Privacy Policy

Flowlines is operated by NexSys Technologies LLC, a limited liability company licensed by the Sharjah Media City (Shams) Free Zone, Government of Sharjah, under License No. 2536548.01, with its registered address in Sharjah Media City, Sharjah, United Arab Emirates. In this policy, “we”, “us” and “our” mean NexSys Technologies LLC.

Flowlines is a business tool. Businesses use it to run AI agents, a shared inbox across WhatsApp, Instagram, Messenger, Telegram, email and web chat, a CRM and automations. That means we handle personal data in two different capacities.

We are the controller of account and website data

We decide how to handle data about our own customers and website visitors: the people who sign up for Flowlines, use the console, pay for a plan, contact us or browse flowlines.io. For this data, NexSys Technologies LLC is the data controller.

We are a processor for workspace data

When a business uses Flowlines to talk to its own customers and contacts, the data about those people (their names, phone numbers, email addresses, channel handles, messages, CRM records and similar) is processed on behalf of that business. The business is the controller; it decides what to collect and why, and we act only on its instructions.

If you messaged a business that uses Flowlines and want your data accessed, corrected or deleted, please contact that business first. You can also write to support@flowlines.io and we will pass your request to the right business where we can identify it, and help them respond.

Account data

• Name, email address and profile details you give us.
• Sign-in data: hashed passwords, session tokens, and, if you sign in with Google or Facebook, the name, email address, profile picture and account ID that provider shares.
• Workspace membership, role and permissions.
• Billing data: billing contact, plan, invoices and payment references. Card details are collected and held by Stripe, not by us.
• Support conversations and anything else you send us.
• Technical and usage data: IP address, device and browser details, log data, feature usage and error reports.

Workspace data (processed for our business customers)

• Contact details and channel identifiers for people who message a business on a connected channel.
• Messages, attachments and call or voice content exchanged on those channels.
• CRM records: contacts, deals, notes, tags, tasks and custom fields.
• Knowledge content a business uploads so its AI agents can answer questions.
• Automation and agent activity, such as which steps ran and what an agent replied.

Website data (flowlines.io)

• Details you enter in the contact form: name, email, company, optional phone number and your message.
• Page views, the page you arrived from and campaign (UTM) parameters, so we can see which pages and campaigns bring visitors.
• A random visitor id, stored locally in your browser (local storage, not a cookie) and sent with page views to Flowlines' own analytics. It contains no personal data. If you sign up from a "Get started" link, it is passed to your new account so we can see which visits lead to sign-ups and where people get stuck while setting up.
• Meta Pixel data. When we have turned it on, flowlines.io loads the Meta Pixel, which lets Meta set its own cookies (such as _fbp and _fbc) and receive information about your visit and actions such as viewing a page or sending the contact form. We use it to measure our own advertising.
• Meta Conversions API data. When we have turned it on, our website server also sends the same events to Meta directly, so Meta can count them when a browser blocks the Pixel: a “PageView” event for each page you view and a “Lead” event when you send the contact form. Each event carries the page address, the time, your IP address, your browser’s user agent and, if the Pixel has set them, Meta’s _fbp and _fbc cookie values. The “Lead” event also carries the email address and, if you gave one, the phone number from the contact form, each hashed with SHA-256 on our server before it is sent, so Meta can match the event to a Meta account. Browser and server events share an event ID so Meta counts each one once. We use this only to measure our own advertising.
• Storage in your browser. Our own code does not set cookies. It reads Meta’s _fbp and _fbc cookies, when the Pixel has set them, to include them in the events above. If you dismiss the announcement bar at the top of the site, we remember the text you dismissed in your browser’s local storage so the bar stays hidden; nothing about it is sent to us.

We use account and website data to:

• create and run your account and provide the service (performance of a contract);
• take payments, send invoices and keep financial records (contract and legal obligation);
• answer your questions and provide support (contract or legitimate interests);
• keep the service secure, prevent fraud and abuse, and fix errors (legitimate interests);
• understand how the service and website are used so we can improve them, mostly in aggregate (legitimate interests);
• measure our advertising with the Meta Pixel and the Meta Conversions API, and send optional product news (consent where the law requires it; you can withdraw it at any time);
• meet legal requirements and respond to lawful requests (legal obligation).

