Privacy Policy

1. Who we are

FandomFlow is operated by {{LEGAL_ENTITY_NAME}}, {{REGISTERED_ADDRESS}} (“FandomFlow”, “we”, “us”). GSTIN: {{GSTIN}}.

FandomFlow is a software platform that helps creators and businesses (“Customers”) automate Instagram conversations, manage an inbox and contacts, and run an online store. This policy applies to fandomflow.com, app.fandomflow.com, our API and stores hosted on FandomFlow.

For your own FandomFlow account we are the data fiduciary (controller). For the personal data of your followers and store customers that you process using FandomFlow, you are the data fiduciary and we act as your data processor, processing it only on your instructions.

2. Information we collect

Information you give us

• Account data: name, email address, password (stored as a hash), and preferences.
• Workspace data: workspace names, team members and their roles, region settings.
• Business and billing data: plan, payment history, and — if you connect a payment account for your store — your payment gateway key ID and secret, which we encrypt before storing.
• Content: automations, messages, notes, store pages, products, images and files you create or upload.

Information from Instagram (Meta)

When you connect a professional Instagram account, and only with the permissions you approve, we receive:

• instagram_business_basic: your account ID, username and profile information, and media you have published, so you can choose posts and reels for automations.
• instagram_business_manage_comments: comments on your media (including the commenter’s Instagram-scoped ID, username and comment text), so automations can respond and you can reply.
• instagram_business_content_publish: to publish the posts, carousels, reels and stories you schedule in FandomFlow, at the time you choose. We only publish content you created or approved.
• instagram_business_manage_messages: direct messages sent to your account, story replies and button postbacks (including sender ID, username, message content and attachments), so you can read and reply in the inbox and so automations can send messages you configured.

We also store an access token issued by Instagram so the service can act on your behalf, and refresh it before it expires.

Information from Facebook Pages (optional)

If you connect a Facebook Page, with the pages_show_list, pages_manage_metadata, pages_messaging, pages_read_engagement and business_management permissions you approve, we receive the Pages you choose to share (name, ID and picture), a Page access token, and the Messenger conversations sent to those Pages: each person's Page-scoped ID, name and profile picture, and the messages, quick-reply choices and attachments they send. We use this only to show the conversations in your inbox, run the automations you set up and send the replies you or your automations write.

Information from Meta Ads (optional)

If you connect Meta Ads, with the ads_read and business_management permissions you approve, we read the ad accounts you choose to share and their ads' names, delivery status, thumbnails and the Instagram media each ad uses — only so you can target comments on your ads in automations. We don't read ad spend or billing, and we don't create or change ads. The access token is stored encrypted.

Information about your store customers

When people buy from a store hosted on FandomFlow, we process their name, email, phone, shipping address, order details and, if they create an account, their login details and saved items, on behalf of the store owner. Card, UPI and bank details are entered on Razorpay’s or PayU’s checkout and are not received or stored by FandomFlow.

Information collected automatically

• Technical data such as IP address, browser type and device information, used for security, fraud prevention and rate limiting.
• Store analytics: visits, page views and product views. Link clicks on tracked links, with a hashed visitor identifier and approximate country.
• Essential cookies for sign-in sessions and security (CSRF protection). We do not use third-party advertising cookies.
• Website analytics on fandomflow.com: Cloudflare Web Analytics counts page views and performance without cookies and without identifying you.

3. How we use information

• To provide FandomFlow: run your automations, show conversations in your inbox, host your store, process orders and bookings, and display analytics.
• To process subscription payments and keep billing records.
• To secure the service: verify webhooks, prevent abuse, enforce rate limits and investigate incidents.
• To support you and send service messages such as verification, password reset, invitations and billing notices.
• To comply with law, including tax and accounting obligations.

We process your personal data on the basis of your consent, for the specified purpose of providing the service you asked for, and for other legitimate uses permitted under the Digital Personal Data Protection Act, 2023.

4. Our commitments for Instagram data

• We use Instagram Platform Data only to provide the features you enable in FandomFlow, and in line with Meta’s Platform Terms and Developer Policies.
• We do not sell Instagram data, use it for advertising, share it with data brokers, or use it to build profiles outside your workspace.
• Instagram data in one workspace is never visible to another workspace.
• Automations only message people who first interacted with your account, within Instagram’s messaging rules.
• When you disconnect Instagram or remove FandomFlow from your Instagram settings, we stop accessing your account and delete or de-identify the related data as described in our Data Deletion page.

5. How we share information

We share personal data only with service providers that help us run FandomFlow, under contracts that require them to protect it, or where the law requires:

• Meta Platforms — to send and receive Instagram messages and comments you authorise.
• Razorpay and PayU — payment processing for subscriptions and for store checkouts.
• Cloud hosting and storage providers — to host our application, database and uploaded files.
• Cloudflare — to serve stores on subdomains and custom domains securely.
• Brevo — to deliver transactional emails such as verification and order emails.

We may disclose information if required by law, court order or a government authority, or to protect the rights, property or safety of FandomFlow, our users or the public. If our business is merged or acquired, data may transfer to the successor under this policy.

6. Where data is stored

Our service providers may store or process data in India or in other countries. Where data is transferred outside India, we do so as permitted under applicable law and with appropriate safeguards.

7. How long we keep data

• Account and workspace data: for as long as your account is active.
• Instagram conversations, contacts and automation history: while the Instagram account stays connected, or until you delete them. Disconnecting an account deletes its conversations, contact identities, automations and webhook records.
• Billing records: as long as required by tax and accounting law (generally 8 years in India).
• After you delete your account, we delete or de-identify personal data within 30 days, except where we must keep it by law. Backups are overwritten on their regular cycle.

8. Your rights and choices

Subject to applicable law, you can:

• access a summary of your personal data and how it is processed;
• correct, complete or update inaccurate data;
• erase your data, or withdraw consent (this may mean we can no longer provide the service);
• nominate another person to exercise your rights in case of death or incapacity;
• raise a grievance with our Grievance Officer, and then with the Data Protection Board of India.

Most data can be edited or deleted directly in the app. Otherwise, email {{PRIVACY_EMAIL}}. If you are a follower or shopper of a FandomFlow customer, please contact that business first; we will assist them in responding.

9. Security

We use HTTPS everywhere, encrypt payment credentials at rest, verify the signatures of incoming webhooks, protect forms against CSRF, rate-limit sign-in, and isolate each workspace’s data with role-based access checks. No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify you and the authorities as required by law. See Security.

10. Children

FandomFlow is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “Last updated” date, and notify you by email or in the app for material changes.

12. Contact and Grievance Officer

Questions or requests: {{PRIVACY_EMAIL}}.

Grievance Officer: {{GRIEVANCE_OFFICER_NAME}}, {{GRIEVANCE_OFFICER_EMAIL}}, {{REGISTERED_ADDRESS}}. We acknowledge grievances within 24 hours and aim to resolve them within 15 days.