Privacy Policy

FlowAI ("we", "us") provides social media automation software that helps businesses respond to Instagram and Facebook comments and messages. This policy explains what data we collect, why, and how it's protected — including data accessed through Meta's (Instagram and Facebook) official APIs.

What we collect

Account information you provide when you sign up: name, email, and workspace details.
Instagram / Facebook data, only after you connect an account through Meta's official OAuth flow, limited to what the granted permissions allow: your connected Page/Instagram professional account identity, public comments on your own posts, and direct messages sent to your connected account.
Contacts your automations create: names, emails, phone numbers, or social handles that people voluntarily provide in a conversation with your connected account. When an automation asks for an email or phone number, we keep the message the person was shown and their reply, with the time, as a record of their consent. You can delete a contact, and its consent record, at any time from the Contacts page.
Usage data: automation activity, event logs, and conversation history needed to run and display the product.

We never ask for or store your Instagram or Facebook password. All access is through Meta's OAuth.

How we use it

To run the automations you configure — replying to comments and sending private replies/DMs.
To show you your inbox, contacts, and analytics inside the app. Inbox conversations are read live from Meta when you open them and are not stored by us.
To operate, secure, and improve the product.

We do not sell your data or your customers' data, and we do not use it to train third-party models.

How Meta data is protected

Access tokens are encrypted at rest (AES-256-GCM) and are only ever used server-side — never sent to the browser.
Webhook events from Meta are signature-verified before we process them.
Every workspace's data is isolated by database-level row-level security; one customer can never read another's data.
We retain Meta-sourced data only as long as your connection is active or as required to operate the feature you enabled, and delete it on request — see our Data Deletion page.

Payments

Payments are handled by Stripe. When you start a trial or a plan, you enter your card details on Stripe's page, and Stripe stores and processes them. We don't see or store your full card number. We keep your Stripe customer and subscription IDs, your plan, and billing dates so we can show your plan and manage your subscription. Stripe's own privacy policy applies to the data it handles.

Sharing

We share data with Meta only as required to call the Instagram/Facebook APIs on your behalf, with Stripe to process payments, and with infrastructure providers (hosting, database, email delivery, video processing) strictly to operate the service. We do not share data with advertisers or data brokers.

Your rights

You can disconnect a Meta account at any time from Social Connections, which revokes our access. You can request deletion of your data at any time — see Data Deletion.

Contact

Questions about this policy: businessaiwitho@gmail.com