Privacy Policy

This policy explains what personal data BusinessFlow, a product of Jai Digital Ads (“BusinessFlow”, “we”, “us”), handles, why, who it is shared with, how long it is kept, and the choices you have. BusinessFlow is operated by Jai Digital Ads from Coimbatore, Tamil Nadu, India.

Two kinds of data, two roles

• Our customers’ account data. When a business signs up (a “customer”), we decide how their account data is used. For this data we are responsible for it.
• Our customers’ contacts. Customers store their own contacts in BusinessFlow (for example people who fill in their lead forms). The customer decides why and how those contacts are used; we process that data on the customer’s behalf and only to provide the service. If you are someone’s contact and want your data changed or removed, contact that business first. You can also write to us and we will pass your request on and help them act on it.

What we collect

From customers and their team members

• Name, email address and password (the password is handled by our sign-in provider; we never see it).
• Workspace details: business name, time zone, country, plan and team roles.
• WhatsApp Business connection details received from Meta when you connect a number (account and number IDs, and an access token stored encrypted).
• Records of actions in your workspace needed to run it, such as imports and bulk actions.
• Billing details for paid plans: the name and address (and, if given, the GSTIN) printed on invoices, the plan and period bought, and payment records from Razorpay (payment and order IDs, amount, status and the payment method type, such as UPI or card). Card, bank and UPI details are entered with Razorpay and never reach us.

Contacts customers store in BusinessFlow

• Phone number, name, and any tags or custom fields the customer adds.
• Consent records: whether a person opted in or out, when, how, and for form sign-ups the exact wording they saw, its version and the page they were on.
• For lead forms: what the person typed, which form and page it came from, and campaign (UTM) tags in the page address.
• WhatsApp conversations with the customer’s business: the messages people send and the replies the customer’s team sends, with their time and delivery status, the person’s WhatsApp profile name, and notes the team adds (notes are never sent to the person).
• Files: copies of photos, documents and other media people send or receive in conversations (so the customer’s team can still see them after WhatsApp’s own copy expires), files the team sends, media in the header of a campaign, and invoice PDFs the team sends on WhatsApp. They are kept in private storage (see “Where files are stored”).
• Contact imports: the spreadsheet (CSV) a customer uploads, and a report of how each row was imported, which lists the numbers in the file.
• If someone replies STOP (or a similar word), we record that they opted out, from which message and when.

From people who fill in a BusinessFlow lead form

• What they type into the form.
• A one-way, daily-changing code derived from their IP address (not the address itself), used only to spot abuse. It is deleted after 30 days. Raw IP addresses are used only briefly to apply rate limits and are not stored.
• Forms are protected by Cloudflare Turnstile, which checks the visitor’s browser to tell people from bots. Cloudflare processes that data under its own privacy policy.

This website

businessflow.jaidigitalads.com does not use analytics, advertising or tracking cookies, and loads no third-party scripts except the early-access form (a BusinessFlow lead form). Its fonts are served from our own site.

Why we use it

• To provide the service: sign-in, workspaces, contacts, lead forms and connecting WhatsApp numbers.
• To keep it secure and stop abuse, such as spam submissions.
• To take payment for plans, issue invoices and receipts, and email renewal reminders, storage warnings and invoices to a workspace’s admins.
• To contact customers about their account, and to reply to early-access requests.
• To meet legal obligations.

We do not sell personal data, and we do not use customers’ contacts for our own marketing.

WhatsApp messages

BusinessFlow is built for Meta’s WhatsApp Business Platform (Cloud API). When WhatsApp messaging is enabled for a customer, message content passes through Meta’s systems and is also subject to Meta’s terms and policies. We store the conversations so the customer’s team can read and answer them. BusinessFlow never sends messages to a customer’s contacts on its own, including after a STOP: the customer decides what is sent and to whom, and opted-out contacts are excluded from campaigns.

Where files are stored

Files (conversation media, files the team sends, campaign media, invoice PDFs sent on WhatsApp, and contact import files and reports) are stored with Backblaze B2 in its US West region, in the United States. The storage is private: files are never published or given a public link. They are shown or downloaded only through BusinessFlow, to signed-in members of the workspace they belong to, after we check that the person may see them.

