Privacy Policy

Information handled by the service

• Account information, such as login and contact details for a business account.
• Business settings, the website address and content supplied for the chatbot, and any custom answers or instructions.
• Website-visitor chat messages and conversation identifiers. If a visitor provides them, the service may also handle a name, email address, or phone number as a lead or conversation contact.
• Technical and usage information needed to operate, protect, and troubleshoot the service.

How information is used

• To provide accounts, configure the chatbot, save conversations, and show messages and leads to the business using the service.
• To generate AI replies using the business website information, configured instructions, and relevant recent messages in the conversation.
• To send visitor-message alerts through the channel selected by the business account, if that feature is configured.
• To maintain security, prevent abuse, provide support, and meet legal obligations.

Service providers

The current application code uses Supabase for authentication and data storage and Cloudflare AI to generate chatbot replies. The message text, relevant recent conversation history, and business information used to answer a visitor may be sent to Cloudflare AI for that purpose.

If a business enables message alerts, the alert may include the visitor’s message and conversation identifiers. Depending on the selected channel, delivery may use Resend for email, Telegram, or WhatsApp through Meta. The business chooses the destination and should tell its visitors about this use.

Paid checkout is not live. If payments are enabled later, Stripe is intended to process payment details. Payment-card details should be entered only into Stripe’s secure payment flow, not into chat messages.

These providers process information to deliver their services and may handle it in different countries. Their own privacy terms also apply. The final provider list and data-transfer details must be confirmed before launch.

Storage and retention

Account settings, website knowledge, conversations, and lead details are stored to provide the service. A specific deletion process and retention schedule have not yet been confirmed for this draft. Those details must be set before the policy is treated as final.

Privacy requests

For a chat on a customer’s website, visitors can start by contacting that business, which manages the chatbot and lead collection on its site. A public contact method for requests about OmniFlow accounts and stored service data must be added before launch.

Security and changes

Reasonable safeguards are used to protect information, but no online service can guarantee absolute security. This draft may be updated as the service and its providers are finalized. The published policy should show its effective date and a way to contact the operator.

Before this policy can be final

• Add the verified legal name of the service operator and a public privacy/support contact.
• Confirm data-retention periods, deletion steps, the final list of providers, and the countries where data may be processed.
• Review the policy for the privacy laws that apply to the operator and customers.