grapzian.com from the Google account you used in BuffyFlow and we will verify your identity before processing a deletion request.
14. Contact
Privacy questions or requests: