Data Processing Agreement

Last updated: October 22, 2026

1. Roles

You are the controller of the personal data of your own customers and leads that passes through Flowtalk (for example their Instagram username, message text, name, phone or email, and appointment details). Flowtalk is your processor for that data. For your own account data (email, billing details), Flowtalk is the controller, as described in the Privacy Policy.

2. What we process and why

• Data: incoming and outgoing Instagram messages and comments, lead details you or your customers provide, appointment bookings, and the knowledge base and settings you enter
• Purpose: only to provide Flowtalk to you: receive messages, generate and send replies, keep your lead and appointment records, and show your dashboard and insights
• Duration: for as long as your account is active, then deleted as described in section 7

3. Our commitments

• We process your customers' data only on your documented instructions, which are your use of the service and your settings, and not for our own purposes
• We do not sell this data or use it for advertising
• People at Flowtalk who can access the data are bound to keep it confidential
• We keep reasonable security safeguards, including encryption of stored Instagram access tokens, signature checks on incoming webhooks, access controls, and encrypted connections
• We tell you without undue delay if we become aware of a breach affecting your customers' data, with what we know about it and what we are doing
• We help you respond to requests from your customers to access, correct or delete their data, as far as the service allows

4. Your responsibilities

• You have a lawful basis for the data you ask Flowtalk to process, and any notice or consent your customers are entitled to
• You use Flowtalk in line with the Acceptable Use Policy and Instagram's platform rules
• You do not put in the knowledge base or settings any data you have no right to share

5. Sub-processors

We use these providers to deliver the service. You authorise their use:

• Meta (Instagram): the channel through which messages are received and sent
• Groq: AI processing of message text to generate replies, and transcription of voice notes into text (the audio is not stored by Flowtalk; only the transcript is kept)
• Resend: sending account and notification emails
• Razorpay: payment processing for your subscription (account data only, not your customers' data)
• MongoDB hosting and Northflank: database and application hosting

Some of these providers process data outside India. We choose providers with appropriate security and we will update this list before adding a new one that handles your customers' data.

6. Security

No system is perfectly secure, but we work to protect data with the measures in section 3 and we review them as the product grows. You are responsible for keeping your own login credentials safe.

7. Return and deletion

• You can delete your account and all associated data yourself from flowtalk.site/deletion, and we remove it within 30 days
• Some billing records may be kept for as long as the law requires
• If you need an export of your data before leaving, email us and we will provide it in a common format

8. Audits and questions

On reasonable written request, and not more than once a year, we will give you the information we reasonably have to show we follow this agreement.

9. Contact

• Email: contactflowtalk@gmail.com