Privacy Policy

1. Introduction

Flowauxi is an AI-powered WhatsApp automation platform. This Privacy Policy describes how we collect, use, and protect your personal data in accordance with the Digital Personal Data Protection (DPDP) Act, 2023.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: For marketing communications and specific data collection (e.g., location access). You explicitly consent to this processing.
• Legitimate Uses: For fraud prevention, network security, and employment-related purposes as permitted by law.
• Contractual Necessity: To provide the services you have subscribed to (e.g., processing payments, delivering messages).
• Legal Compliance: To comply with legal usage obligations like tax reporting and law enforcement requests.

3. Information We Collect

We collect the following information when you use Flowauxi:

• Identity Data: Name, Email, Phone Number (Legal Basis: Contractual Necessity)
• WhatsApp Data: WhatsApp Business Number, Message Metadata (Timestamps, Status). Content is encrypted. (Legal Basis: Contractual Necessity)
• Technical Data: IP address, device info, cookies (Legal Basis: Legitimate Use)

4. Data Retention

We retain personal data only as long as necessary:

• Account Data: Retained for 3 years after account closure or last interaction.
• Financial Records: Retained for 7 years as required by tax laws.
• Log Data: Retained for 90 days for security auditing.

5. Cross-Border Data Transfers

Some data may be processed outside India (e.g., via Meta's servers or cloud providers like AWS/Google Cloud). We ensure these transfers comply with the DPDP Act through:

• Standard Contractual Clauses (SCCs): Ensuring equivalent protection levels.
• Negative List Adherence: We do not transfer data to countries restricted by the Indian government.

6. Third-Party Services

Meta & WhatsApp: We use the WhatsApp Business API. Meta processes message metadata. By using our service, you consent to Meta's privacy practices.

Other Processors: We use secure cloud hosting and email providers bound by Data Processing Agreements (DPAs).

6A. List of Sub-Processors (DPDP s.8 & s.16)

We engage the following sub-processors to deliver the service. Each is bound by a Data Processing Agreement. We do not transfer personal data to any country on the Government of India's negative list (s.16).

This list is reviewed periodically. Material changes are notified at least 30 days in advance.

7. Data Security & Breaches

Personal data is encrypted in transit (TLS 1.3) and at rest at the database-volume level (LUKS) on our self-hosted infrastructure. Secrets such as consent signing keys are held in an encrypted secrets store. We maintain a written breach-response runbook and, in the event of a personal data breach, notify the Data Protection Board of India and affected data principals without undue delay — within the statutory 72-hour window (DPDP Act 2023, s.8(6)).

8. User Rights

Under the DPDP Act, you have the right to:

• Access & Correction: Request a summary of your data and correct inaccuracies.
• Erasure: Request deletion of your data (see Data Deletion).
• Withdraw Consent: Withdraw consent for specific processing (e.g., marketing) at any time.
• Nominate: Nominate an individual to exercise your rights in the event of death or incapacity.
• Grievance Redressal: File a complaint with our Grievance Officer.

You can submit an access, correction, erasure, or nomination request through our Data Principal Rights Portal. We acknowledge every request and act within the statutory 30-day SLA.

9. Children's Privacy

Our services are not intended for users under the age of 18. We do not knowingly collect data from minors without verifiable parental consent (DPDP s.9).

We apply technical safeguards: contacts flagged as minors are automatically excluded from marketing campaigns, audience targeting, and third-party exports (such as Google Sheets), and their data is not processed for these purposes without verifiable consent. If you believe we have collected a minor's data, request erasure through our Data Principal Rights Portal.

10. Automated Decision-Making

We use AI to power chatbot responses. We do not use automated decision-making for significant legal or financial effects on users without human review.

11. Cookies

We use essential session cookies (lifespan: session only) for authentication. We do not use third-party tracking cookies.

12. Grievance Redressal

For any privacy-related concerns or grievances, please contact our Grievance Officer:

13. Changes to Policy

We may update this policy. Material changes will be notified via email at least 30 days in advance.

14. Contact