Privacy Policy

1. Overview & Meta Developer Policy Compliance

Welcome to Flowchat ('earnwithads.in', 'we', 'our', or 'us'). Flowchat is an AI-powered social direct message (DM) automation engine that integrates with official Meta Graph APIs (Instagram & Facebook) and WhatsApp Business APIs. This Privacy Policy explains in detail how we collect, process, store, encrypt, and delete personal data when you or your social media subscribers interact with our platform.

Flowchat complies fully with Meta Platform Terms, Meta Developer Policies (including Section 3.a Data Protection and Section 4.b User Data Usage), the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and applicable Indian IT Act regulations.

2. Information We Collect & Meta API Data Permissions

In order to execute automated comment-to-DM flows, story replies, and keyword triggers across Instagram, Facebook, and WhatsApp, we collect and process the following categories of data:

• •A. Account & Profile Data: Your name, email address, and profile details processed securely via Clerk Authentication.
• •B. Meta Platform Access Tokens: OAuth access tokens, Page Access Tokens, and Instagram Business Account Identifiers issued by Meta. We NEVER request, access, or store your Instagram or Facebook account passwords.
• •C. Comment & Interaction Data: Public comments, story replies, post URLs, reel captions, and keyword trigger words ('LINK', 'PRICE', 'INFO') dropped on your connected Meta accounts.
• •D. Direct Message Content: Automation reply templates, custom links, coupon codes, and automated DM delivery timestamps.
• •E. Subscriber & Lead Metrics: Anonymized counts of DMs sent, link click-through rates, and follow-gate verification statuses.
• •F. Technical & Usage Logs: IP addresses, browser user-agent strings, device identifiers, and HTTP request logs processed for system security and fraud prevention.

3. How We Use Your Data & Purpose Limitation

We process collected data strictly for limited and explicit operational purposes necessary to deliver our DM automation service:

• •To monitor public comments and story interactions on your connected Instagram & Facebook accounts via Meta Webhooks.
• •To deliver automated Direct Messages containing your requested links, PDFs, or offer codes in under 4 seconds.
• •To verify whether a commenter follows your account before delivering a link ('Follow-Gate' feature).
• •To rewrite DM replies dynamically using AI variations, preventing message duplication and spam flags.
• •To display real-time conversion analytics and subscription validity in your Flowchat dashboard.
• •To process subscription payments via Razorpay & Stripe and maintain transaction history.

4. Data Storage, Encryption & Security Standards

We implement enterprise-grade technical and organizational security measures to protect your data:

• •Encryption in Transit: All data transferred between your browser, Flowchat servers, and Meta Graph APIs is encrypted using TLS 1.3 / HTTPS encryption.
• •Encryption at Rest: Sensitive Meta access tokens and user data are encrypted in our Supabase PostgreSQL database using AES-256-GCM encryption with Row Level Security (RLS) policies.
• •Zero-Password Policy: We do NOT store or ask for your social media account passwords under any circumstances.
• •Infrastructure Security: Hosted on Vercel and Supabase with 99.9% uptime SLA, DDoS mitigation, and 24/7 automated vulnerability scanning.

5. Authorized Subprocessors & Third-Party Sharing

We do NOT sell, rent, trade, or monetize your personal data. Data is shared exclusively with our vetted subprocessors to operate the service:

• •Meta Platforms Inc. (Instagram, Facebook, Messenger, WhatsApp) — To send DMs and receive comment webhooks.
• •Supabase Inc. — Encrypted PostgreSQL database hosting.
• •Clerk Inc. — User authentication and session management.
• •Vercel Inc. — Serverless cloud hosting and global edge network.
• •Razorpay Software Pvt. Ltd. & Stripe Inc. — Payment gateway processing.

6. Data Retention & Automatic Purge Policy

We retain personal data and Meta tokens only for as long as your account remains active. Upon account cancellation or explicit data deletion request:

• •All associated Meta access tokens, keywords, DM templates, and analytics are permanently purged from our active Supabase database within 48 hours.
• •Inactive accounts with zero activity for 12 consecutive months are automatically flagged and purged in compliance with global data protection laws.

7. User Rights & Data Deletion Rights (GDPR / CCPA / Meta)

You have full control over your data. You may exercise any of the following rights at any time:

• •Right to Access: Request a copy of all personal data held about your account.
• •Right to Erasure / Data Deletion: Request complete erasure of your account and Meta tokens via earnwithads.in/data-deletion or by emailing ashishkushwaha1822@gmail.com.
• •Right to Revoke Permissions: Revoke Flowchat's permissions directly from your Facebook/Instagram Business settings under 'Apps and Websites'. Once revoked, our system automatically revokes and purges your connection tokens.

8. Contact Information & Privacy Team

If you have any questions, privacy concerns, or data deletion requests regarding this Privacy Policy, please contact our Support & Privacy Team: