Privacy Policy

This Privacy Policy describes how Alden Peak Technologies, a company incorporated under the laws of the Republic of Tunisia, with its registered office at Immeuble Borj Khefacha, 5000 Monastir, Tunisia ("ChattyFlow," "we," "us," or "our"), collects, uses, stores, shares, and protects personal data in connection with the ChattyFlow platform, accessible at www.chattyflow.com (the "Platform"), and our related services, tools, and websites (collectively, the "Services").

This Privacy Policy applies to all users of the Platform, including visitors to our website, registered account holders, Free Plan users, Paid Plan subscribers, and any individuals whose personal data we process in connection with the Services.

This Privacy Policy forms part of our Terms of Service. By accessing or using the Platform, you confirm that you have read and understood this Privacy Policy. If you do not agree with our data practices as described in this Policy, you must discontinue your use of the Platform.

We are committed to protecting your personal data and handling it responsibly, transparently, and in compliance with Tunisian Law No. 2004-63 on the Protection of Personal Data and other applicable data protection laws.

Table of Contents

1. Who We Are and How to Contact Us
2. Personal Data We Collect
3. How We Collect Personal Data
4. How We Use Your Personal Data
5. Legal Basis for Processing
6. Cookies and Tracking Technologies
7. Third-Party Service Providers and Sub-Processors
8. International Data Transfers
9. Data Retention
10. How We Protect Your Data
11. Sharing of Personal Data
12. Your Rights as a Data Subject
13. End-User Data and Your Subscribers
14. Children and Minors Under 18
15. Third-Party Links and Services
16. Changes to This Privacy Policy
17. Contact Us

1. Who We Are and How to Contact Us

The data controller responsible for your personal data is:

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us at akhairallah@chattyflow.com. We will endeavor to respond to all privacy-related inquiries within ten (10) business days.

Privacy Officer

ChattyFlow has appointed a person responsible for the protection of personal data. You may contact our Privacy Officer directly for questions about our privacy practices, data subject rights, or compliance with Quebec Law 25 and other applicable data protection laws:

2. Personal Data We Collect

We collect the following categories of personal data about you, depending on how you interact with the Platform:

2.1 Account and Identity Data

• Full name
• Email address
• Account password (stored in encrypted form)
• Profile information you choose to provide

2.2 Contact and Communication Data

• Email address used for transactional communications and account notifications
• Records of any communications you send to us, including support requests and correspondence

2.3 Instagram Account Data (via Meta Graph API)

When you connect your Instagram account using Instagram Login for Business, we request the following Instagram Graph API permissions and use them strictly as described:

• instagram_business_basic — read your Instagram Business account profile (username, account ID, profile picture, follower/media counts) to display your account in the dashboard and identify your account when delivering automations.
• instagram_business_manage_messages — receive incoming Direct Messages and send replies on your behalf to users who initiated a conversation, in order to power the automated DM feature.
• instagram_business_manage_comments — read comments on your posts (to detect trigger words and reply publicly) and post comment replies on your behalf.
• instagram_business_content_publish — publish posts, reels, and stories that you compose inside the Platform's publishing wizard.
• instagram_business_manage_insights — read aggregated post and account insights (impressions, reach, follower demographics) to display analytics inside the dashboard.

We also receive: your Instagram Business account ID, the long-lived access token issued by Meta (stored encrypted), and the Instagram-scoped IDs (IGSIDs) of users who interact with your content via comments, story replies, or DMs. These IGSIDs allow us to deliver the message you configured to the right recipient. We do not receive end-user names, email addresses, phone numbers, or birthdays from Meta.

2.4 TikTok Account Data (via TikTok Login Kit)

When you connect your TikTok account using TikTok Login Kit v2, we request the following TikTok scopes: `user.info.basic` (open ID, display name, avatar URL), `user.info.profile`, `user.info.stats`, `video.list` (to list your published videos for selection inside the Platform), `video.upload` and `video.publish` (to upload and publish videos that you compose inside the Platform). We store your TikTok Open ID, display name, avatar URL, and an encrypted access token that is automatically refreshed before expiry.

