Privacy Policy

1. Who we are

AI Lead Flow (the “Service”) is operated by [Registered company name], [Street address], [City, Postal code], Pakistan (“we”, “us”). The Service is a software platform that lets businesses answer and follow up with their customers on WhatsApp using an AI assistant. You can contact us about privacy at privacy@[your-domain.com].

2. Our role

This policy covers two groups of people, and our role is different for each:

• Business users: the businesses that sign up for the Service (“Customers”) and their staff. We decide how this account data is used, so we are its controller.
• End users: people who message a Customer’s WhatsApp number. The Customer decides why and how their data is processed and is its controller. We process it only on the Customer’s behalf and instructions, as a processor (service provider). If you are an end user, please read the Customer’s own privacy notice too, and send requests about your data to that business first. You can also contact us (see section 11).

3. Data we collect

3.1 Business users

• Account details: name, email address, organisation name, role, and a hashed password.
• Business configuration: services, products, prices, opening hours, staff, branches, message templates, alert rules and AI settings that you enter.
• WhatsApp Business Account details: account and phone number IDs, display name, and the access token you give us to send and receive messages. Tokens are encrypted at rest.
• Connected services: if you connect Google Calendar, the free/busy times and events needed to offer and record bookings; if you connect your store system, the settings needed to reach it.
• Technical data: IP address, browser type, and request logs, used for security and to keep the Service running.

3.2 End users (people who message a Customer)

• WhatsApp phone number and WhatsApp profile name.
• Message content (text, button replies, and details of any media sent), with timestamps and delivery status.
• Details given in the conversation, such as name, the service or products wanted, preferred appointment times, delivery address and order details.
• Booking, order request and lead records created from the conversation, and the business’s notes on them.
• Whether the person has opted out of messages.
• If the conversation started from a Click-to-WhatsApp advertisement, the ad referral information that Meta provides with the message.

We do not ask end users for payment card numbers, passwords or government ID numbers, and Customers must not use the Service to collect them.

4. How we use data

• To provide the Service: receive and send WhatsApp messages, generate AI replies, offer and book appointments, record order requests, send alerts and reminders, and show conversations to the Customer’s staff.
• To keep the Service secure: authenticate users, detect abuse and misuse, and investigate incidents.
• To support Customers and send service messages such as security notices, template review results and changes to these terms.
• To maintain and improve the Service, using aggregated or de-identified information where possible.
• To meet legal obligations and enforce our terms.

We do not sell personal data, and we do not use end users’ data to advertise to them or for our own marketing. We use end-user data only to provide the Service to the Customer whose number they messaged.

5. AI processing

To understand messages and draft replies, the relevant conversation text and the Customer’s business information are sent to AI model providers (currently Google Gemini, Groq and, where configured, OpenAI) through their business APIs. The providers process this data to return a response under their API terms. The AI is instructed to answer only from the Customer’s information, and Customers can switch the AI to draft-only or suggestion-only mode, or take over any conversation. AI replies can still be wrong, so Customers remain responsible for the answers sent in their name.

6. Data from Meta and WhatsApp

The Service uses the WhatsApp Business Platform provided by Meta. Data we receive through it is used only to provide the Service to the Customer that connected the WhatsApp Business Account, in line with Meta’s Platform Terms and the WhatsApp Business policies. We do not use it to build profiles of end users across Customers, and we do not share it with other Customers.

If a Customer turns on conversion reporting, we send booking and purchase events to Meta’s Conversions API so Meta can measure the Customer’s ads. Phone numbers and email addresses in these events are hashed with SHA-256 before they are sent.

7. Who we share data with

We share personal data only with the service providers below, to run the Service, or when the law requires it.

We may also disclose data if required by law or a valid legal request, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply.

8. International transfers

Our providers may process data in countries other than yours, including the United States and the European Union. Where required, we rely on the providers’ contractual safeguards for these transfers.

9. How long we keep data

• Account and business data is kept while the Customer’s account is active.
• End-user data is kept for as long as the Customer keeps it in the Service, or until a deletion request is completed.
• When a Customer closes their account, we delete their organisation’s data within 30 days, except where the law requires us to keep certain records for longer.
• Server logs are kept for a short period, normally no longer than 30 days.

See our Data Deletion page for how to ask us to delete data.

10. Security

Data is encrypted in transit with TLS. WhatsApp access tokens and other credentials are encrypted at rest with AES-256-GCM, passwords are hashed with bcrypt, and API keys are stored only as hashes. Each organisation’s data is kept separate, and access within an organisation depends on the user’s role. No system is perfectly secure, but we work to protect data and will notify affected Customers of a breach as required by law. More on our Security page.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent. To use these rights:

• Business users: email privacy@[your-domain.com] from your account’s email address.
• End users: contact the business you messaged. You can also email us with your phone number and the business’s name; we will pass the request to that business and help them complete it. To stop receiving messages from a business at any time, reply STOP in the chat.

We respond within 30 days. You may also complain to your local data protection authority.

12. Children

The Service is a business tool and is not directed at children. Business users must be at least 18. We do not knowingly collect personal data from children under 13; if you believe a child has provided data through a Customer’s WhatsApp number, contact us and we will help delete it.

13. Cookies and local storage

Our website does not use advertising cookies or third-party tracking. The dashboard stores your sign-in session in your browser’s local storage so you stay signed in; this is removed when you sign out.

14. Changes to this policy

We may update this policy. We will post the new version here with a new “last updated” date and, for significant changes, notify Customers by email or in the dashboard.

15. Contact

[Registered company name]
[Street address]
[City, Postal code]
Pakistan
Email: privacy@[your-domain.com]
Phone: [+92 3XX XXXXXXX]