Privacy Policy

1. Introduction

ChatFlow ("we", "us", or "our") operates a SaaS platform that allows businesses to build and deploy AI-powered chatbots connected to Facebook Messenger. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including any data processed on your behalf through the Facebook Messenger Platform.

By using ChatFlow, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you register for ChatFlow, we collect your email address, full name, and company name. This information is used solely to create and maintain your account.

2.2 Chatbot Configuration Data

We store the configuration you provide for your chatbots, including system prompts, AI model preferences, and business information you enter to train your bot.

2.3 Facebook Messenger Data

When you connect a Facebook Page to ChatFlow, we process the following data through the Messenger Platform on your behalf:

• Messenger user IDs of people who message your Facebook Page
• Message content sent by users to your Page
• Timestamps of messages
• Your Facebook Page ID and Page Access Token (stored encrypted)

We do not collect Facebook users' names, profile pictures, or any other profile information beyond their Messenger-scoped user ID.

2.4 Usage Data

We automatically collect anonymized usage analytics (page views, feature usage) to improve the platform. This data does not identify individual users.

3. How We Use Your Information

We use the information we collect to:

• Provide and operate the ChatFlow platform
• Process and respond to Facebook Messenger messages on behalf of your business
• Generate AI responses using the AI model you select
• Store conversation history so your chatbot has context
• Display analytics and conversation insights in your dashboard
• Send transactional emails (e.g., account verification, password reset)
• Improve our services and fix bugs

We do not sell your data or your end users' data to any third party. We do not use Messenger conversation data for advertising purposes.

4. Facebook Platform Data

ChatFlow integrates with the Meta (Facebook) Messenger Platform. Our use of data received from Facebook APIs complies with Meta's Platform Terms and Developer Policies.

Specifically:

• We only request the minimum permissions necessary: pages_messaging, pages_show_list, pages_read_engagement and pages_manage_metadata
• We do not share Messenger conversation data with third parties except the sub-processors listed in section 5, and only to operate the service
• Conversation data is stored only as long as necessary to provide the service
• Users who message your Facebook Page can request deletion of their conversation data by contacting you directly; as the platform operator you can delete any conversation from your ChatFlow dashboard

5. Data Sharing and Sub-processors

We share data only with the following sub-processors, strictly to operate our platform. Each is bound to process data only on our instructions.

• Supabase Inc. – Database, file storage and authentication. Stores account data, chatbot configuration, knowledge base files and conversation history. Encrypted at rest and in transit.
• Vercel Inc. – Application hosting and infrastructure; processes incoming Messenger webhook requests.
• Google LLC – AI response generation (Gemini API). Message content and the relevant knowledge base content are sent to generate chatbot replies.
• OpenAI, L.L.C. – Image understanding, where a customer sends an image to a connected Page.
• n8n – Workflow automation used to orchestrate message handling between the above services.
• Stripe, Inc. – Subscription billing. Stripe receives billing details only; it does not receive Messenger conversation data.

We do not sell, rent, or trade your personal information or your end users' data to any third parties, and we do not use conversation content for advertising or to train AI models.

We may disclose data where required by valid legal process. We review every such request for legality, disclose the minimum necessary, document each request, and challenge requests we consider unlawful.

6. Data Retention

We retain your account data and chatbot configurations for as long as your account is active. Conversation history is retained to provide your chatbot with context and for analytics purposes.

Upon account deletion, we will delete your account data, chatbot configurations, and associated conversation history within 30 days.

7. Data Security

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, and Row Level Security (RLS) in our database to ensure each user can only access their own data. Facebook Page Access Tokens are stored encrypted.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have rights to access, correct, or delete your personal data. To exercise these rights, contact us at the email below. We will respond within 30 days.

If you are located in the European Economic Area, you have rights under the GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority.

9. Children's Privacy

ChatFlow is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a prominent notice on our platform. The "Last updated" date at the top reflects the most recent revision.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

ChatFlow (operated by Webhiine LLC)
Ulaanbaatar, Mongolia
Email: privacy@socialchatbot.app

To delete your data, see our Data Deletion Instructions.