2.4-bis TikTok Business Messaging Data

When you connect a TikTok Business account, we additionally request `messaging.manage` and `tcm.message.manage` so the Platform can receive incoming Direct Messages and comments delivered through the official TikTok Business webhooks, and send replies on your behalf to users who initiated a conversation. We process the following categories of TikTok end-user data: open ID, display name, message text, comment text, timestamps and the video ID the comment was posted under. We use this data exclusively to deliver the automated reply you configured, capture sales leads in your dashboard and compute your COD trust signals. TikTok Direct Message content and comment text are retained for a maximum of thirty (30) days from receipt and are then purged automatically; you can shorten this period or trigger an immediate purge from your dashboard at any time. Customer records created in your COD CRM (`My Customers`) as a result of a sales-word trigger are automatically deleted thirty (30) days after the trigger date, with no opt-out. We do not use TikTok end-user data to train any machine-learning model, we do not resell or share it with any advertiser, and when you revoke our authorisation — either from the TikTok app or by disconnecting inside ChattyFlow — all TikTok-derived personal data is deleted from our production systems within seventy-two (72) hours, and from encrypted backups within ninety (90) days through our standard backup rotation.

2.5 Technical and Device Data

• IP address, and the country we derive from it once, when you first sign in or connect TikTok (it decides which messaging features Meta and TikTok allow for your account, and cannot be changed from your account)
• Language settings
• Session identifiers and authentication tokens

2.6 Usage and Behavioral Data

• Pages and features of the Platform you access and interact with
• Actions taken within the Platform, including flow creation, campaign launches, and contact management activities
• Time and duration of your sessions on the Platform
• Clickstream data and navigation patterns
• Session recordings, heatmaps, and interaction data collected via Mouseflow (see Section 6)

2.7 Payment and Billing Data

We collect limited billing information necessary to process your subscription payments, including your billing name. For card payments, full payment card numbers, CVV codes and complete banking details will be collected and processed exclusively by our payment processor (ClicToPay, operated by Société Monétique Tunisie (SMT) in Tunisia) and are never stored on ChattyFlow's systems. Card payments via ClicToPay are pending activation. Please refer to Section 7 for details on our payment processor.

2.8 Booking Guest Data and Survey Responses (where enabled)

Where you enable optional Platform modules — including the Booking module (opened to each account after review) and the Surveys module — we may, on your behalf and as a data processor, collect and store data submitted by your end users through those modules. Booking guest data may include the guest's name, email address, selected time slot, attendee count, and any free-text fields you configure. Survey response data may include the option chosen by the end user, free-text replies you collect, and the Instagram or TikTok identifier of the responding user. This data is processed solely to deliver the booking confirmation, manage the guest list, or relay the survey response back to you, and is never used by ChattyFlow for advertising, profiling, or training of AI models.

2.9 Booking Assistant and Guest Consent

When a guest books through an Instagram or TikTok DM, an automated assistant handles the conversation. Booking messages are read by OpenAI to understand dates, times and requests (including Arabic dialects); names, email addresses and phone numbers are replaced with temporary codes before any text is sent, OpenAI is instructed not to store the request, and the guest's contact details are never sent to the model. Availability checks and booking changes are made only by ChattyFlow's own code. Before asking for a name, email or phone number, the assistant shows the guest a short notice explaining why the details are needed and asks for their agreement; if the guest declines, nothing is saved and no booking is made. Guests receive confirmation, reminder, change and cancellation messages by DM and email, including when an account holder cancels or deletes a booking campaign.

2.10 Policy Acceptance at Sign-up

When you create an Account with email, you confirm that you agree to our Terms & Conditions, Privacy Policy, Cookie Policy and Data Policy. We record the date, the policy version and the language of that agreement as a consent record.

3. How We Collect Personal Data

We collect personal data through the following means:

• Directly from you: When you register for an Account, complete your profile, contact our support team, or otherwise interact with the Platform.
• Automatically: When you browse our website or use the Platform, we automatically collect technical and usage data through cookies, server logs, and similar tracking technologies (see Section 6).
• From third-party platforms: When you connect your Meta Business Account or other supported third-party accounts to the Platform, we receive data from those platforms as permitted by their APIs and your account settings.
• From third-party analytics providers: We receive aggregated and anonymized usage data from Google Analytics and behavioral data from Mouseflow to help us understand how the Platform is used.
• From our payment processor: Once activated, ClicToPay (Société Monétique Tunisie) will provide us with limited transaction confirmation data and billing status information necessary to manage your card-based subscription; the ClicToPay integration is currently pending.

4. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

Local predicted-attention analysis: when you upload an image or video in Lead Engine, ChattyFlow may process it locally in your browser to estimate likely areas of visual attention. For videos, only a small deterministic sample of frames is assessed. Media pixels are not sent to a separate attention-analysis provider. We store a compact summary containing normalized hotspot coordinates, center/edge shares, sampled-frame count, analysis-version label, and generation time with the media analysis. This is a statistical prediction, not eye tracking, biometric identification, proof of viewing, comprehension, intent, or conversion. It does not identify people or determine sensitive characteristics, and our AI provider remains the source of semantic media analysis.

Automated decision-making and profiling: ChattyFlow does not make fully automated decisions that produce legal or similarly significant effects on individuals (such as eligibility, credit, employment, insurance, or government-benefits decisions). Our Lead Engine may assign a numeric lead score and stage based on conversation signals to help you prioritize follow-up; this is a business-support tool and any final decision to contact, qualify, or contract with a lead is made by you. Our Conditional Logic and Surveys features automatically branch a conversation based on the keyword, button, or reply chosen by an end user; this is operational message routing only.

5. Legal Basis for Processing

We process your personal data on the following legal bases, in accordance with Tunisian Law No. 2004-63 and, where applicable, international data protection standards:

• Performance of a contract: Processing that is necessary to provide you with the Platform and Services you have requested, including account management, platform operation, payment processing, and transactional communications.
• Legitimate interests: Processing that serves our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This includes improving the Platform, ensuring security and preventing fraud, and conducting analytics to understand how the Platform is used. Where we rely on legitimate interests, you may object to such processing (see Section 12).
• Consent: Processing that is based on your freely given, specific, and informed consent — in particular, the deployment of non-essential cookies and session recording technologies. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legal obligation: Processing that is necessary for us to comply with applicable laws, regulatory requirements, or lawful orders from competent authorities.

6. Cookies and Tracking Technologies

We use cookies, web beacons, pixel tags, session recording scripts, and similar tracking technologies (collectively, "Tracking Technologies") on our website and Platform. Tracking Technologies help us operate the Platform, remember your preferences, analyze usage patterns, and improve user experience.

6.1 Types of Tracking Technologies We Use

• Essential cookies: These are strictly necessary for the Platform to function. They enable core features such as user authentication, session management, and security. Essential cookies cannot be disabled without impairing Platform functionality.
• Analytics cookies (Google Analytics): We use Google Analytics to collect anonymized and aggregated data about how users interact with our website and Platform, including pages visited, time spent, and navigation paths. This helps us understand usage patterns and improve the Platform.
• Session recording (Mouseflow): We use Mouseflow to record user sessions on the Platform, including mouse movements, clicks, scrolling behavior, and form interactions. Session recordings help us identify usability issues and improve the user experience. Mouseflow does not capture passwords or sensitive payment information.
• Accessibility controls (AccessiYes by CookieYes): The accessibility button lets you change contrast, text size and similar display settings. It loads before any cookie choice because it is needed for accessible use of the site; in our testing it sets no cookies, stores nothing on your device and sends no tracking data. CookieYes states that it collects no personal data other than a masked IP address.
• Consent management (CookieYes): We use CookieYes to manage and record your cookie consent preferences. CookieYes stores a record of your consent choices to ensure we only deploy non-essential Tracking Technologies with your permission.

6.2 Your Cookie Choices

When you first visit our website or Platform, you will be presented with a cookie consent banner managed by CookieYes. You may accept all cookies, reject non-essential cookies, or customize your preferences. You may also change your cookie preferences at any time by accessing the cookie settings available on our website.

To opt out of Mouseflow session recording specifically, visit: mouseflow.com/opt-out

To opt out of Google Analytics tracking, visit: tools.google.com/dlpage/gaoptout

Please note that disabling certain Tracking Technologies may affect the functionality or performance of the Platform.

6.1 Website Reading Signals and the Chat Assistant

Website reading signals

When a business installs the ChattyFlow visitor script on its website, the script records how the page was read: which sections of the page came into view, how long each was in view, how far the visitor scrolled, which elements were clicked, and how much of a video was watched. It also records coarse context such as the number of pages seen in the visit, the referring source category, device type and local hour. This script also runs on chattyflow.com, including on this Privacy Policy page.

These signals are deliberately coarse. We do not record mouse coordinates, pointer paths, attention rectangles, keystrokes, form field contents, or screen recordings. Reading signals collected without consent carry no visitor identifier and cannot be linked back to a person. Where consent has been given, the signals may be linked to the conversation or lead record for that visit so the business can follow up. Legal basis: consent where consent is required, otherwise our legitimate interest in understanding how our own pages are read. Retention: 12 months, after which the records are deleted or aggregated into non-identifying totals.

