Privacy policy

Information we process

We process account and business details, team membership and permissions, connected WhatsApp account identifiers and access tokens, conversations and attachments, delivery status, workflow settings and service logs. Passwords are stored as hashes rather than plain text. If you use Google sign-in, the account details supplied by Google support authentication.

Payment records include billing names and addresses, any buyer GST details, order and invoice references, amounts, payment status, mandate references and credit usage. Payment credentials such as a card number, UPI PIN or bank authentication are handled by the payment provider; do not send them to Chatflow support.

Our role

Your business decides why and how its customers’ conversations and contact details are processed, so for that information your business is the data fiduciary under India’s Digital Personal Data Protection Act, 2023, and Chatflow processes it on your behalf. For your own account, team and billing details, the service provider named below is responsible.

Why we use this information

We use it to operate your workspace, authenticate people, enforce access permissions, connect WhatsApp, deliver selected workflows, provide AI assistance, reconcile payments and credits, issue receipts, investigate faults and respond to support requests. Your business remains responsible for customer consent and its lawful use of customer data.

Service providers

Meta processes connected WhatsApp communications. Cashfree processes new Chatflow plan, onboarding and AI credit payments and AutoPay mandates. Existing business payment requests may use PhonePe or the gateway configured for that business. Google processes sign-in when enabled; the configured email provider handles account verification and recovery messages.

When you use AI assistance, relevant prompts, conversation context and selected business information are sent to OpenAI to generate the requested result. New metered OpenAI calls request store:false. This setting does not replace the provider’s applicable retention and data controls. Only enable AI for information your business is authorised to process this way.

Access and sharing

Workspace permissions control which staff can see and act on business data. People you authorise, service providers involved in the requested feature and authorised support staff may process information needed for their role. Connected integrations receive information according to your configuration. Do not add an integration unless you trust its recipient and have permission to share the information.

Storage and retention

Workspace records and service logs are retained to operate the service, recover from faults and meet applicable recordkeeping obligations. Backups and provider systems may retain copies under their own controls. Billing records may need to remain after account closure to fulfil accounting and legal obligations.

An unpaid renewal pauses service use without deleting your business records. Pausing service is separate from a deletion request. Ask support about exporting or deleting your workspace information; we verify your authority before acting.

Security

Access is limited by workspace roles and per-number permissions, connections use HTTPS, provider secrets are kept in protected server configuration, and backups are restricted to authorised operators. No system is completely secure. If we become aware of a breach affecting your workspace information, we notify the workspace owner and, where required, the relevant authority.

Cookies and local device storage

Authentication cookies keep your session signed in. Local device storage may cache authorised workspace information and app preferences to improve loading and support queued work. Use your own trusted device, sign out when finished on a shared device and revoke sessions you no longer recognise.

Your requests

Contact the support address or grievance officer below to request access, correction, export or deletion of information associated with your workspace, or to raise a privacy concern. Include the business name and account email, with only the details needed to identify the request.