Privacy Policy

1. Who we are

FlexyFlow operates FlexyFlow and is the “controller” of the personal data described in this policy, except for the data covered in section 2. For anything about this policy or your data, contact us at our contact form.

2. Our role for your customers' data

Businesses (“merchants”) use FlexyFlow to sell to their own customers. When someone orders from a store on FlexyFlow, or messages a store on WhatsApp, the merchant decides what to collect and what to do with it. For that data:

• The merchant is the controller (a “business” under the CCPA). Their own privacy notice applies, and requests about that data should go to them.
• We are the merchant's processor (a “service provider”): we handle the data only to run the Service for the merchant, under the data processing terms in our Terms of Service, and we help merchants answer their customers' requests.

If you ordered from a store and can't reach it, contact us and we'll pass your request on.

3. Data we collect

From merchants (account holders)

• Account details: name, email, phone number (optional), password (stored only as a secure hash by our sign-in provider) and how you sign in. If you sign in with Google or Apple, we receive your name, email and profile picture from them.
• Store content: your store's name, description, logo, design, products, prices, photos, order form, opening status and the WhatsApp number you show. Store pages, product photos and logos are public: anyone with the link can see them.
• Billing details: plan, subscription status, billing name and address, invoices and payments. Card details are entered on Stripe and kept by Stripe; we only see the card brand, last four digits and expiry date.
• WhatsApp connection: if you connect a WhatsApp number, the number, its display name, the IDs of your WhatsApp business account, and the access token Meta gives us (stored encrypted).
• Invites: who signed up with your invite link (shown to you as a first name or masked email) and the rewards earned.
• Messages to us: what you send through our contact form or by email.

From merchants' customers (on the merchant's behalf)

• Orders: the answers given in the store's order form (for example name, phone number and address), the products, quantities and totals, the order's status history and notes the merchant adds.
• WhatsApp orders: the customer's WhatsApp number and profile name, and the messages exchanged with the store's ordering assistant. We don't keep chat history: we store the step the conversation is at and the answers needed to place the order, and then the order itself.

Automatically, from everyone

• Technical data: IP address, browser and device type, and the pages requested, in our hosting provider's logs. For our own rate limits (for example, how many orders one visitor can send in ten minutes) we keep only a salted, one-way hash of the IP address, never the address itself.
• Activity: the days on which an account was used, for overall usage statistics.
• Cookies and local storage: see section 12.

We don't ask for special categories of data (such as health, religion or biometric data), and merchants must not use their order forms to collect them.

4. How we use data, and why

Where we rely on legitimate interests, we've weighed them against your rights, and you can object (section 9). We don't sell personal data, don't use it for advertising, and don't make decisions with legal or similarly significant effects about anyone based solely on automated processing. The WhatsApp ordering assistant automates the order conversation, but the merchant decides what happens with each order.

5. Who we share data with

We share personal data only with the service providers below, who act on our instructions and must protect it:

We also share order data with the merchant who owns the store; data with authorities when the law requires it or to protect rights and safety; and data with a buyer or successor if our business is merged or sold, who must respect this policy. We never sell personal data or share it for cross-context behavioral advertising.

6. International transfers

Our providers may process data outside your country, including in the United States and the European Union. When data leaves the EU, the UK or another country that restricts transfers, we rely on adequacy decisions, standard contractual clauses or the equivalent safeguards required by local law. Contact us for a copy of these safeguards.

7. How long we keep data

• Account and store data: as long as your account exists. Deleting your account deletes it, with your store, products, photos, orders and WhatsApp connection.
• Orders: until the merchant deletes them or their account.
• WhatsApp conversation state: replaced at each step of the conversation and deleted with the store.
• Billing records: as long as tax and accounting laws require (often up to 10 years). Stripe keeps its own records under its own policy.
• Rate-limit hashes: about one day. Hosting logs: a short period set by our hosting provider.
• Messages to us: as long as needed to answer and follow up.
• Accounts removed for abuse: we keep the email address on a block list, to stop it being used to sign up again.
• Backups: deleted data can remain in backups for a short time (normally under 30 days) until they're overwritten.

8. How we protect data

• Every page and request is encrypted in transit (HTTPS).
• Each account can only reach its own data, enforced by the database itself (row-level security).
• Passwords are stored only as secure hashes; card data is handled by Stripe, which is PCI DSS certified.
• WhatsApp access tokens are encrypted at rest (AES-256-GCM).
• Staff access is limited by role.

No system is perfectly secure. If a breach affects your personal data, we'll notify you and the authorities as the law requires.

9. Your rights

Depending on where you live, you have some or all of these rights:

• Access: get a copy of your data.
• Correction: fix inaccurate data. You can edit most of it yourself in Settings.
• Deletion: have your data deleted (see section 11).
• Portability: receive your data in a common, machine-readable format. Merchants can also export their orders as a CSV file from the Orders page.
• Restriction and objection: ask us to limit or stop some uses, including those based on legitimate interests.
• Withdraw consent at any time, where we rely on it.
• Complain to a data protection authority, for example your EU/EEA authority, the UK's ICO, Morocco's CNDP, Brazil's ANPD or Canada's Privacy Commissioner.

To use these rights, use the settings in your account or contact us at our contact form. We answer within one month (45 days for US state laws), may first ask you to confirm your identity, and won't treat you differently for using your rights. If you're a merchant's customer, contact the merchant first (section 2).

10. California and other US states

In the last 12 months we collected these categories of personal information: identifiers (name, email, phone number, IP address), commercial information (orders, plans and payments) and internet activity (activity dates and logs). We collect them from you, from merchants' customers on the merchant's behalf, and from Google, Apple, Stripe and Meta, for the purposes in section 4, and disclose them only to the service providers in section 5 for those purposes.

We don't sell or share personal information as the CCPA defines it (including of anyone under 16), and we treat Global Privacy Control signals as a request not to. The only sensitive personal information we handle is account login details, used only to sign you in.

Residents of California and other US states with privacy laws can ask to know, correct or delete their personal information, and can appeal our answer by replying to it. An authorized agent can make a request for you with your signed permission.

11. How to delete your data

Merchants: open Settings → Delete account. If you have a paid subscription, cancel it first in Billing. This permanently deletes your profile, store, products, photos, orders, invite history and WhatsApp connection, and deletes your Stripe customer record and saved cards.

Only WhatsApp: open Storefront → WhatsApp → Disconnect. We delete the stored access token and stop receiving your WhatsApp messages. You can also remove FlexyFlow's access in your Meta business settings. If you connected through Meta (Facebook) and want all the data we got from it deleted, follow the steps above or contact us at our contact form, and we'll confirm once it's done.

Customers of a store: ask the store, or contact us and we'll help.

12. Cookies and local storage

We only use cookies the Service needs to work and to remember your choices. We don't use advertising or analytics cookies, so there's nothing to opt into.

Stripe sets its own cookies on its payment pages (to prevent fraud), and Meta sets its own in the Connect WhatsApp window. Their policies apply to those.

13. Children

The Service is for businesses. You must be at least 18, or the age of majority where you live, to create an account. We don't knowingly collect data from children; if you think a child gave us personal data, contact us and we'll delete it.

14. Changes to this policy

When this policy changes, we update the date at the top. If a change is significant, we'll tell you by email or in the app before it takes effect.

15. Contact us

Questions or requests about your data: our contact form. FlexyFlow.