Where consent has been given, the website assistant may use these signals (for example, which section a visitor slowed down on or read again) to choose when to offer help and to start the conversation from that topic. This never produces a decision with legal or similarly significant effects. Recording never starts when the browser sends a Global Privacy Control or Do Not Track signal, and every chat shows a "Stop tracking" link that stops recording at once, deletes what was recorded for that visit, and is remembered on the device for six months.

The chat assistant

Our chat assistant is an AI system, not a person, and every chat says so on screen in the visitor's language; a visitor can ask for a person at any time. Our chat assistant (the floating chat button, the FAQ widget and the in-page assistant) processes the messages a visitor types, and, if the visitor turns on the voice option, the audio the visitor records. Audio is transcribed to text and the recording is discarded after transcription. If the visitor chooses to give them, the assistant stores a name, email address and, where offered, a phone number, together with the visitor's consent to be contacted, so that the business can reply. Visitors are never required to give any of this to use the assistant.

Conversation transcripts and contact details are visible only to the business the visitor was talking to. They are never pooled across businesses, never used to train shared models, and never sent to a third party for advertising. Legal basis: consent for the contact details and for any voice recording; performance of the business's legitimate interest in answering an enquiry for the conversation itself. Retention: website chat and Flow conversations are kept for 12 months and lead records for 24 months; contact details are kept for as long as the business keeps the lead, and are deleted when the business deletes it or on request as described on our data deletion page.

Visitors may request deletion of their conversation, contact details and reading records at any time — see Data Deletion Request.

6.3 Connected AI Tools and Agent Performance Records

AI tools you connect (ChattyFlow MCP)

An account owner or manager may connect an AI assistant of their choice (for example Claude or ChatGPT) to ChattyFlow through our Model Context Protocol (MCP) server. Before anything is shared, a consent screen names the tool, shows the web address its data will be sent to, and lets you choose what it may read and change. Nothing that releases people's own words or contact details, and nothing that writes, is selected in advance.

Depending on what you select, the tool may read: what visitors to your website appear to be looking for (inferred, with evidence and a confidence, and only for visitors who consented to measurement); totals and averages; how your videos perform part by part; the questions visitors asked; how your website agent is set up and performing; and your website, Flow and FAQ leads, including the name, email address and phone number each person chose to give your business. Depending on what you select, it may also: propose answers for you to approve; propose material for your Knowledge, which is added only when you accept it and never includes Instagram or TikTok comment text; change a short list of your website agent's settings (such changes take effect immediately, are recorded with the value they replaced, and can be undone); and record the outcome of a website lead.

Data leaves ChattyFlow through this connection only on your instruction, and once received it is governed by the terms of the AI tool you chose, not by this Policy. You are responsible for choosing a tool you trust and for using what it receives lawfully, including any contact details. You can revoke a connection at any time from your dashboard, and access ends immediately. Every call a tool makes is recorded in an audit log that is kept for 90 days.

Instagram and TikTok data through a connected tool: it is available only if you separately accept the platform data terms shown on the consent screen, and the terms of Meta and TikTok always take precedence over any instruction you give. People appear only as anonymous references, never as names, handles, or platform identifiers. No message content is shared, and TikTok data is limited to totals. A Visual Flow is shared only if you add a Claude step to it, and then only its wording and the totals you selected; what people typed is never shared. A connected tool cannot send messages, reply, post, or change any Instagram or TikTok automation under any permission. LinkedIn is not available.

Agent performance records

Each night, ChattyFlow records per-business daily counts of how its website agent performed: conversations started, how far they went, leads captured, next steps agreed, hand-overs to a person, outcomes you recorded (such as won or lost), unanswered questions, visits, and which setup features were switched on. We also keep a history of changes to your website agent's settings, noting whether each change came from the dashboard or from a connected tool. The hand-over email address is recorded only as set or not set.

These records contain counts and settings only: never message content, names, email addresses or phone numbers. They are built only from website, Flow and FAQ activity, never from Instagram, TikTok or LinkedIn data. We use them to show you your agent's scorecard and to understand, across the Platform, which setups help businesses capture more leads, so that we can improve the Platform. They are visible to you and to authorised ChattyFlow staff. They are never shown to other businesses, never pooled into another business's agent, never sold, and never used to train AI models. Legal basis: our legitimate interest in measuring and improving the Services. You may object by contacting our Privacy Officer.

