Privacy Policy

Who We Are

Flowtalk ("we", "our", "us") is a productivity platform that helps Instagram Business accounts automate customer DM responses using keyword rules and AI. Our service is available at flowtalk.site.

This Privacy Policy explains what data we collect, how we use it, and your rights. By using Flowtalk, you agree to the practices described here.

Data We Collect

How We Use Instagram Data

Flowtalk connects to your Instagram Business account via the official Instagram Graph API with your explicit consent through OAuth. We use this connection exclusively to:

• Receive incoming direct messages via Meta's webhook system
• Send automated replies to customers on your behalf
• Configure Ice Breaker questions shown to customers who first open your DM
• Display your Instagram username and connection status in the dashboard
• If you enable comment automation, read comments on your posts to detect trigger keywords and send an automated private reply to the commenter

We do not use Instagram data for advertising, profiling, training AI models, or any purpose outside of providing the auto-reply service described above.

Data Sharing

We do not sell, rent, or share your personal data with any third parties, with limited exceptions:

• Groq (AI provider): Incoming message text is sent to Groq's API to generate AI replies. No personally identifiable information is attached. If a customer sends a voice note, the audio is sent to Groq to be turned into text. We keep only the text of what was said, never the audio file.
• MongoDB Atlas: Your account data is stored in MongoDB Atlas with encryption at rest.
• Northflank: Our application is hosted on Northflank's infrastructure.
• Razorpay: If you subscribe to a paid plan, your name, email, and payment details are processed directly by Razorpay to handle billing. We never see or store your card details.
• Resend: Account verification, password reset, and notification emails are sent through Resend, which processes your email address to deliver them.
• Legal requirements: We may disclose data if required by law.

Data Retention

• Account data (email, password hash) — retained until account deletion
• Instagram connection data — retained until you disconnect or delete your account
• Conversation content and activity logs — retained until account deletion, so the AI can remember earlier context within a conversation and so your dashboard history stays accurate
• Message statistics (counts) — retained until account deletion
• Subscription and payment records — retained until account deletion, as required for billing and tax records

Deleting your account removes all of the above within 30 days — see "Your Rights" below for how.

Your Rights

• Access: Request a copy of all data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and all associated data
• Disconnection: Revoke Instagram access at any time from Instagram settings or the Flowtalk dashboard
• Portability: Request your data in a portable format

You can request deletion yourself at any time from flowtalk.site/deletion — if you're logged in, your account and all associated data (leads, messages, appointments, subscription records) are deleted immediately. For any other request, contact us at contactflowtalk@gmail.com; we will respond within 30 days.

Security

• AES-256 encryption for all stored Instagram access tokens
• Bcrypt hashing for all user passwords
• HTTPS enforced on all connections
• Webhook signature verification (HMAC-SHA256) to prevent spoofed requests
• Session-based authentication with secure, HTTP-only cookies
• Rate limiting on all authentication endpoints

Meta Platform Policy Compliance

• We only request permissions necessary for core functionality
• We do not scrape, store, or process Instagram data beyond what is described in this policy
• Users can revoke access at any time by disconnecting their Instagram account
• We do not use Instagram data to build profiles for advertising
• Message data is processed only to generate automated replies for the account owner

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Continued use of Flowtalk after changes constitutes acceptance of the updated policy.