Flows Privacy Policy

Flows is a product operated by DemanualAI Pvt. Ltd. (“DemanualAI,” “we,” “us,” or “our”). Flows helps businesses manage customer conversations, leads, follow-ups, and related activity across WhatsApp, Instagram, websites, CRM systems, online stores, and connected services.

This Privacy Policy applies specifically to the Flows product. It explains what personal data Flows processes, where that data comes from, how it is used and shared, how long it is retained, and how individuals can request access, correction, withdrawal of consent, or deletion.

Section 01

Scope of this policy

This policy applies when you:

Communicate with a business that uses Flows.
Send a WhatsApp message, Instagram message, comment, form submission, or website-chat message that is processed through Flows.
Visit a website operated through Flows.
Use Flows as a business customer or authorised team member.
Contact DemanualAI about Flows, request a demonstration, book a meeting, or submit a support request.

This policy does not replace the privacy policy of the business you are communicating with. That business may collect and use your information for its own purposes and should provide its own privacy notice.

Section 02

Who controls your personal data

The party responsible for your personal data depends on how you interact with Flows.

When you communicate with a Flows customer

The business you are communicating with normally determines why and how your personal data is used. That business acts as the data controller or data fiduciary, and DemanualAI processes the information on its behalf as a service provider or data processor.

For example, if you message a shop using Flows, the shop decides why it collects your enquiry, how it follows up, and how long it keeps your customer record.

Requests concerning this information should normally be sent to that business first. DemanualAI will assist its business customers in responding to valid privacy requests.

When you interact directly with DemanualAI

DemanualAI is responsible for information collected when you:

Visit a Flows product page on the DemanualAI website.
Ask DemanualAI about Flows.
Submit a Flows sales or contact enquiry.
Book a Flows demonstration or meeting.
Enter into a contract for Flows.
Request support for Flows.

Section 03

Personal data we process

Depending on how a business configures Flows and which services it connects, we may process the following categories of information.

Contact and identity information

Name, email address, telephone or WhatsApp number.
Company, job title, or organisation.
Instagram username, account identifier, profile name, and profile image where made available through Meta’s APIs.
Customer or account identifiers assigned by Flows or a connected CRM.

Communications and social interactions

WhatsApp messages sent to or received from a participating business.
Instagram direct messages, comments, replies, mentions, and reactions involving a participating business.
Website-chat messages, email messages, and contact-form submissions.
Images, documents, audio, video, and other attachments you choose to send.
The date, time, delivery status, and read status of communications where available.
Records showing whether you opted in, opted out, blocked a business, or changed your communication preferences.

Please do not send sensitive personal information unless it is necessary and the business has specifically asked you to provide it through an appropriate channel.

Customer relationship and transaction information

Products or services you asked about, enquiry source, and campaign information.
Lead status, notes, tags, assigned representative, and follow-up history.
Appointment or booking information.
Shopping-cart, order, payment-status, delivery, refund, and support information received from connected systems.
Your previous interactions across connected channels and preferences you communicate to the business.

Payment-card details should ordinarily be collected and processed by the relevant payment provider, not stored directly by Flows.

Automatically generated information

Conversation summaries and suggested or automated replies.
Categories, tags, detected enquiry topics, lead priority, or follow-up status.
Workflow history, automation results, and customer-service or sales activity records.

These outputs may be generated using automated or artificial-intelligence systems. Businesses using Flows remain responsible for reviewing their workflows and using the resulting information appropriately.

Technical and usage information

IP address, browser and device type, operating system, and referring page.
Pages viewed, links selected, and date and time of access.
Session, cookie, or similar identifiers.
Error, diagnostic, security, audit, webhook, API, delivery, and integration logs.

Business-customer information

Work contact information, account permissions, and team role.
Configuration, integration settings, authentication, and connection tokens.
Support communications, subscriptions, billing, invoice, and payment records.
Activity performed within the service.

Section 04

Where we obtain personal data

We may receive personal data:

Directly from you or from the business you are communicating with.
From Meta through the official WhatsApp Business Platform and Instagram APIs.
From a website, form, chat, CRM, ecommerce store, scheduling system, or other service connected by a Flows customer.
Automatically from your browser, device, or interaction with the service.
From licensed data sources where the business has a lawful basis to use the data.
From public sources where collection and use are permitted by law and applicable platform rules.

Flows does not use unauthorised scraping to collect information from WhatsApp, Instagram, or other social platforms.