7. Third-Party Service Providers and Sub-Processors

We engage the following third-party service providers to help us operate and improve the Platform. Each provider acts as a data processor on our behalf and processes personal data only in accordance with our instructions and their applicable privacy policies.

We do not sell your personal data to any third party. We do not share your personal data with any third party for that third party's own marketing purposes.

8. International Data Transfers

Alden Peak Technologies is based in Tunisia. By using the Platform, your personal data may be transferred to and processed in countries other than your country of residence, including:

• European Union: Hostinger (domain and hosting), Resend (transactional email), Supabase (database infrastructure), Mouseflow (session recording), and CookieYes (consent management) store and process data on servers located within the EU, providing a comparable level of data protection.
• United States (AI processing): OpenAI processes content sent to our AI features in the United States; Google Gemini, our backup AI provider, may process it in the EU or the United States. See Section 7.
• United States / Global edge network: Google Analytics (Web analytics) and Cloudflare (reverse-proxy and security edge, USA-headquartered with global PoPs including the EU; processes connection metadata such as IP address, request headers and timestamps solely to secure and deliver the Platform).
• Tunisia: Card payments will be processed by ClicToPay (operated by Société Monétique Tunisie / SMT), a Tunisian licensed payment provider, once the integration is activated (currently pending).

Where personal data is transferred outside of Tunisia to countries that may not provide the same level of data protection as Tunisian law, we take steps to ensure that appropriate safeguards are in place, including contractual protections with our service providers. If you would like more information about the safeguards in place for international data transfers, please contact us at akhairallah@chattyflow.com.

8.1 Hosting and International Data Transfers

Personal data collected through our Platform (in particular buyer delivery information such as name, phone number, address and governorate) may be hosted by our technical sub-processor Supabase Inc. The servers used for our application are currently located in the European Union (France region). If we change the hosting region in the future, this Privacy Policy will be updated accordingly.

In accordance with Tunisian Law n° 2004-63 of 27 July 2004 on the protection of personal data, we commit to:

• Guarantee an adequate level of protection: we have entered into a Data Processing Agreement (DPA) with Supabase, contractually requiring them to process all personal data in accordance with strict security and confidentiality standards equivalent to the requirements of Tunisian law.
• Ensure the security of transfers: personal data is encrypted in transit (TLS 1.2+) and at rest (AES-256) within our database infrastructure.
• Legal authorisation: any transfer of personal data outside the Tunisian territory is carried out in compliance with the transfer mechanisms and the prior authorisations required by the Instance Nationale de Protection des Données Personnelles (INPDP).

8.2 Service Availability — North Africa and Middle East Only

The TikTok integration of ChattyFlow is offered exclusively to holders of a TikTok Business account (personal and creator TikTok accounts are not eligible) located in the following countries: MENAP region (Middle East, North Africa, Afghanistan and Pakistan), namely Tunisia, Algeria, Morocco, Libya, Egypt, Mauritania, Sudan, Djibouti, Somalia, Saudi Arabia, Kuwait, Qatar, the United Arab Emirates, Oman, Bahrain, Jordan, Lebanon, Iraq, Yemen, Palestine, Afghanistan and Pakistan. It is not offered in the United States, the European Economic Area, Switzerland or the United Kingdom, nor in any other territory. Instagram-connected features remain available outside this region. 

9. Data Retention

We retain your personal data for as long as is necessary to fulfil the purposes for which it was collected, to provide you with the Services, and to comply with our legal and regulatory obligations. The following retention principles apply:

