Privacy Policy

1. Who We Are

FoxlyFlow is a messaging API platform operated by FoxlyApps (“we”, “us”, “our”), an entity operating under the laws of India. FoxlyFlow lets businesses and developers (“Customers”) send and receive WhatsApp messages with their own customers (“End Users”) through Meta’s WhatsApp Business Platform. This policy covers the FoxlyFlow website, dashboard and API (together, the “Service”).

FoxlyFlow also powers WhatsApp features in Foxly COD, our Shopify app. Foxly COD’s own privacy policy is at https://www.foxlycod.com/privacy.

2. Our Role

For Customer account data (for example, the email address used to sign in), we are the data controller.

For End User data that Customers send or receive through the Service (phone numbers, messages, media), the Customer is the controller and we process that data on the Customer’s behalf and on its instructions, to provide the Service. End Users should contact the business that messaged them first; we will help that business answer requests.

3. Contact Information

For any questions about this policy or your data:

• FoxlyApps
• Email: support@foxlyapps.com

4. Data We Collect

A. Customer account data

• Name, email address and password (stored only as a one-way hash)
• Workspace name, API key metadata (never the full key after creation), webhook URLs
• Audit records of account actions (for example, key rotation, channel connection)

B. WhatsApp Business Platform data

• The Customer’s WhatsApp Business Account ID, phone number ID, business display name, quality rating and messaging limits provided by Meta
• Access tokens issued by Meta, stored encrypted (AES-256-GCM) and used only to send and receive messages for that Customer
• End Users’ WhatsApp phone numbers and profile names
• Message content (text, images, video, audio, documents), message templates, and delivery, read and failure statuses

C. Technical data

• IP addresses, request IDs, timestamps and error logs, used for security, rate limiting and troubleshooting

5. How We Use Data

• To provide the Service: deliver messages, receive replies, report statuses and send webhooks the Customer configured
• To secure the Service: authentication, rate limiting, abuse prevention and audit logs
• To support Customers and fix problems
• To meet legal obligations

We do not use message content or End User data for advertising or to train models, and we do not sell personal data.

Legal basis: performance of our contract with the Customer, our legitimate interest in running a secure service, and legal obligations.

6. WhatsApp and Meta

Messages are sent through the WhatsApp Business Platform operated by Meta Platforms, Inc. Meta processes them under its own terms and privacy policy. When a Customer connects a WhatsApp Business Account through Meta’s Embedded Signup, Meta shares with us the account identifiers and access token described above, only for the permissions the Customer approves.

Customers are responsible for obtaining End Users’ opt-in before messaging them and for complying with the WhatsApp Business Messaging Policy. A Customer can disconnect WhatsApp at any time, which deletes the stored access token and stops all messaging for that account.

7. Sharing

We share data only with:

• Meta Platforms, Inc. — to send and receive the WhatsApp messages Customers choose to send
• Infrastructure providers that host the Service (cloud hosting, databases, storage), under confidentiality and security obligations
• The webhook endpoints a Customer configures, which receive that Customer’s own events
• Authorities, when required by law

8. Retention

• Account data: while the account is active, and deleted within 30 days of a deletion request
• Messages and statuses: while the Customer’s account is active, unless the Customer asks us to delete them earlier
• Media files: deleted automatically 30 days after upload or receipt
• Idempotency records: deleted automatically after 7 days
• Records we must keep by law (for example, billing): for the legally required period

9. Security

• TLS encryption in transit
• Access tokens and webhook signing secrets encrypted at rest
• API keys stored only as hashes; scoped keys and rotation
• HMAC-signed webhooks, rate limiting and audit logging

10. Cookies

The dashboard uses one strictly necessary cookie to keep you signed in. The public website uses no advertising or analytics cookies.

11. International Transfers

Meta and our infrastructure providers may process data outside India. Where they do, we rely on their contractual and security commitments to protect it.

12. Your Rights and Data Deletion

You may request access to, correction of, or deletion of your personal data at any time.

Email support@foxlyapps.com with the subject “Data deletion request”. We confirm within 7 days and complete deletion within 30 days, except records we must keep by law. Full instructions: https://flow.foxlyapps.com/data-deletion

13. Children

The Service is for businesses and is not directed at children under 18. We do not knowingly collect their data.

14. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, complaints may be addressed to our Grievance Officer:

• Email: support@foxlyapps.com

We respond within 30 days.

15. Changes to This Policy

We may update this policy. The “Last updated” date above shows the latest version; material changes are announced by email or in the dashboard.

16. Governing Law

This policy is governed by the laws of India.