Who we share data with

We use these providers to run BusinessFlow, only for the purposes above:

• Supabase: database and sign-in. Our database is hosted in the AWS Mumbai region (India).
• Resend: sends account emails such as sign-up confirmations, password resets and team invitations, and billing emails (invoices, renewal reminders, storage warnings).
• Razorpay (Razorpay Software Private Limited, India): processes payments for paid plans. You enter card, bank or UPI details with Razorpay, not with us; we receive only the payment’s IDs, amount, status and method type.
• Cloudflare: website hosting and security, network protection, and Turnstile spam checks on forms.
• Meta Platforms: the WhatsApp Business Platform, and Facebook Login when you connect a WhatsApp Business account.
• Backblaze (B2 Cloud Storage, US West region, United States): private storage for the files described above.
• Our server host: the servers that run BusinessFlow’s application and its background work. We will name the provider here before customers’ data is processed on them.

Some of these providers process data outside India: in particular, stored files are kept in the United States (Backblaze), and Meta and Cloudflare operate worldwide. Before we start using any new provider that handles personal data, we will add it to this list.

How long we keep data

• Account and workspace data: for as long as the account is open, then deleted on request unless we must keep it by law.
• Invoices, refund receipts and payment records: kept for as long as the law requires us to keep accounting records, even after a workspace is deleted.
• Contacts: until the customer deletes them. When a contact is deleted, what they typed into lead forms is erased. Their phone number and consent history are kept so that, if the number is added again, an earlier opt-out is still respected.
• Conversations: until the contact is deleted, or until the customer’s retention setting removes them (a customer can choose to erase conversation content older than 90, 180, 365 or 730 days). Either way we erase the text and content of the messages, the team’s notes, our copies of the original WhatsApp notifications, and the stored files. We keep only non-content records (when a message was sent or received, its type, delivery status and Meta’s charge details) for billing, statistics and audit.
• Files in conversations: deleted from storage together with the conversation content, as above. A file we could not copy is available only while WhatsApp keeps it (7 days for files people send, 30 days for files the team sends).
• Campaign media: kept with the campaign for as long as the customer’s workspace exists.
• Contact imports: the uploaded file is deleted as soon as it has been imported, or after 24 hours if the import is never started. The import report is deleted automatically 30 days after the import.
• Connected online stores: we keep only the order number, status, total, currency and tracking link. The store’s original order notifications are cleared after 7 days and deleted after 90 days.
• Developer API: records of webhook deliveries are deleted after 30 days; daily request counts after 400 days.
• The workspace activity log: entries are deleted after 365 days.
• Lead-form sign-ups held back by a customer’s limits, and blocked spam: deleted after 30 days.
• The daily IP-derived code on form submissions: cleared after 30 days.
• When a workspace is deleted, its stored files are removed from storage within a week.

Your choices and rights

You can ask to see, correct or delete personal data we hold about you, or withdraw consent you gave us, by emailing hello@jaidigitalads.com. We will confirm who you are before acting and reply within a reasonable time. If your data is held by one of our customers, we will help that business act on your request.

When a customer completes a deletion request for one of their contacts, we erase that person’s name, WhatsApp profile name, custom fields, tags, conversation content and team notes, stored files, lead form answers, deals and notes about them, scheduled messages, and their phone number. All of the workspace’s contact import reports are deleted too, since they may list the number. Two things remain: a one-way coded form of their number and WhatsApp ID, so they are never messaged again, and invoices already issued to them (tax records), no longer linked to the contact. Draft invoices to them are deleted.

Security

Data is encrypted in transit, access tokens are encrypted at rest, each workspace’s data is kept separate from every other workspace, stored files are kept in private storage with no public links, and access is limited to what is needed to run the service.

Children

BusinessFlow is a business service and is not meant for children.

Changes

If we change this policy, we will update the date at the top and, for significant changes, tell customers by email.

Contact

Questions or requests about privacy:

BusinessFlow, a product of Jai Digital Ads
Registered address: [Registered address: to be added]
Phone: [Phone: to be added]
Email: hello@jaidigitalads.com