• Account data: We retain your Account data for as long as your Account remains active. If you close your Account, we will delete or irreversibly anonymize your personal data within thirty (30) days of Account closure on our primary production systems. Encrypted backup archives may retain residual copies for up to ninety (90) additional days, after which they are automatically purged through our backup rotation cycle.
• Chat Bot and Flow conversations: Chat sessions, messages, events, ratings, and feedback collected through our own chat widget and Flow bot are retained for up to twelve (12) months from the date of the conversation. They are deleted automatically on a rolling schedule and immediately when you close your Account.
• Leads and conversation-derived data: Lead records, lead messages, notes, answers, assessments, and push history are retained for up to twenty-four (24) months from the date of creation. Knowledge gaps derived from conversations are retained for the same period. They are deleted automatically on a rolling schedule and immediately when you close your Account.
• Knowledge base content: Files, links, notes, prompts, videos, and text chunks uploaded to your knowledge bases are retained until you delete the knowledge base or close your Account. Embeddings and vector indexes derived from your content are deleted together with the source content.
• Billing and payment records: We retain billing records and transaction history for a minimum of five (5) years from the date of the transaction, or such longer period as required by applicable tax and financial regulations in Tunisia.
• Usage and analytics data: Aggregated and anonymized analytics data may be retained indefinitely as it no longer constitutes personal data. Raw usage logs are retained for up to twelve (12) months.
• Cookie consent records: Records of your cookie consent preferences are retained for up to twelve (12) months, or until you withdraw or change your consent.
• Support and correspondence: Records of support requests and communications are retained for up to three (3) years from the date of the last communication.
• AI insights and connected-platform data: Post metrics, captions, comments and the AI summaries, tips and sentiment insights derived from them are kept only while they power a feature you can see. They are removed automatically on a rolling schedule once they are no longer used, and are deleted as soon as you disconnect your Instagram or TikTok account, revoke ChattyFlow's access from the platform, or delete your Account.
• Uploaded media analyses: Images, videos, analysis results, and owner feedback are retained while they remain attached to an active Lead Engine feature and are deleted when you delete your Account.
• Agent performance records: Daily counts are retained for two (2) years and the history of agent settings changes for one (1) year. Both are deleted when you delete your Account.
• Connected AI tools: The audit log of calls made by a connected tool is retained for ninety (90) days. Answers a tool proposed and you reviewed are kept for ninety (90) days after your decision. Data a tool has already received is held by that tool's provider under its own terms.
• Records tied to a connected account: Questions asked by people in your Instagram or TikTok inbox, links created for a named recipient together with their open records, and the record of when each person last messaged you are erased as soon as you disconnect that account, the platform or the person revokes ChattyFlow's access, or you delete your Account.
• Booking guest details: A guest's name, email, phone number, Instagram or TikTok identifier and answers are erased automatically seven (7) days after the appointment ends, whatever the booking's status, and as soon as the account holder deletes the booking campaign (after the guest has been sent a cancellation notice).
• Consent and policy-acceptance records: Records proving that a guest, lead or user agreed to a notice or policy (date, notice version, notice text, language and channel) are kept as legal proof and cannot be changed or deleted while the Account exists, including when the underlying lead or booking details are erased. They are permanently deleted twenty-four (24) months after the account holder deletes their Account.
• Legal hold: Where we are required to retain data for legal proceedings, regulatory investigations, or to establish, exercise, or defend legal claims, we may retain relevant data beyond the periods stated above until the matter is resolved.

When personal data is no longer required, we delete or anonymize it in a secure manner. Where complete deletion is not immediately practicable (for example, because data is stored in backup archives), we will isolate such data from further processing and delete it as soon as reasonably possible.

9.1 Suspended or Blacklisted Accounts

If your Account is suspended, terminated for cause, or blacklisted by ChattyFlow for breach of these Terms — including violations of Meta or TikTok platform policies, fraud, abuse of the Free Plan or referral program, or harm to end users — we retain a minimal record of the closed Account (email address, hashed identifiers, account-type metadata, and the reason for suspension) for the longer of two (2) years or the duration of any related investigation. This minimal retention is strictly necessary to (i) prevent the same user from re-registering and circumventing the suspension, (ii) comply with our obligations to Meta and TikTok, and (iii) defend ChattyFlow against potential claims. No automation, message content, or end-user contacts are retained for suspended Accounts beyond the standard retention periods above.

10. How We Protect Your Data

We implement appropriate technical and organizational security measures designed to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Encryption of data in transit using industry-standard TLS/SSL protocols
• Encryption of data at rest within our database infrastructure (Supabase)
• Access controls and role-based permissions limiting access to personal data to authorized personnel only
• Regular security assessments and monitoring of our systems and infrastructure
• Secure password hashing and storage practices
• Use of reputable, security-certified third-party infrastructure providers

While we take data security seriously and employ reasonable safeguards, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your personal data. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and any applicable regulatory authorities as required by law.

You are responsible for maintaining the confidentiality of your Account credentials and for any activity that occurs under your Account. Please notify us immediately at akhairallah@chattyflow.com if you suspect any unauthorized access to your Account.

