The short version
- HeloFlow is run by PureFlow Studios in Lucknow, India. Our main database and files are stored in India (Mumbai).
- For your account and billing, we decide how data is used. For the contacts and WhatsApp conversations in your workspace, your business decides and we process them on your behalf.
- We never sell personal data, never show ads, and don't put advertising or analytics cookies on heloflow.com.
- We don't use your customers' messages to train AI models. AI replies only run when your workspace switches them on.
- You can export everything, erase a single contact, or delete your whole workspace from Settings → Data & privacy.
This summary is here to help. The full text below is what applies.
Who we are
HeloFlow is a customer messaging and CRM product for businesses that use WhatsApp. It is operated by PureFlow Studios, a sole proprietorship registered in India (GSTIN 09RFSPS2815K1ZA), with its registered address at E-4/77, Hardoi Road, Lucknow 226003, Uttar Pradesh, India. In this policy, "HeloFlow", "we", "us" and "our" mean PureFlow Studios.
This policy covers our website (heloflow.com), the HeloFlow app (app.heloflow.com), our API, and any support or sales conversation you have with us. It is written to meet India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it, and the Information Technology Act, 2000.
Two roles we play
How we treat personal data depends on whose data it is.
- Your account data. When you sign up, invite teammates, pay for a plan, fill in a form on our website or write to support, we decide why and how that data is used. For this data we are the Data Fiduciary (the "controller").
- Your workspace data. When your business uses HeloFlow, you add contacts, receive and send WhatsApp messages, track leads and upload files. Your business decides why and how that data is used. For this data your business is the Data Fiduciary and we are its Data Processor. We only process it to run HeloFlow for you, under our Data Processing Agreement.
If you messaged a business that uses HeloFlow, that business is responsible for your data. Please contact the business first. If you can't reach them, write to privacy@heloflow.com with the business's name and your WhatsApp number, and we will pass your request on and help them act on it.
What we collect
Account and profile
Your name, email address, phone number, business name, industry, team size and role. If you sign in with a password, we store it only as a salted hash. If you sign in with Google, Google shares your name, email address and profile picture with us.
Workspace data you add or receive
- Contacts: names, WhatsApp numbers, tags, notes, custom fields and opt-in records.
- Conversations: WhatsApp messages you send and receive, including text, images, documents, audio, video and locations, and their delivery status.
- Leads and pipeline stages, activity history, remarks and expected values.
- Message templates, broadcasts, automated flows and sequences, WhatsApp forms and their responses.
- Knowledge-base documents you upload for AI replies.
- Payment links you create through your own Razorpay account, and whether they were paid.
Data from Meta when you connect WhatsApp
When you connect a number through Meta's sign-up window, Meta gives us your WhatsApp Business Account ID, phone number ID, display name, quality rating, messaging limit and template statuses, plus an access token that lets HeloFlow send and receive messages for that number. We store the token encrypted, and we delete it when you disconnect the number.
Billing
Your plan, invoices, GST details you provide, and payment status. Card, UPI and bank details are entered on Razorpay's pages and handled by Razorpay; we never see or store your full card number.
Technical and security data
IP address, browser and device type, sign-in times, and a log of important actions in your workspace (for example, who changed a plan or deleted a contact). We use these to keep accounts secure, limit abuse such as mass sign-ups, and fix errors.
Website visitors
If you fill in a form on heloflow.com (book a demo, contact us, newsletter or integration request), we collect what you type: typically your name, email, phone number, company, team size and message. We also record your IP address and browser to filter spam. We do not use advertising pixels, analytics cookies or tracking scripts on heloflow.com.
How we use it
We use personal data only for the purposes below.
| Purpose | Examples |
|---|---|
| Provide HeloFlow | Sign you in, deliver and receive messages, run broadcasts, flows, sequences and AI replies, store files |
| Keep it secure | Detect fraud and abuse, enforce plan limits, investigate security incidents |
| Support you | Answer questions, troubleshoot problems you report |
| Billing and tax | Charge for plans, issue GST invoices, keep records the law requires |
| Improve the product | Measure feature usage in aggregate, find and fix bugs |
| Tell you about HeloFlow | Service emails about your account; product news only if you agreed, with an unsubscribe link in every email |
| Meet legal obligations | Respond to lawful requests, keep required records |
We do not read your conversations. We only look at workspace data when you ask us to (for example in a support request), when it is needed to investigate a security incident or a breach of our Acceptable Use Policy, or when the law requires it.
We do not sell personal data, and we do not use it for advertising.
AI features
AI replies and knowledge-base search are off until someone in your workspace switches them on. When they are on, the text of relevant incoming messages and the relevant parts of your knowledge base are sent to our AI provider (OpenAI, or Anthropic if your workspace chooses its models) to write a reply or to index your documents. If your workspace adds its own AI provider key, that provider processes the data under your own agreement with them.
We don't use your workspace data to train AI models, and under their business API terms our AI providers don't either. AI replies can be wrong: your workspace decides when AI answers and when a person takes over.