Section 05

How we use personal data

We process personal data to:

Receive, organise, respond to, and route customer enquiries.
Maintain a connected customer record across authorised channels.
Send requested information, confirmations, reminders, and service updates.
Provide follow-ups or marketing messages where the recipient has provided any consent required by law and platform rules.
Record and respect opt-ins, opt-outs, blocks, and other communication preferences.
Create and manage appointments, orders, support requests, and customer-service activity.
Operate CRM, automation, website-chat, ecommerce, analytics, and reporting functions.
Summarise conversations, classify enquiries, suggest responses, and run customer-configured workflows.
Prevent spam, fraud, misuse, and security incidents.
Troubleshoot, support, and improve the reliability of Flows.
Manage subscriptions, billing, contracts, and business records.
Meet legal, regulatory, tax, accounting, and law-enforcement requirements.
Establish, exercise, or defend legal claims.

We do not use personal data for purposes that are incompatible with the reason it was collected unless we provide additional notice or obtain consent where required.

Section 06

WhatsApp and Instagram data

Flows connects to WhatsApp and Instagram using official Meta APIs.

Depending on the permissions granted and the features enabled by a business, Flows may receive:

WhatsApp telephone numbers, profile names, message content, and attachments.
Message timestamps, delivery status, and read status.
Instagram account identifiers, usernames, profile information, comments, mentions, direct messages, and related content.
Information necessary to connect an interaction to the correct business and customer record.

We use this information only to provide the features requested by the participating business, maintain the relevant customer record, operate authorised automations, protect the service, and comply with applicable law and Meta’s platform requirements.

A business may send WhatsApp marketing messages only where the recipient has provided the required opt-in. A recipient can stop future marketing messages by replying STOP, asking the business to stop, or using the controls provided by WhatsApp or Instagram.

Removing Flows’ permissions from Facebook, Instagram, or WhatsApp stops future access through that connection, but it may not automatically delete information previously received by the business or Flows. To request deletion of previously collected information, follow Section 14.

Meta separately processes information under its own terms and privacy policies. DemanualAI does not control Meta’s independent processing.

Section 07

Automated processing and artificial intelligence

Flows may use automation and artificial intelligence to:

Understand the general topic or intent of an enquiry.
Generate conversation summaries or draft configured responses.
Assign tags or lead stages and recommend or schedule follow-ups.
Route a conversation to a person or workflow.
Extract relevant customer or order information from messages.

Automated outputs may be incomplete or incorrect. Businesses using Flows should review important information before relying on it.

DemanualAI does not use customer conversations or CRM records to train publicly available or general-purpose artificial-intelligence models.

Flows is not intended to make decisions that produce legal or similarly significant effects about an individual without appropriate human involvement.

Production AI providers

Flows uses Amazon Web Services (AWS) Bedrock, deployed in the Asia Pacific (Mumbai) Region (ap-south-1). The production architecture currently uses:

Amazon Nova Pro (apac.amazon.nova-pro-v1:0).
Amazon Nova Micro.
DeepSeek V3.2.

Depending on the workflow configured by a business customer, relevant message content, attachments, CRM context, and instructions may be sent to these models through AWS Bedrock to classify an enquiry, extract information, create a summary, draft a response, or operate an authorised automation. We limit the information sent to what is reasonably necessary for the relevant task.

Section 08

Legal grounds for processing

Depending on the applicable law and context, personal data may be processed:

With your consent.
To provide a service or respond to a request made by you.
To perform or take steps toward a contract.
On the documented instructions of a Flows business customer.
For legitimate business purposes, where permitted and where those interests do not override your rights.
To comply with legal obligations or prevent fraud, misuse, or threats to security.
For other uses expressly permitted by applicable law.

Where processing relies on consent, you may withdraw that consent. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Section 10

Cookies and website analytics

Flows product pages and Flows-powered websites may use cookies, browser storage, pixels, or similar technologies to keep websites and forms working, remember settings, prevent abuse, understand traffic, measure interactions, diagnose errors, and improve the website.

These pages currently use or may use:

Umami for website analytics.
PostHog for website and product analytics.
Google reCAPTCHA to prevent spam and abuse.
Calendly when you open the meeting-booking interface.

The Flows product pages do not currently provide a cookie-consent banner or preference interface. Analytics technologies that are configured on those pages may load automatically when you visit them.

You may restrict cookies through your browser. Some features may not work correctly if necessary storage is blocked.

Section 11

International transfers

DemanualAI and its service providers may process personal data in India, Qatar, the United States, or other countries where DemanualAI, a participating business, or a service provider operates.

Privacy and data-protection laws may differ between countries. Where required, we use contractual, organisational, and technical measures intended to protect personal data when it is transferred internationally.

Business customers are responsible for ensuring that their use of Flows and connected services complies with any restrictions that apply to their international transfers.

Section 12

Data retention

We retain personal data only for as long as reasonably necessary to provide the service, follow a business customer’s instructions, resolve disputes, maintain security, and comply with legal obligations.