Workspace data is used only to provide the service to the business that owns the workspace, under its instructions. The business is responsible for having a legal basis to collect and use it.

We do not sell personal data, and we do not use workspace conversations to train AI models that are made available to others.

Flowlines receives data through the Meta Platform APIs only for the features a person or business turns on:

• Facebook Login. If you choose “Continue with Facebook”, we receive your name, email address, profile picture and Facebook user ID, and use them only to create your account and sign you in. We do not store your Facebook access token.
• Messages from people who contact a business. When someone messages or comments on a business’s connected WhatsApp number, Instagram professional account or Facebook Page, we receive the message, the sender’s platform ID and delivery and read status. For Instagram and Messenger we also fetch the sender’s name and profile picture (Business Asset User Profile Access) so the business can see who it is talking to; WhatsApp provides the sender’s profile name. This data is stored only in that business’s workspace.
• Business assets. The Facebook Pages, WhatsApp Business accounts, phone numbers, Instagram accounts and product catalogs that the business’s admin selects when connecting, and the access tokens that let Flowlines act for them.
• Instagram comments and mentions. Comments and @mentions on the business’s own Instagram posts, so its team can read, reply to, hide or delete them.
• Instagram insights. Reach, views, interactions and follower metrics for the business’s own Instagram account and posts, shown only to that business’s team inside Flowlines.
• Ad attribution and conversions. When someone starts a chat from a click-to-WhatsApp, click-to-Messenger or click-to-Instagram ad, we keep the ad reference Meta includes so the business can see which ad started the conversation. If the business turns on conversion tracking, we send conversion events for chats started from its click-to-WhatsApp ads to the business’s own Meta dataset.
• WhatsApp product catalogs. We read and update the products in the business’s catalog so it can share them in chats, and keep the catalog in sync with products from its Shopify store or Flowlines CRM when it asks us to.
• Lead Ads. When a business connects Facebook Lead Ads, we receive the answers people submit in its instant forms, together with the form’s name, any consent (disclaimer) responses, and the ad, ad set and campaign the submission came from, and add them to that business’s Flowlines CRM.
• AI processing. A business’s conversations are processed by AI only when that business uses AI features. If the business deploys an AI agent, the agent reads the messages in the conversations it handles, including images (which OpenAI describes) and voice notes (which ElevenLabs transcribes), and sends them to OpenAI to write its replies. While a workspace has an active AI agent, Flowlines also automatically has OpenAI describe images that customers send, has ElevenLabs transcribe voice notes that customers send, and has OpenAI turn message text and free-text CRM notes into search embeddings so its AI agents can recall earlier conversations. The business can turn this automatic processing off, or turn it on without an AI agent, in its AI settings; a workspace with no active AI agent gets none of it unless it turns it on. When someone on the business’s team uses an AI feature, such as a suggested reply, a summary or a transcript, the content involved is sent to OpenAI or ElevenLabs at that moment. OpenAI and ElevenLabs act as our service providers. A person on the business’s team can take over a conversation from an AI agent at any time, and the AI agent pauses while they do.

Telegram and email channels work in a similar way through their own platforms.

We use data received from Meta Platforms only in line with Meta’s Platform Terms. In particular:

• we use it only to provide Flowlines to the business that connected the account (showing conversations in its inbox, letting its team and AI agents reply, keeping its CRM and automations up to date), or to sign you in;
• we do not sell, license or rent it, and we do not use it for advertising or to build profiles for anyone else;
• we share it only with the providers listed below that help us run the service, under contract;
• we delete it when the business disconnects the account or deletes the data, when the workspace is deleted, or when a deletion request is made, as described below and in our Data Deletion Instructions.

We use the providers below to run Flowlines. Each may process personal data only to provide its service to us, under contractual confidentiality and data protection obligations. Which ones touch a given workspace depends on the features and channels it turns on.

