Flock · ITL World
Effective 28 August 2026 · Last updated 28 August 2026
This policy explains what information the Flock application collects, why, who it is shared with, and how you can ask about or remove it. Flock is a business travel-reporting service operated by ITL World. It is not a consumer app: accounts are created and issued by ITL World for its own staff and for authorised users at its corporate client organisations. There is no public sign-up.
Flock is provided by ITL TOURISM & TRAVEL LLC (“ITL World”, “we”, “us”), registered at Office No. 104, 1st Floor, Centurion Star Tower A, Deira, Dubai, United Arab Emirates (P.O. Box 122358).
For any question about this policy or about your information, contact privacy@itlworld.com.
This policy applies to the Flock mobile application for Android and iOS, and to the Flock website at flock.itlworld.com that the application displays. The mobile application does not hold its own copy of your data — it is a secure window onto the same service, so what is described here applies equally whether you use a phone or a browser.
Flock handles information about you as a user of the app, and separately, business travel records belonging to a client organisation. These are treated differently, and your rights differ between them.
| Information | Whose it is | Our role |
|---|---|---|
| Your account and how you use the app | Yours | We decide how it is used — we are the controller |
| Corporate travel records, including traveller names and itineraries | The client organisation that booked the travel | We hold and process it on their instructions — we are a processor |
If you are a traveller whose trip appears in Flock and you want that record corrected or removed, the request must go through your own employer, because the record belongs to them and not to us. We will act on their instruction.
Your name, work email address, the organisation and business unit you belong to, your assigned role, your default currency, and who issued your account. This is entered by an ITL World administrator when your account is created — you do not register yourself.
Your password, which is never stored in readable form. It is converted into a one-way cryptographic hash, and the original cannot be recovered from what we hold — not by us, and not by anyone who obtained a copy of our database. We also store a session cookie that keeps you signed in for up to eight hours of activity.
We keep a record of pages you open and reports you download, with the date, time and network address. This exists so that access to commercially sensitive information can be traced — it is a security and accountability measure, not a marketing one.
Flock includes an assistant that answers questions about your reports in plain language. Your questions and the answers given are stored so you can refer back to them. See section 6 for who processes them.
Flock reports on corporate travel booked through ITL World. Those records can include traveller names, journey dates, routes and destinations, airline and hotel details, ticket numbers, and amounts paid. You only ever see the records your role and organisation permit — the system restricts this on every request, not just in the menus.
Device type, operating system version, application version and network address, used to deliver the service and to diagnose faults.
Being explicit about this, because these are the questions people actually have:
We share information only with the service providers needed to operate Flock, and only as described here.
| Provider | What reaches them | Why |
|---|---|---|
| Google (Gemini AI) | The question you type into the assistant, and the summary figures needed to answer it | To produce written explanations of your reports |
| Microsoft (email delivery) | Recipient address and the report or alert being sent | To email scheduled reports and alerts you have asked for |
| Hosting providers | Data stored on our behalf | To run the servers and databases behind the service |
When you ask the assistant a question, that question and the figures required to answer it are sent to Google's Gemini service. Three limits apply, and they are built into the software rather than being a matter of policy:
If you would prefer that a particular question never reaches an external service, do not use the assistant for it — the ordinary reports and exports do not involve any third party.
We may also disclose information where we are legally required to, or to establish or defend a legal claim.
Information is held on servers and managed databases operated by ITL World and its hosting providers in the United Arab Emirates and India. Where information moves between countries, we do so under the safeguards required by applicable law.
| Information | Kept for |
|---|---|
| Your account | While the account is active, then deleted within 90 days of closure |
| Access and download records | 24 months |
| Assistant conversations | 24 months |
| Business travel records | As agreed in the contract with the client organisation |
Subject to the law that applies to you, you may ask us to:
Write to privacy@itlworld.com. We will respond within 30 days. As noted in section 3, requests about corporate travel records are referred to the client organisation that owns them.
Flock accounts are issued and withdrawn by ITL World. To have yours removed, contact your ITL World representative or write to the address above. We will confirm once it is done.
No system is perfectly secure, but we take these measures seriously and review them.
Flock is a workplace tool intended for people aged 18 and over. It is not directed at children, and we do not knowingly collect information from them.
If we change this policy we will update the date at the top of this page. Where a change materially affects how your information is used, we will tell affected users directly.
ITL TOURISM & TRAVEL LLC
Office No. 104, 1st Floor, Centurion Star Tower A
Deira, Dubai, United Arab Emirates
P.O. Box 122358
Telephone +971 4 605 9999 · 800-ITL (800-485)
privacy@itlworld.com