WhatsApp and Meta
HeloFlow is built on Meta's WhatsApp Business Platform. Every WhatsApp message you send or receive passes through Meta, and Meta processes it under the WhatsApp Business Terms and Meta's Privacy Policy. HeloFlow is an independent product and is not affiliated with, or endorsed by, Meta or WhatsApp.
Who we share data with
- Service providers who help us run HeloFlow, such as hosting, database, payments and AI. They may use the data only to provide their service to us, under contract. The current list is on our Sub-processors page.
- Meta, to deliver the WhatsApp messages you send and receive.
- Integrations you set up, such as webhooks, API keys, Zapier, Make, Pabbly or your own Razorpay account. You choose what they receive.
- Authorities, when the law requires it, for example a valid court order or a lawful request from a government agency. We only share what is required.
- A successor business, if HeloFlow is transferred, for example to a company incorporated by its owners. This policy will continue to protect your data, and we will tell you before any change.
Where your data is stored
Our main database and file storage are in India, in Amazon Web Services' Mumbai region, provided by Supabase. Some service providers process data in other countries: for example, our web hosting network, Meta, and our AI providers in the United States. We only transfer personal data to countries that the Government of India has not restricted under Section 16 of the DPDP Act, and our providers are bound by contract to protect it.
How long we keep it
| Data | How long |
|---|---|
| Workspace data | For as long as your workspace exists. When an owner deletes the workspace there is a 7-day window to change your mind; after that it is permanently erased, including files, usually within 24 hours |
| Images, documents, audio and video in chats | 90 days by default. Your workspace can choose 30, 90, 180 or 365 days, or keep them indefinitely |
| A contact you erase | Removed immediately with their conversations and leads; their files are deleted within 24 hours |
| Messages deleted in the inbox | Removed permanently after 90 days |
| Raw WhatsApp webhook records | 14 days |
| Error and delivery logs | 14 to 30 days |
| Billing and tax records | As long as Indian tax and accounting law requires, usually six to eight years |
| Website form enquiries | Up to 24 months after our last contact, unless you become a customer |
| Encrypted backups | Deleted data can remain in backups for up to 30 days, until they are overwritten |
How we protect it
- All traffic to HeloFlow is encrypted in transit (HTTPS), and data is encrypted at rest.
- WhatsApp access tokens, AI keys and payment keys are stored in an encrypted vault, never in plain database columns.
- Each workspace is isolated at the database level, so one business can never read another's data.
- Roles (owner, admin, agent) limit what each teammate can see and change, and important actions are logged.
- Only people who need access to run HeloFlow have it, and they are bound by confidentiality.
No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires, without undue delay, and explain what happened and what we are doing about it.
Your rights
Under the DPDP Act you have the right to:
- Know what personal data we process about you and how we use it.
- Correct, complete or update inaccurate or incomplete data.
- Erase data we no longer need, or that you withdrew consent for, unless the law requires us to keep it.
- Withdraw consent at any time, as easily as you gave it. This doesn't affect anything we did before you withdrew.
- Nominate someone to exercise these rights for you if you die or can't act yourself.
- Have a grievance addressed by our Grievance Officer, and then complain to the Data Protection Board of India if you are not satisfied.
Most of this you can do yourself in the app: edit your profile, export your workspace, erase a contact or delete the workspace in Settings → Data & privacy. For anything else, write to privacy@heloflow.com from the email address on your account. We will confirm who you are, reply within 30 days, and tell you if the law stops us from doing what you asked.
If you are a customer of a business that uses HeloFlow, see Two roles we play. You can also stop that business's WhatsApp messages at any time by replying STOP.
Children
HeloFlow is a tool for businesses and is not meant for anyone under 18. We don't knowingly collect children's personal data. Businesses must not use HeloFlow to message children, or to process their data, without the verifiable parental consent the DPDP Act requires.
Cookies
heloflow.com sets no advertising or analytics cookies. The app uses a small amount of storage in your browser to keep you signed in and remember your settings. Details are in our Cookie Policy.
Changes to this policy
When we change this policy, we update the date at the top. If a change materially affects how we use your data, we will email workspace owners or show a notice in the app at least 15 days before it takes effect.
Contact and grievance officer
Questions or requests about privacy: privacy@heloflow.com.
- Operated by
- PureFlow Studios, a sole proprietorship registered in India
- Registered address
- E-4/77, Hardoi Road, Lucknow 226003, Uttar Pradesh, India
- GSTIN
- 09RFSPS2815K1ZA
- Support
- support@heloflow.com · +91 63936 40650
- Privacy and data requests
- privacy@heloflow.com
- Legal notices
- legal@heloflow.com
For complaints about how we handle personal data, or anything else about HeloFlow, you can write to our Grievance Officer. We acknowledge every grievance within 24 hours and aim to resolve it within 15 days.
- Name
- Aviral Singh
- Designation
- Grievance Officer, PureFlow Studios
- Address
- E-4/77, Hardoi Road, Lucknow 226003, Uttar Pradesh, India
- Hours
- Monday to Saturday, 10:00 to 19:00 IST (except public holidays)
Questions about this document?
Write to legal@heloflow.com or see all the ways to reach us.