Privacy Policy

This Privacy Policy describes how ChatinFlow Teknoloji A.Ş. (“ChatinFlow”, “we”, “us”) processes personal data when you visit our websites, use our applications, or interact with our customer support.

We act as a data controller for personal data collected through our marketing site and when you create an account. When you use our platform to message your audience, you are the data controller for your contacts' data and we act as a data processor on your behalf: we process that data only to provide the Services to you, under the data processing terms in our Terms of Service.

If you are in Türkiye, this policy is also our information notice (aydınlatma metni) under the Personal Data Protection Law No. 6698 (KVKK).

We collect information in three ways: data you provide, data generated through your use of the product, and data we receive from third parties.

Data you provide

• Account data: name, email, role, organization, billing address.

• Workspace content: flows, templates, AI prompts, contacts, and conversations.

• Support communications: messages you send our team.

• Public content: your community profile, the topics and replies you post, flows you publish to the flow library, and your listing in the experts directory. These are public; see "Public content" below.

• Newsletter: your email address, if you subscribe to our newsletter and confirm the subscription.

• Partner payout details: if you join our partner program, where we pay your commission: the email address of your Payoneer or Wise account, or for a bank transfer the account holder, IBAN or account number, bank country, and optionally the SWIFT/BIC code and bank name. We store them encrypted and show them back to you only masked.

Data generated through use

• Product telemetry: feature usage, performance metrics, error reports.

• Authentication events: sign-in attempts, session metadata.

• Audit logs: workspace and admin actions.

• Questions to Wayfinder: when the assistant in your dashboard can't answer a question, we keep the question's text so our team can write the answer. It is stored without your name or account, with email addresses, phone numbers, card and bank numbers, tokens and @handles removed, and the same question is kept once with a count.

Data from third parties

• Connected channels: profile and message data from Meta (Instagram, Messenger, WhatsApp), X, Telegram, and the other channels you connect.

• Payment providers: Paddle, our default payment provider, and Stripe share subscription and transaction details with us, such as your plan, payment status, and customer and transaction references. Card numbers go directly to them and never reach our servers.

• Sign-in providers: if you sign in with Google or Facebook, we receive your name, email address, profile picture, and account identifier from that provider.

We use the data above to:

• Provide, secure, and improve the ChatinFlow platform.

• Authenticate users and prevent abuse.

• Process billing, pay partner commissions, and meet tax obligations.

• Send you emails about your account, billing, security and the service, and, only if you agreed, product news and tips.

• Show the content you choose to publish in the community, the flow library and the experts directory, and moderate it.

• Comply with legal obligations and enforce our Terms.

We do not sell personal data, and we do not use your workspace content to train AI models.

Two AI features run on our own servers in Finland with models we host ourselves, without any key:

• Voice message transcription. When a contact sends you a voice message, we turn it into text on our servers so your inbox and automations can read it. The transcript is stored with the message and deleted with it. Only if our transcription is unavailable when you ask for a transcript in the inbox, and your workspace has an OpenAI key connected, is that voice message transcribed by OpenAI with your key instead.

• Wayfinder, the in-app assistant. It reads the questions you ask it to find the right answer, and we never send them to an AI provider. Questions it cannot answer are kept without your name or account so we can add answers; nothing else is stored. If you dictate a question with the microphone, the recording is turned into text on our servers in the same way and is not kept.

Other AI features work only with an AI provider account you connect using your own API key (OpenAI, Anthropic, Google Gemini, or Azure OpenAI). When you use them, the content involved is sent to the provider you chose, under that provider's terms. Without a connected key, no workspace content is sent to an outside AI provider.

Where the EU General Data Protection Regulation applies, we rely on the following lawful bases:

• Contract (Art. 6(1)(b)): to deliver the service you signed up for, including publishing the public content you choose to post.

• Legitimate interests (Art. 6(1)(f)): to secure our service, prevent abuse, moderate public content and improve product quality.

• Consent (Art. 6(1)(a)): for product news and tips by email, our newsletter, the partner referral cookie, and other non-essential cookies if we ever add them. You can withdraw consent at any time.

• Legal obligation (Art. 6(1)(c)): to comply with tax, accounting, and law enforcement requests.

We send product news and tips by email only if you ticked the box when you signed up, or subscribed to our newsletter and confirmed your subscription. Every such email has an unsubscribe link that works with one click. Emails about your account, security, billing and the service itself are not marketing, and we send them regardless.

The community, the flow library and the experts directory are public. What you publish there, together with your community name and profile, can be seen by anyone, including search engines.

You can edit or delete your posts. Copies of a flow that others have already installed stay with them. If you delete your account, your community profile is renamed "Deleted member", its handle, bio and picture are removed, and your posts stay under that name so that conversations still make sense. Our staff can remove public content that breaks our rules, as described in our Terms of Service.

We do not use automated decision-making or profiling that has legal effects on you or affects you in a similarly significant way, with one exception: automatic temporary suspensions after repeated abuse, which are needed to keep the service safe under our contract with you. You can contest such a suspension and ask a person to review it at support@chatinflow.com. Other protective measures, such as rate limits and spam filters, also run automatically.

To create an account, you need to give us an email address and a password, or use a sign-in provider. To buy a paid plan, you give your payment details to our payment provider. We cannot provide the Services without this information. Everything else is optional.

We share personal data only as needed to operate ChatinFlow.

Subprocessors are the service providers that process personal data on our behalf. The current list, also published on our Security page:

• Hetzner Online GmbH (Germany): hosting of our application servers, database, file storage, and backups, in a data centre in Finland.