Booking and scheduling run on our own installation of the open-source Cal.com software, hosted on our infrastructure on Railway, so booking details are not sent to Cal.com the company.

Some providers are used only when a business connects its own account, under that business’s own contract with the provider: telephony providers (Twilio, Plivo or Exotel) for calls and SMS, which carry call audio, phone numbers and message content; Telegram, Shopify and Stripe accounts it links; an AI provider of its choice if it adds its own AI key; and Cloudflare Turnstile or Google reCAPTCHA if it turns on spam protection for its forms, which then checks the form visitor’s browser.

We may also disclose data if the law requires it, to protect the rights, property or safety of our users or others, or as part of a merger or sale of our business, in which case this policy continues to apply to it.

• Account data is kept while your account is open. Flowlines has no self-service button to close a user account: email support@flowlines.io and we delete it within 30 days, except records we must keep for legal, tax or accounting reasons or to resolve disputes.
• Workspace data is kept for as long as the business keeps it. A business can delete conversations and contacts at any time.
• When a workspace is deleted (only its owner can do this), deletion starts straight away; there is no grace period and it cannot be undone. Members lose access immediately. Every part of Flowlines then deletes the workspace’s data: conversations and messages, contacts and CRM records, automations, AI agents and knowledge, files and recordings, analytics and cached data. Its channels are disconnected at the platforms (for example, Meta webhook subscriptions and Telegram bot webhooks are removed and WhatsApp personal-number sessions are logged out) and its Flowlines subscription is cancelled. This normally finishes within minutes; we track it for each part of the system and retry automatically until it completes. We keep only: security audit log entries, which expire after 90 days; a deletion record with the workspace’s ID and name and which systems confirmed the deletion, without any workspace content; invoices and payment records held by Stripe for tax and accounting; and records of our referral programme’s partner rewards and payouts.
• When a business disconnects a channel (a WhatsApp Business account, Instagram account or Facebook Page), we delete the stored access token immediately and stop receiving new data from it. Past conversations stay in the workspace unless the business chooses to delete them when it disconnects, or deletes them later. A disconnected Telegram bot stops receiving messages at once; its stored token is deleted when the workspace is deleted.
• Verified deletion requests that you send us (see Data Deletion Instructions) are completed within 30 days.
• Contact form messages are kept as long as needed to answer you and follow up on your enquiry.
• Backups and logs are overwritten on their normal cycle, so deleted data can remain in them for a limited extra period.
• Anonymised, aggregated data that can no longer identify anyone may be kept to understand and improve the service.

We protect data with measures suited to the risk, including:

• encryption in transit (TLS) and encryption of stored integration credentials;
• hashed passwords and expiring sign-in tokens;
• workspace isolation, so each request only reaches the workspace it belongs to;
• role-based permissions inside workspaces and limited internal access to production systems;
• error monitoring, audit logs and regular updates of the software we depend on.

No system is perfectly secure. If a personal data breach affects you, we will tell you, and the relevant authorities where the law requires it.

We are based in the United Arab Emirates, and our providers run their services in several countries, including the United States and the European Union. Your data may therefore be processed outside the country where you live. Where the law requires it, we put appropriate safeguards in place for these transfers, such as the contractual clauses approved for that purpose, together with technical measures like encryption in transit.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent you gave. You may also complain to your local data protection authority.

To use these rights for account or website data, email support@flowlines.io from the email address on your account where possible. We may need to confirm your identity, and we respond within 30 days. Many details can also be changed directly in the Flowlines console.

For workspace data, the business that runs the workspace decides; see section 2. We will not treat you differently for using your rights.

Flowlines is a service for businesses and is not directed at children. You must be at least 16 years old to create an account. We do not knowingly collect personal data from children as a controller. If you believe a child has given us personal data, email support@flowlines.io and we will delete it.

We may update this policy as Flowlines and the law change. The date at the top and bottom of this page shows the current version. If a change is material, we will give reasonable notice before it takes effect, for example by email or in the console.

For privacy questions, data requests or complaints, email support@flowlines.io. You can also write to us at our registered address:

Use of Flowlines is also governed by our Terms & Conditions.