Privacy policy

This is a translation. If there is any discrepancy, the Spanish version prevails.

This Policy explains how WaFloW.ai, operated by Clic and App Agency SL («we»), collects, uses, stores and protects personal data when you use our website, the platform and its services (the «Service»). It also explains your rights under applicable law, in particular the General Data Protection Regulation (GDPR).

1. Definitions

• Account: a unique profile created to access the Service.
• Company: Clic and App Agency SL, owner of WaFloW.ai.
• Cookies: small files stored on your device while browsing.
• Personal data: any information that identifies or can identify a natural person.
• Service: the platform and the website available at waflow.ai.
• Service provider: a third party that processes data on behalf of the Company.
• Usage data: information collected automatically when the Service is used.
• User: the natural or legal person who uses the Service.
• Business: the company or professional that uses WaFloW.ai to manage its communications with its customers.
• Business Contacts: the people the Business communicates with through the Service.

2. Who is responsible for each piece of data

• Your account data and your use of the Service: we are the data controller.
• Business Contacts' data (conversations, contacts, appointments, leads and forms): the Business is the controller. We act as processor, only to provide the service to the Business and following its instructions.
• If you are a customer of a business that uses WaFloW.ai, please address your requests to that business first. You can also write to us and we will pass your request on.

3. Data we collect

3.1. Data you give us

When you sign up, buy a plan, contact support or use interactive features, we may collect your name, email address, phone number, business details, IP address and approximate location.

3.2. Data the Business manages in the Service

WhatsApp messages, emails and SMS; voice notes, images and files; contact details; appointments, tasks and leads; and form responses.

3.3. Usage data

IP address, device and browser type, operating system and time zone, referring pages, pages visited, session length and interactions within the platform.

4. Cookies

We use cookies and similar technologies to sign you in, remember your preferences, measure use of the Service and improve it.

On the website we also use analytics and advertising cookies: Google Analytics, the Meta pixel and Rewardful, which attributes sign-ups coming from our affiliates. You can reject or delete them in your browser settings; some features may not work properly without them.

5. What we use data for

• Providing and maintaining the Service and managing accounts.
• Running the features the Business enables: inbox, AI agents, automations, broadcasts and integrations.
• Providing support and customer service.
• Sending operational or administrative communications.
• Analysing use of the platform and improving it.
• Ensuring security and preventing abuse.
• Complying with legal obligations.

We do not sell personal data to third parties.

6. Legal basis

• Performance of a contract: to provide the Service.
• Consent: when you give it expressly, for example for analytics or advertising cookies.
• Legal obligation: to comply with applicable law.
• Legitimate interest: for security, analysis and improvement of the Service, provided your rights do not prevail.

7. Meta data (WhatsApp, Facebook and Instagram)

When a Business connects its WhatsApp Business, Facebook or Instagram accounts, or its Meta ad account, WaFloW.ai processes the data it receives from Meta solely to provide the service to that Business:

• WhatsApp, Messenger and Instagram messages, with the name and identifier of the person who writes;
• comments and reviews on the Business's own Facebook Page and Instagram account, and the posts the Business publishes from WaFloW.ai;
• the answers people give in the Business's Meta lead forms;
• the Business's own ad accounts, their campaigns and their results.

We use it to show it in the Business's inbox, reply, automate, publish and measure results. If the Business turns it on, WaFloW.ai sends Meta conversion events about the Business's own contacts so that the Business can measure its ads. We do not sell this data, share it with other businesses or use it for our own advertising. It is kept while the account is active or until the Business or the person concerned asks for it to be deleted (section 14).

8. Google data

WaFloW's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We only access what the user connects, and only for the features they enable:

• their name and email, if they sign in with Google;
• their Gmail, if they connect it to the inbox;
• their Google Calendar, if they connect it to the calendar feature: the list of their calendars, so they can choose which ones to use, and the events on the calendars they choose, to create, move and cancel appointments and to avoid double bookings;
• the Google Drive files and Sheets they expressly choose for their automations.

In addition:

• We do not transfer this data to third parties, except to provide or improve user-facing features, for security or to comply with the law.
• We do not use it for advertising.
• We do not sell it.
• No person reads it, except with the user's consent, for security, to comply with the law, or when it is aggregated and anonymised.
• We do not use data obtained through Google Workspace APIs to develop, improve or train generalised artificial intelligence or machine learning models.

If you connected WaFloW with Google, you can disconnect Google Calendar (Appointments > My Google Calendar > Disconnect) or Google Drive (Integrations > Google Drive and Sheets > Disconnect) in WaFloW, or remove WaFloW's access at any time at myaccount.google.com/connections. Once disconnected, WaFloW stops accessing your Google data. To delete the data already stored, see section 14.

9. AI providers and other connected services

If the Business enables AI agents or features, the content needed to generate the reply is sent to the AI provider it chooses (for example OpenAI, Anthropic or Google). Depending on what it enables, this includes the conversation text, the transcript of an audio message or the description of an image.

If the Business uses its own key or account, that processing is also governed by its agreement with the provider. The same applies to other services the Business connects, such as ElevenLabs for voice or Twilio for SMS.

10. Who we share data with

• Service providers: hosting, analytics, support and infrastructure.
• The services the Business connects, to provide the features it enables.
• Public authorities, when required by law.
• Third parties in the event of a merger, acquisition or corporate reorganisation.

All of them are contractually bound to protect the confidentiality and security of the data.

11. How long we keep data

We keep data while the account is active and, afterwards, for as long as the law requires. After that, we delete or anonymise it securely. We may keep aggregated, anonymous information for internal analysis.

12. International transfers

Some providers may process data outside the European Economic Area, for example in the United States. In that case we apply appropriate safeguards, such as the European Commission's standard contractual clauses, agreements with providers and technical and organisational security measures.

13. Your rights

You have the right to access your data, rectify it, request its erasure, restrict or object to its processing, request its portability and withdraw your consent at any time.

You can exercise them by writing to soporte@waflow.ai. You can also lodge a complaint with a supervisory authority; in Spain, the Spanish Data Protection Agency (AEPD).

14. Data deletion

You can ask us to delete your data at any time.

How to request it

Email soporte@waflow.ai from your account email with the subject «Data deletion». Include your name, the business and what you want deleted: your whole account or the data of a specific integration.

If you connected WaFloW.ai with Facebook or Instagram

1. On Facebook, go to Settings & privacy → Settings → Apps and websites.
2. Find WaFloW and click «Remove».
3. Email soporte@waflow.ai so we also delete the data we received from Meta.

If you are a customer of a business that uses WaFloW.ai

That business is responsible for your data. Ask it directly, or write to us and we will pass your request on.

Timeframe

We handle each request within 30 days at most and confirm by email once it is done. Some data may be kept for as long as the law requires, for example invoices.

15. Security

We apply reasonable technical and organisational measures to protect data: encrypted connections (HTTPS), secure infrastructure and access controls. Each Business works in a space separate from the others, and the keys of connected services are stored encrypted. No system is completely secure, so we cannot guarantee absolute security.

16. Children

The Service is not aimed at children under 14 and we do not knowingly collect their data. If we find that such data has been collected, we will delete it.

17. Corporate transactions

In the event of a merger, acquisition or sale of assets, personal data may be transferred as part of the transaction. We will inform you beforehand.

18. Third-party links

The Service may include links to third-party sites. We are not responsible for their privacy policies or their content.

19. Changes to this Policy

We may update this Policy. We will publish the new version with its date and, if the change is significant, give notice by email or within the platform.

20. Contact

• Entity: Clic and App Agency SL
• Email and privacy contact: soporte@waflow.ai