• Cloudflare (United States): delivery and protection of traffic to chatinflow.com (CDN, TLS, and DDoS protection).

• Paddle (United Kingdom): payments, invoicing, and sales tax, as merchant of record.

• Stripe (United States): payment processing.

We also share personal data in these cases:

• Partners: if you arrived through a partner's link and allowed the partner referral cookie, the partner is credited for your subscription payments. Partners see the plan, the amount and date of each payment they are credited for, and whether a refund is under review, never your name or email address.

• Partner payouts: to pay a partner's commission, we give the amount and the partner's payout details to the service the partner chose: Payoneer, Wise, or our bank for a bank transfer. Each processes the payment under its own terms.

• Services you connect: when you connect a channel (such as Meta, X, Telegram, Twilio, or Postmark) or an AI provider with your own API key, data is exchanged with that service because you connected it, under its own terms. These services are not our subprocessors.

• AI assistants you connect to our MCP server: if you connect an AI assistant (for example Claude, ChatGPT, Claude Code, Cursor or VS Code) to a workspace, by signing in with ChatinFlow or with an access token, the data you let it read, such as conversations, contacts and automations, goes to that assistant and its AI provider under their terms. It can only do what you allowed, such as leaving notes, moving conversations or pausing automations, and it cannot message your contacts. An owner or admin can turn MCP off or hide contact details from it. Each tool call is recorded without its content and kept for 90 days.

• Legal requirements: where compelled by valid legal process. We notify customers when allowed.

• Corporate transactions: in the event of a merger, acquisition, or asset sale, with continued protections.

Our application servers, database, uploaded files, and backups are hosted by Hetzner in a data centre in Finland, inside the European Economic Area (EEA). There is no choice of hosting region.

Some personal data is processed outside the EEA:

• Traffic to chatinflow.com passes through Cloudflare's global network.

• Payments are processed by Paddle in the United Kingdom or by Stripe in the United States, depending on the payment provider used for your subscription. The United Kingdom is covered by an EU adequacy decision.

• ChatinFlow Teknoloji A.Ş. is established in Türkiye, and authorized members of our team access the service from there to operate and support it.

For transfers to Cloudflare and Stripe, we rely on the safeguards in their data processing terms, such as the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

We retain personal data only as long as we need it for the purposes described above:

• Account data: while your account is open. When you delete your account, it is anonymized after a 14-day grace period during which you can cancel the deletion.

• Billing records: for as long as tax and accounting law requires. This includes the record of each partner payout we sent, with where it went.

• Questions to Wayfinder: 12 months after the same question was last asked.

• Partner payout details: while you are a partner. They are deleted with your account; a payout that was not sent by then is not sent.

• Workspace content (contacts, conversations, messages, flows): until you delete it or the workspace is deleted. Messages are not deleted automatically.

• Audit logs and security events: kept as the record of account and workspace activity, with no automatic deletion period.

• Public content: until you or we delete it, as described under "Public content".

• Newsletter subscriptions: until you unsubscribe.

• Product usage data: usage events are deleted after 120 days, sign-in attempt records after 90 days, and individual error reports after 30 days.

• Server logs: between 7 and 90 days, depending on the log. Logs of data protection requests are kept for 365 days.

• Backups: nightly backups are kept for 14 days, so deleted data can remain in a backup for up to 14 days.

These periods cannot currently be changed from workspace settings or the API. To ask for earlier deletion, email privacy@chatinflow.com.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.

• Correct inaccurate data.

• Delete data subject to legal obligations.

• Object to processing or restrict its use.

• Receive your data in a portable format.

• Withdraw consent at any time, without affecting prior processing.

• Lodge a complaint with your local data protection authority. If the KVKK applies, you have the rights in its Article 11, and after first applying to us you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Some of these are built into the product: workspace admins can export workspace data and export or delete an individual contact's data, and you can delete your own account from your account settings.

To exercise any of these rights, email privacy@chatinflow.com. We respond within 30 days.

We protect personal data with the following measures:

• Traffic to chatinflow.com is encrypted with TLS 1.2 or 1.3 and protected by HSTS. Older protocol versions are refused.

• Channel access tokens and integration secrets are encrypted with AES-256-GCM envelope encryption, using a separate key for each workspace.

• Passwords are stored only as salted hashes. Every account can turn on two-step sign-in (TOTP) and review or sign out its active sessions.

• The database and cache accept connections only from the application server, not from the internet.

• Access within a workspace follows fixed roles, and workspace and security events are recorded in an audit log.

More detail is on our Security page. Suspected vulnerabilities can be reported to security@chatinflow.com.

Our websites use cookies and similar storage that they need to work, for example to keep you signed in, protect forms against cross-site request forgery, and remember your language and your privacy choices. Our fonts are served from our own domain, so no font provider receives a request when a page loads.

One thing is optional and needs your consent: the partner referral cookie, set only if you arrive through a partner's link and choose Allow. You can withdraw that consent at any time in Privacy settings, linked at the bottom of every page.

We do not load third-party analytics or advertising trackers. If that changes, we will ask for your consent first and update our Cookie Policy, which lists every cookie and storage entry we use.

ChatinFlow is not intended for children under 16. If we learn that we have collected personal data from a child under 16 without verified parental consent, we will delete it promptly.

We may update this Privacy Policy from time to time. Each revision is published on this page with a new version number and effective date. If a change materially affects how we process your personal data, we will also notify account owners by email before it takes effect.

Questions about this policy or your data? Email privacy@chatinflow.com.