Privacy Policy

**Last Updated:** March 6, 2025

1. Introduction

Flowziac ("we," "our," or "us") is committed to protecting your privacy and the privacy of your data and your customers' data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our WhatsApp automation platform and related services (collectively, the "Services").

This Privacy Policy applies to:

• Our website and application
• All users who create accounts on our platform
• The data you upload, process, or store through our Services
• End-users whose data you process using our platform (e.g., your customers)

2. Data Controller and Processor Roles

2.1 As Data Controller

When you use our Services, you act as the data controller for personal data of your contacts and end-users. You are responsible for:

• Obtaining proper consent from your data subjects
• Providing privacy notices to your customers
• Determining the lawful basis for processing
• Ensuring your processing activities comply with applicable data protection laws

2.2 As Data Processor

We act as a data processor when we process data on your behalf to provide our Services. Our processing activities are governed by our Data Processing Agreement (DPA) and these Terms.

3. Information We Collect

3.1 Information You Provide

We collect information you voluntarily provide when you:

• Create an account (name, email, company name, phone number)
• Add team members to your workspace
• Configure your workspace settings
• Upload or input contact data
• Create message templates and flows
• Integrate third-party services
• Communicate with our support team

3.2 Automatically Collected Information

We automatically collect certain information when you use our Services:

• **Usage Data:** Features used, messages sent, API calls made, workspace activity
• **Device Information:** IP address, browser type, operating system, device identifiers
• **Log Data:** Access times, error logs, performance metrics
• **Cookies and Tracking Technologies:** We use cookies and similar technologies for functionality, analytics, and personalization. See our Cookie Policy below.

3.3 Information from Third Parties

We may receive information from:

• WhatsApp Business API regarding message status and delivery
• Payment processors for billing information
• Authentication providers (Google, etc.) if you use social login
• Analytics services (Google Analytics, etc.)

4. How We Use Your Information

We use the information we collect to:

4.1 Provide and Improve Our Services

• Create and manage your account
• Process and transmit messages through WhatsApp
• Store and organize your contact data
• Generate analytics and reports
• Provide customer support
• Maintain and improve platform functionality
• Develop new features and services

4.2 Communication

• Send service-related notifications (account updates, security alerts, billing information)
• Respond to your inquiries and support requests
• Send marketing communications (only with your consent or where permitted by law)

4.3 Legal and Security

• Comply with legal obligations
• Protect our rights, property, and safety
• Detect and prevent fraud, abuse, and security incidents
• Enforce our Terms of Service

5. Data Sharing and Disclosure

5.1 With Your Consent

We may share your information with third parties when you explicitly authorize us to do so.

5.2 Service Providers

We engage trusted third-party service providers to assist in operating our platform:

• Cloud hosting providers (AWS, etc.)
• Payment processors
• Email service providers
• Analytics and monitoring services
• Customer support platforms

All service providers are bound by contractual obligations to protect your data and may only process it according to our instructions.

5.3 WhatsApp Business API

Your messages and contact data are transmitted through WhatsApp's infrastructure. WhatsApp is an independent third party with its own privacy policies. We are not responsible for WhatsApp's data practices.

5.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests (court orders, subpoenas, government requests). We will notify you of such requests when permitted.

5.5 Business Transfers

If Flowziac undergoes a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of the business transaction. We will notify you of any such change in ownership.

5.6 Aggregated or De-identified Data

We may use and share aggregated or de-identified data for research, analytics, or business purposes. Such data cannot reasonably be used to identify you or your customers.

6. Data Retention

6.1 Your Data

We retain your data (including contacts, messages, flows) for as long as your account is active. You may delete individual data or your entire account at any time.

6.2 Backup Retention

Some data may be retained in backup systems for up to 90 days after account deletion for disaster recovery and compliance purposes.

6.3 Legal Holds

We may retain certain data longer if required to comply with legal obligations, resolve disputes, or enforce our agreements.

7. Data Security

7.1 Security Measures

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL)
• Encryption at rest for sensitive data
• Access controls and authentication
• Regular security assessments
• Secure coding practices
• Employee training on data protection

7.2 Your Responsibilities

You are responsible for:

• Maintaining the confidentiality of your account credentials
• Using strong passwords and enabling two-factor authentication
• Controlling access to your account and workspace
• Ensuring your team members follow security best practices
• Notifying us immediately of any security incidents

7.3 Data Breach Notification

In the event of a data breach affecting personal data, we will notify you and relevant authorities as required by law within 72 hours of becoming aware of the breach.

8. Your Rights and Choices

8.1 Access and Control

You can access, update, or delete your account information at any time through your account settings.

8.2 Data Subject Rights

If you are a resident of certain jurisdictions (EU, UK, California, etc.), you may have additional rights regarding your personal data:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

To exercise these rights, contact us at privacy@flowziac.com. We may verify your identity before fulfilling your request.

8.3 Marketing Communications

You can opt out of marketing emails by clicking the unsubscribe link in any email or updating your communication preferences in your account settings.

9. International Data Transfers

Our Services are hosted globally. Your data may be transferred to and processed in countries other than your own, including India, the United States, and other jurisdictions where our service providers operate.

We ensure appropriate safeguards for international transfers:

• EU Standard Contractual Clauses (SCCs)
• Adequacy decisions from the European Commission
• Data processing agreements with all processors

By using our Services, you consent to such international transfers.

10. Cookies and Tracking Technologies

10.1 Types of Cookies We Use

• **Essential Cookies:** Required for basic functionality (authentication, session management)
• **Functional Cookies:** Remember your preferences and settings
• **Analytics Cookies:** Help us understand how users interact with our platform
• **Marketing Cookies:** Used for personalized advertising (with consent)

10.2 Cookie Management

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

10.3 Third-Party Tracking

We use third-party analytics services (Google Analytics, etc.) that may use their own tracking technologies. These third parties have their own privacy policies.

11. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Data Processing Agreement (DPA)

If you are subject to data protection laws (GDPR, CCPA, etc.), our Data Processing Agreement (DPA) applies to our processing of your customers' data. The DPA is incorporated into these Terms and is available at [legal/static/dpa.md](legal/static/dpa.md).

13. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Sending an email notification
• Updating the "Last Updated" date

Your continued use of the Services after such changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

Flowziac Technologies Private Limited

Email: privacy@flowziac.com

Address: [Your Company Address]

For data protection matters in the EU/EEA, you may also contact our EU Representative (if applicable).

15. Complaints

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with your local data protection authority.

---

Important Note for Our Customers (Data Controllers):

As a user of Flowziac, you are the data controller for the personal data of your contacts and end-users. You are responsible for:

• Providing appropriate privacy notices to your data subjects
• Obtaining valid consent where required
• Responding to data subject requests
• Ensuring your use of our platform complies with all applicable data protection laws

We provide tools and features to help you meet these obligations, but ultimate responsibility rests with you.