Privacy Policy

Last updated: October 15, 2026

This policy explains how QChulo (“we”) handles information in ChatFlow, a service that lets businesses (“clients”) automate replies to comments and messages on their own Instagram professional accounts and Facebook Pages.

Who is responsible for what

For the people who comment on or message a client (“contacts”), the client decides what its automations do and is responsible for that data; we process it on the client's behalf and only to provide ChatFlow to that client. For the people who use ChatFlow itself (the client's staff), we are responsible for their account data.

Information we collect

From clients

• Account details: name, email address and password (stored hashed) of the people who log in to ChatFlow.
• Connected accounts: the Instagram professional account or Facebook Page the client connects, its ID, name, username, profile photo, posts (to choose where an automation runs) and the access token Meta issues when the client grants permission.
• The automations, texts, media and settings the client creates.

About contacts, through Meta's platform

• Their Instagram- or Messenger-scoped ID, name, username and profile photo.
• The comments they leave on the client's posts and the messages they send to the client, and button taps.
• Information they choose to type in a conversation, for example an email address or phone number when an automation asks for it.
• Whether they opened a link sent by an automation (to send a reminder only to people who did not).

How we use it

• To run each client's automations: detect the keyword, send the client's reply, show the conversation in the client's dashboard.
• To send emails the client set up, when a contact gave their email for that purpose.
• To keep the service secure, working and within Meta's rules (for example, the 24-hour messaging window).

We do not sell personal information, we do not use it for advertising, and we do not use one client's data for another client.

Sharing

We share data only with the service providers that run ChatFlow, under their own security commitments: Meta Platforms (to receive and send Instagram and Messenger comments and messages), Railway (hosting and database) and Resend (email delivery, only for clients who use email). We may disclose information if the law requires it.

Retention

We keep data while the client uses ChatFlow. When a client disconnects an account or closes its ChatFlow account, or a person asks us to delete their data, we delete it as described in our Data Deletion page, except where the law requires us to keep something.

Security

Data travels over encrypted connections (HTTPS). Access to each client's data is limited to that client's users and to our staff when needed to provide support.

Your choices and rights

• Contacts can stop the conversation at any time by not replying, and can ask the business or us to delete their data.
• Anyone can ask us for a copy of their data or to correct or delete it by writing to chatflow@qchulo.com.
• People can also remove ChatFlow's access from their Instagram or Facebook settings (Apps and websites).

Children

ChatFlow is a business tool and is not directed to children under 13.

Changes

We will post any change to this policy on this page with a new date.

Contact