Privacy Policy

FlowChat ("FlowChat," "we," "us," or "our") is a chat automation platform operated by Empire Marketing that helps businesses build and run automated conversations across Instagram, Facebook Messenger, WhatsApp, and related channels ("the Service"). This Privacy Policy explains what information we collect, how we use and share it, and the choices you have, both as a business that uses FlowChat ("Customer") and as someone who messages a Customer's connected account ("End User").

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

Account information. When you sign up, we collect your name, email address, business name, and billing information.

Connected channel data. When a Customer connects an Instagram, Messenger, or WhatsApp account, we access and store information made available through that platform's API, which may include the connected account's profile information, page or business account details, and access tokens needed to send and receive messages on the Customer's behalf.

Conversation data. To operate automated flows, we process message content, comments, and metadata (timestamps, sender identifiers, delivery status) exchanged between a Customer's connected account and its End Users.

Contact and CRM data. Information End Users voluntarily provide through a Customer's automated flows (for example, name, email address, or phone number collected in a lead-capture step), and tags or notes a Customer adds to a contact record.

Usage data. Log data, device and browser information, and analytics about how the Service is used.

Cookies. We use essential cookies to keep you signed in and remember basic preferences. We do not use cookies for third-party advertising.

FlowChat integrates with Meta Platforms, Inc. ("Meta") products, including the Instagram API, Messenger Platform, and WhatsApp Business Platform. Data obtained through these integrations ("Platform Data") is used solely to provide the automation, inbox, CRM, and analytics features a Customer configures — for example, receiving a message, matching it to a flow, sending an automated or human reply, and logging the conversation in the Customer's inbox.

We do not sell Platform Data, and we do not use it for advertising or for any purpose unrelated to operating the Service on the Customer's behalf.

Platform Data is retained only for as long as needed to provide the Service, subject to the data retention period a Customer configures in their Compliance settings (365 days by default), after which it is deleted or de-identified, unless a longer period is required to comply with a legal obligation.

Any End User may request that a Customer delete their data by replying with a stop/opt-out keyword (e.g. "STOP") in a conversation, or by contacting the Customer directly. Customers and End Users may also contact us at the email below to request deletion of data we hold, and we will act on verified requests within a reasonable time.

• To provide, maintain, and improve the Service, including running automated flows, the shared inbox, CRM, broadcasts, and analytics.
• To authenticate Customers and secure their accounts and connected channels.
• To process payments and manage subscriptions.
• To communicate with Customers about their account, including service updates, security alerts, and support.
• To monitor, detect, and prevent fraud, abuse, and violations of our Terms of Service or the policies of Meta and other connected platforms.
• To comply with legal obligations.

We do not sell personal information. We share information only:

• With the messaging platforms a Customer connects (Meta, and any other channel providers a Customer enables), as necessary to send and receive messages.
• With service providers who host our infrastructure, process payments, or provide analytics, under contractual confidentiality and data protection obligations.
• Between a Customer's own team members, as configured by that Customer within their workspace.
• If required by law, subpoena, or other legal process, or to protect the rights, property, or safety of FlowChat, our Customers, or others.
• In connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections.

We retain account and conversation data for as long as a Customer's account is active, plus the retention period configured in Compliance settings, or as needed to comply with legal, accounting, or reporting requirements. When a Customer closes their account, we delete or anonymize their data within 90 days, except where retention is required by law.

To request deletion of your personal information, email us at the address below. We will verify the request and act on it within 30 days.

We use industry-standard technical and organizational measures — including encryption in transit, access controls, and regular monitoring — to protect information from unauthorized access, alteration, or disclosure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. If you are located in the European Economic Area or United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can delete it.

We may process and store information in countries other than your own. Where required, we use appropriate safeguards, such as standard contractual clauses, to protect information transferred internationally.

We may update this Privacy Policy from time to time. We will post the updated version here with a new "Last updated" date, and, for material changes, provide additional notice to Customers.

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at info@empiremarketingdesign.com.