Privacy Policy

1. Introduction

Flowauxi is an AI-powered WhatsApp automation platform. This Privacy Policy describes how we collect, use, and protect your personal data in accordance with the Digital Personal Data Protection (DPDP) Act, 2023.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: For marketing communications and specific data collection (e.g., location access). You explicitly consent to this processing.
• Legitimate Uses: For fraud prevention, network security, and employment-related purposes as permitted by law.
• Contractual Necessity: To provide the services you have subscribed to (e.g., processing payments, delivering messages).
• Legal Compliance: To comply with legal usage obligations like tax reporting and law enforcement requests.

3. Information We Collect

We collect the following information when you use Flowauxi:

• Identity Data: Name, Email, Phone Number (Legal Basis: Contractual Necessity)
• WhatsApp Data: WhatsApp Business Number, Message Metadata (Timestamps, Status). Content is encrypted. (Legal Basis: Contractual Necessity)
• Technical Data: IP address, device info, cookies (Legal Basis: Legitimate Use)

4. Data Retention

We retain personal data only as long as necessary:

• Account Data: Retained for 3 years after account closure or last interaction.
• Financial Records: Retained for 7 years as required by tax laws.
• Log Data: Retained for 90 days for security auditing.

5. Cross-Border Data Transfers

Some data may be processed outside India (e.g., via Meta's servers or cloud providers like AWS/Google Cloud). We ensure these transfers comply with the DPDP Act through:

• Standard Contractual Clauses (SCCs): Ensuring equivalent protection levels.
• Negative List Adherence: We do not transfer data to countries restricted by the Indian government.

6. Third-Party Services

Meta & WhatsApp: We use the WhatsApp Business API. Meta processes message metadata. By using our service, you consent to Meta's privacy practices.

Other Processors: We use secure cloud hosting and email providers bound by Data Processing Agreements (DPAs).

7. Data Security & Breaches

We use AES-256 encryption and TLS 1.3. In the event of a personal data breach, we will notify the Data Protection Board of India and affected users promptly (as required by law, typically within 72 hours).

8. User Rights

Under the DPDP Act, you have the right to:

• Access & Correction: Request a summary of your data and correct inaccuracies.
• Erasure: Request deletion of your data (see Data Deletion).
• Withdraw Consent: Withdraw consent for specific processing (e.g., marketing) at any time.
• Nominate: Nominate an individual to exercise your rights in the event of death or incapacity.
• Grievance Redressal: File a complaint with our Grievance Officer.

9. Children's Privacy

Our services are not intended for users under the age of 18. We do not knowingly collect data from minors. If you believe we have collected such data, please contact us immediately for deletion.

10. Automated Decision-Making

We use AI to power chatbot responses. We do not use automated decision-making for significant legal or financial effects on users without human review.

11. Cookies

We use essential session cookies (lifespan: session only) for authentication. We do not use third-party tracking cookies.

12. Grievance Redressal

For any privacy-related concerns or grievances, please contact our Grievance Officer:

13. Changes to Policy

We may update this policy. Material changes will be notified via email at least 30 days in advance.

14. Contact