Unless a different period is agreed with the business customer:

Customer conversations and CRM information are retained while the business uses Flows and for up to 90 days after termination, unless earlier deletion is requested or applicable law requires longer retention.
Deleted service data may remain in encrypted backups for up to 90 days before being overwritten.
Technical and security logs are retained for up to 12 months.
Sales and support enquiries submitted directly to DemanualAI are retained for up to 24 months after the last interaction.
Contract, billing, tax, and transaction records are retained for the period required by applicable law.
Opt-out or suppression records may be retained for as long as necessary to ensure the person is not contacted again.

A business customer may configure a shorter or longer period where permitted by law. We may retain information for longer when required by law, necessary for an unresolved dispute, or needed to investigate fraud or a security incident.

Data that has been aggregated or irreversibly anonymised may be retained without the periods stated above because it no longer identifies an individual.

Section 13

Your choices and privacy rights

Depending on where you live and applicable law, you may have the right to:

Ask whether your personal data is being processed and request access to it.
Request correction or completion of inaccurate information.
Withdraw consent or object to or restrict certain processing.
Request deletion or a portable copy of information you provided.
Opt out of marketing communications.
Ask for information about the parties with whom data has been shared.
Nominate another person to exercise rights on your behalf where applicable.
Submit a grievance or complaint to a relevant data-protection authority.

These rights may be subject to legal exceptions.

Marketing choices

You can stop marketing communications by replying STOP to an applicable WhatsApp message, asking the business to stop, using the controls provided by WhatsApp, Instagram, email, or the relevant website, or contacting us below.

We may retain limited suppression information so that your opt-out continues to be respected.

Section 14

How to request account or data deletion

To request deletion of a Flows account or personal data associated with Flows:

Email privacy@demanualai.com with the subject “Flows Data Deletion Request.”
Include your name; the telephone number, WhatsApp number, email address, or Instagram username associated with the request; the business you contacted; and a brief description of the information you want deleted.
Do not send passwords, one-time codes, payment-card details, or identity documents unless we specifically request information through a secure method.
We may ask for reasonable verification to ensure that the request concerns your data.
If the relevant business controls the data, we will refer the request to that business or help it respond.
We aim to acknowledge the request within 24 hours. We will complete it within the period required by applicable law after any necessary identity verification.

After a valid deletion request, we will delete or anonymise covered information unless retention is required for legal compliance, fraud prevention, security, dispute resolution, enforcing agreements, or maintaining a record of your opt-out.

Deletion from active systems may not immediately remove encrypted backup copies. Backup copies will be isolated from ordinary use and removed according to our backup-retention schedule.

Section 15

Security

We use reasonable technical and organisational safeguards designed to protect personal data, including:

Encryption in transit, access controls, authentication, and role-based restrictions.
Logging, monitoring, and backup and recovery procedures.
Secure integration and credential-management practices.
Access limited to personnel and providers with a business need.
Confidentiality obligations and incident-response procedures.

No system is completely secure, and we cannot guarantee that unauthorised access, loss, or misuse will never occur.

If we become aware of a personal-data breach, we will investigate it and notify affected customers, individuals, or authorities where required by applicable law.

Section 16

Children’s privacy

Flows is a business communication and customer-management service and is not directed to children.

Businesses using Flows must not knowingly use it to collect or process children’s personal data unless they have a lawful basis, provide appropriate notices, obtain verifiable parental or guardian consent where required, and configure the service appropriately.

If you believe a child’s personal data has been processed improperly through Flows, contact us at privacy@demanualai.com.

Section 17

Third-party services

WhatsApp, Instagram, ecommerce platforms, payment providers, calendars, and other connected services operate under their own terms and privacy policies.

This policy describes DemanualAI’s processing. It does not govern how an independent third party uses information for its own purposes.

Section 18

Changes to this policy

We may update this policy when Flows changes, when we use new service providers, or when legal requirements change.

The current version will always show its effective date and last-updated date. If a change materially affects how personal data is used, we will provide additional notice where required.

Section 19

Contact and grievances

For questions, privacy requests, withdrawal of consent, or complaints, contact:

Privacy ContactDemanualAI Pvt. Ltd.privacy@demanualai.comNo. 28, Sai Supreme, Thiru. Vi. Ka. Industrial, Guindy Industrial Estate, Chennai City Corporation, Chennai 600032, Tamil Nadu, IndiaGrievance contact: Sanjay Rajaraman, Founder of DemanualAIResponse target: acknowledgement within 24 hours; completion within the period required by applicable law following any necessary identity verification.

When contacting us, include enough information to identify the relevant Flows account or participating business. Please do not send unnecessary sensitive information.

If you are dissatisfied with our response, you may submit a complaint to the competent data-protection authority available under applicable law.

Return to the top