11. Quebec Law 25 and Canadian Privacy Rights

If you are located in Quebec, Canada, our collection, use, disclosure, and retention of personal information is governed by Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information). The following additional commitments apply to you:

• Transparency: We collect personal information only for the purposes described in this Privacy Policy. We will inform you of any new purpose before collecting additional personal information.
• Consent: We obtain your consent before collecting, using, or disclosing personal information, except where Law 25 permits collection without consent.
• Data minimization: We limit the personal information we collect to what is necessary for the purposes identified.
• Security: We implement reasonable security safeguards to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification.
• Retention and destruction: We retain personal information only as long as necessary for the purposes described in Section 9, after which we securely destroy, anonymize, or archive it in accordance with Law 25.
• Privacy Officer: We have designated Akram Khairallah, Founder, as our Privacy Officer. You may contact the Privacy Officer at akhairallah@chattyflow.com regarding any privacy-related matter.
• Complaints: You have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI) if you believe your privacy rights have been violated.

For users elsewhere in Canada, similar provincial privacy laws may apply, and you may contact our Privacy Officer for information about the safeguards that apply in your province.

Where Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) or substantially similar provincial private-sector privacy legislation applies, we remain accountable for personal information under our control, identify and limit collection to stated purposes, use appropriate safeguards, provide access and correction rights, and retain information only as long as necessary. Cross-border processing may make information accessible to courts, law-enforcement bodies, or regulators in the destination jurisdiction, subject to applicable law.

11.1 European Economic Area, United Kingdom and Switzerland

Where the GDPR, UK GDPR, or Swiss data-protection law applies, we process personal data under the legal bases in Section 5 and provide the rights listed in Section 13. You may complain to the supervisory authority where you live, work, or believe an infringement occurred. International transfers rely on an applicable adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful safeguard, as appropriate. We do not use Lead Engine scores or media analysis to make solely automated decisions producing legal or similarly significant effects.

Alden Peak Technologies is established in Tunisia. Where appointment of an EU or UK representative is legally required, the representative's identity and contact details will be published here before the Services are intentionally offered in that territory.

11.2 United States State Privacy Rights

Residents of US states with applicable consumer privacy laws may have rights to know, access, correct, delete, and obtain a portable copy of personal information, and to opt out of sale, targeted advertising, or certain profiling. We do not sell personal information for money and do not use End-User data for targeted advertising. You may disable non-essential analytics through our cookie settings and submit a verified request or appeal a denied request by contacting our Privacy Officer. We will not discriminate against you for exercising an applicable privacy right. These rights apply only where the relevant law covers ChattyFlow and may be subject to statutory exceptions.

12. Sharing of Personal Data

We do not sell, rent, or trade your personal data to third parties. We share personal data only in the following limited circumstances:

• With our sub-processors: We share personal data with our authorized service providers listed in Section 7, strictly as necessary to provide the Platform and Services.
• With an AI tool you connect, at your instruction: When an account owner or manager connects an AI tool through ChattyFlow MCP, we send it only the categories they selected, as described in Section 6.3. That tool's provider is not our sub-processor; it acts under your agreement with it.

13. Your Rights as a Data Subject

Depending on your location and the applicable data protection laws, you may have the following rights with respect to your personal data:

• Right of access: You have the right to request a copy of the personal data we hold about you and to receive information about how it is processed.
• Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure: You may request deletion of your personal data by closing your Account. Upon Account closure, we will delete or anonymize your personal data within a reasonable period, subject to any legal retention obligations.
• Right to data portability: You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another controller where technically feasible. You can download your account data from your Settings, or request it by emailing our Privacy Officer.
• Right to restriction: You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while the accuracy of the data is contested.
• Right to object: Where we process your personal data on the basis of legitimate interests, you have the right to object to such processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on your consent (such as non-essential cookies), you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Quebec Law 25 rights: If you are in Quebec, you have the right to request information about the personal information we hold about you, to request correction of inaccurate personal information, to withdraw consent to the collection, use or disclosure of your personal information (subject to legal or contractual restrictions), and to file a complaint with the Commission d'accès à l'information du Québec (CAI). Our Privacy Officer is responsible for ensuring compliance with Law 25.
• Right to lodge a complaint: You have the right to lodge a complaint with the competent data protection authority in your jurisdiction. In Tunisia, the supervisory authority is the Instance Nationale de Protection des Données Personnelles (INPDP), reachable at www.inpdp.nat.tn.

To exercise any of the rights listed above, please submit your request to us in writing at akhairallah@chattyflow.com. We will respond to all verified requests within thirty (30) days. We may ask you to verify your identity before processing your request.

