Privacy policy
Flow Digital AI ("the Service") gives businesses automated replies and a customer management system on top of Meta's WhatsApp Business Platform. This document explains what data we process, what for, and how it can be removed.
Who is responsible for the data
The business that signs up for the Service is the data controller for the customers who message it. Flow Digital AI acts as a data processor on its behalf, and processes the data solely to provide the Service.
What data we collect
- The phone number and display name of whoever messages the business on WhatsApp
- Message content — text, images and voice notes — in both directions
- Delivery data (sent, delivered, read) and message timestamps
- What the business enters itself: business details, business rules and knowledge-base documents
- Details of the business's own users who sign in: email and name
We don't collect location, contacts from the device, or anything beyond what is sent in the conversation itself.
What the data is used for
To generate an automated reply, to keep conversation history so replies stay coherent, to manage the lead in the CRM, and to show the business its usage figures. We don't sell data and we don't use it for advertising.
Third-party services
- Meta (WhatsApp Business Platform) — sending and receiving the messages.
- Google Gemini — message content is sent to the model to generate a reply. It is not used to train the model.
- Supabase — database and file storage.
- Railway — server hosting.
Security
Traffic is encrypted with HTTPS. Each business's access tokens are encrypted in the database (AES-256-GCM), so a database backup on its own does not expose them. Every inbound request is cryptographically verified against Meta, and permissions are separated so one business cannot reach another's data.
Opting out
Anyone messaging the business can send "הסר" or "STOP" and the system will stop contacting them. To resume, they send "התחל" or "START".
Deletion and your rights
You can ask to see, correct or delete your data. An end customer's deletion request is handled through the business they were messaging. Deleting a business account deletes all of its conversations, media and knowledge base.
Privacy enquiries: tal.fisher123@gmail.com
Changes to this policy
We'll update this document as needed, and the date of the last update appears at the top.