Privacy Policy

1. Who this policy covers

This policy applies to two groups of people:

• Clients — business owners who create an SSFlows account and connect their own Facebook Page.
• Customers — people who send a message to a Facebook Page or a WhatsApp Business number that is connected to SSFlows.

2. Information we collect from clients

• Name, email address, phone number and business address provided at sign-up.
• Facebook Page ID, Page name and an access token for the Page the client connects.
• For a client who connects WhatsApp: the WhatsApp Business Account ID, the business phone number and its ID, the display name, and an access token for that number.
• Business information the client enters, such as products, prices, opening hours and delivery charges.

3. Information we collect from customers

When a customer sends a message to a connected Facebook Page or WhatsApp Business number, we receive:

• The content of the message.
• A page-scoped user ID (PSID) supplied by Facebook.
• On WhatsApp, the customer's WhatsApp phone number, which WhatsApp sends with every message so the business can reply to it.
• The customer's public profile name, where Facebook or WhatsApp provides it.
• Any photo or voice message the customer sends, so the assistant can understand and answer it.
• Any name, phone number or delivery address the customer chooses to type when placing an order.

We do not collect payment card details or government identity numbers. A location a customer chooses to share in a chat is used only to answer that conversation.

4. How we use this information

• To read an incoming message and generate a reply based only on the information the business owner has provided.
• To send that reply through the same channel — the Facebook Page or the WhatsApp Business number.
• To show the conversation history to the business owner in their dashboard, so they can take over a conversation manually at any time.
• To record orders placed through the conversation.
• To count message volume for billing.

We do not sell your data. We do not share it with advertisers. We do not use it to train advertising models or to build profiles across businesses.

Visitors to our website. On the public pages of ssflows.com we use the Meta Pixel to measure our own advertising. When it is switched on, Meta receives the page you viewed, details of your browser and device, your IP address, and an identifier kept in a cookie. We send it nothing from your messages, and page views are not counted on the login, signup, password-reset or account pages. We do not load it for a visitor whose browser sends Do Not Track or Global Privacy Control, and you can also block it with your browser's cookie settings or an ad blocker. How Meta uses that information is described in Meta's own privacy policy.

Account events. When a shop owner finishes creating an account, chooses a paid plan, or pays, we also tell Meta that it happened: the name of the event, and for a plan or a payment its amount in taka. It goes with the owner's email address, phone number and an account identifier, each converted to a one-way hash first, so that we can measure which of our ads lead to accounts and sales. We never send the content of any message, any of your customers' details, or any business information. If your browser sends Do Not Track or Global Privacy Control, we send nothing from the browser and skip the sign-up and plan events; the record of a completed payment is made by our server after the payment is confirmed, and is the one thing a browser setting cannot stop.

5. Automated replies

Replies are generated using Google Gemini. Message text, and any photo or voice message a customer sends, are sent to Google for the sole purpose of composing a reply and is not used by SSFlows for any other purpose. Prices and order totals are always calculated from the business owner's own database records, never generated by the language model.

6. Separation between clients

Each client can only see data belonging to their own Facebook Page. This separation is enforced at the database level through row-level security, not only in the interface.

7. Where data is stored

Data is stored in Supabase (PostgreSQL). Facebook access tokens are held in a restricted table that no client account can read. Connections to our servers use HTTPS.

8. How long we keep data

• Conversation history is kept while the client's account is active, so the business owner can refer back to it.
• If a client disconnects their Page, the stored access token is removed.
• If a client closes their account, associated data is deleted within 30 days.

9. Your rights

You may ask us to show you what data we hold about you, correct it, or delete it. Requests are handled within 30 days.

10. Children

SSFlows is intended for business use. We do not knowingly collect information from children under 13.

11. Changes to this policy

If we change this policy we will update the date at the top of this page. Significant changes will be communicated to clients by email.