14. End-User Data and Your Subscribers

When you use the Platform to manage conversations with and send messages to your own subscribers, customers, or end users ("End Users"), you act as an independent data controller with respect to that End-User data. ChattyFlow processes End-User data on your behalf as a data processor, strictly in accordance with your instructions and this Privacy Policy.

You are solely responsible for:

• Ensuring you have a valid legal basis to collect and process your End Users' personal data
• Providing your End Users with appropriate privacy notices explaining how their data will be used, including its processing by ChattyFlow
• Obtaining all necessary consents from your End Users for communications sent through the Platform
• Handling any data subject rights requests made by your End Users with respect to their personal data
• Ensuring your use of End-User data through the Platform complies with all applicable laws

ChattyFlow does not use End-User data for its own independent purposes beyond what is necessary to provide the Platform to you, except for the anonymous daily counts described in Section 6.3 (Agent performance records). Those counts are drawn only from website, Flow and FAQ activity and identify no End User. We do not sell End-User data, and we do not use it to build profiles for advertising purposes.

14.1 Meta Platform Data Commitments

With respect to any data obtained from Meta (including from the Instagram Graph API), ChattyFlow expressly commits to the following, in accordance with the Meta Platform Terms and Developer Policies:

• No sale or licensing. We do not sell, license, or purchase any Meta Platform Data.
• No advertising. We do not use Meta Platform Data for advertising, retargeting, building advertising audiences, measuring ad performance, or any similar purpose.
• No combining. We do not combine Meta Platform Data with data obtained from any other source for the purpose of profiling, ad targeting, or building independent datasets about end users.
• No discrimination or eligibility decisions. We do not use Meta Platform Data to determine eligibility for housing, employment, insurance, education, credit, government benefits, or to make decisions that would have a legal or similarly significant effect on a person.
• No machine learning training. We do not use Meta Platform Data to train, fine-tune, or evaluate machine learning or artificial intelligence models, whether ours or those of third parties.
• Limited retention. We retain Meta Platform Data only as long as necessary to operate the Platform for you, and we delete it when you disconnect your Instagram account, when Meta or the user revokes access, when your Account is deleted, or upon Meta's request.
• Restricted access. Access to Meta Platform Data is limited to authorized personnel and the sub-processors listed in Section 7, who are bound by confidentiality and security obligations.
• No performance evaluation. Meta Platform Data is never included in the agent performance records described in Section 6.3.
• Sharing with a connected AI tool only on explicit instruction. Meta Platform Data reaches an AI tool you connect only after you explicitly accept the platform data terms on the consent screen; we keep evidence of that instruction. People appear only as anonymous references, message content is never shared, and no permission lets a tool send, reply, post, or change an automation on Instagram.

How users can revoke access and request deletion. End users (followers/customers) can revoke ChattyFlow's access at any time directly on Instagram by going to Settings → Apps and Websites → Active and removing ChattyFlow. Account holders may also disconnect their Instagram account at any time from the ChattyFlow dashboard, which triggers immediate deletion of all associated Meta Platform Data on our servers. Users may also submit a data deletion request through Meta's Data Deletion Callback at: https://www.chattyflow.com/instagram-data-deletion.

15. Children and Minors Under 18

The Platform and the Services are not intended for use by anyone under the age of 18, nor does ChattyFlow knowingly collect or solicit personal data from anyone under the age of 18. If you are under 18, you may not attempt to register for the Service or send any information about yourself to us, including your name, address, telephone number, or email address.

In the event that we confirm that we have collected personal data from someone under the age of 18 without verification of parental consent, we will delete that information promptly. If you believe we may have inadvertently collected personal data from a minor, please contact us immediately at akhairallah@chattyflow.com.

16. Third-Party Links and Services

The Platform may contain links to third-party websites, platforms, and services that are not owned or controlled by ChattyFlow, including Meta platforms and payment processors. This Privacy Policy applies only to data processed by ChattyFlow and does not cover the data practices of any third-party services.

17. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the Services we provide. When we make material changes, we will notify you by sending an email to your registered address and/or by posting a prominent notice on the Platform. The updated Privacy Policy will display its revised effective date at the top of the document.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the updated Privacy Policy, you must discontinue your use of the Platform and close your Account.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal data.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we process your personal data, please contact us:

We will make every effort to address your inquiry promptly and to resolve any concerns you may have about our data practices. If you are not satisfied with our response, you have the right to lodge a complaint with the Instance Nationale de Protection des Données Personnelles (INPDP) in Tunisia or the competent data protection authority in your country of residence.