Privacy Policy

1. Who we are

AllFlow (“AllFlow”, “we”) operates the platform available at allflow.biz. For any question about this policy or about your personal data, the contact is felipe@allflow.biz.

2. Our two roles: controller and processor

Understanding this makes the rest of the policy straightforward.

When you use the platform —your account, your team, your projects, your integrations— AllFlow is the controller of that data.

When the platform sends a survey or a message on behalf of a customer organization, that organization is the controller and AllFlow processes the data as a processor, following its instructions and only to provide the service. In plain terms: if you received a WhatsApp survey, your data is controlled by the company that sent it, not by AllFlow.

3. What data we process

We process these categories:

• Your account data: name, email address, role and organization, login credentials (passwords are stored hashed, never in plain text) and usage preferences.
• Data of surveyed individuals, processed on behalf of a customer organization: name, WhatsApp number, consent and opt-out status, survey answers (values and text) and messaging metadata such as the message identifier, its delivery status and the date.
• Content you upload: briefs, tasks, projects, tickets, files and the code from the repositories you connect.
• Conversations with AI assistants: the text you type in the help chat, the sales assistant and the planner, together with the context the platform assembles to answer (for example, files from your repository).
• Payment data: payments are processed by Paddle as merchant of record. AllFlow does not store card numbers; we receive the subscription status and a customer identifier from the provider.
• Technical data: IP address, device and browser type, and error and security logs.

4. Why we use it

To provide the service and support you; to deliver surveys and store the answers; to generate plans, proposals and code with AI assistants; to authenticate and administer accounts; to invoice and collect payment; to prevent abuse and protect the platform; and to comply with legal obligations.

We do not use your data for advertising and we do not sell it.

5. Who we share it with

Only with the providers that run the platform, under contractual confidentiality and security obligations. The main ones:

• Meta Platforms — WhatsApp message delivery through the WhatsApp Business Platform.
• Twilio — message delivery for organizations using that transport.
• Neon — the PostgreSQL database where the information lives.
• Vercel — application hosting and task execution.
• GitHub — the code repositories you connect to the platform.
• Supabase — the database for organizations that use it.
• Large language model providers, for example DeepSeek — for the help chat, the sales assistant and the planner.
• Resend — transactional email delivery.
• Paddle — payments, subscriptions and invoicing.

6. International transfers

Our providers process data in the United States and the European Union. These transfers are necessary to operate the service and are covered by each provider's contractual obligations.

7. How long we keep it

• Account data: while the account is active and up to 12 months after it closes.
• Survey answers and contact data of surveyed individuals: for as long as the customer organization keeps them. By default, up to 24 months after the survey closes; afterwards they are deleted or anonymized.
• Technical and security logs: up to 12 months.
• Billing records: for the periods required by tax regulations.

8. How we protect it

Data travels encrypted (TLS) and is stored with role-restricted access. Each integration's credentials are stored per organization and always displayed masked. Sensitive actions are logged.

9. Your rights

You may request access, rectification, erasure, objection and portability of your personal data by writing to felipe@allflow.biz. We respond within 30 days.

If your data came from a survey, the request must be resolved by the organization that sent it, since it is the controller. If you write to us, we will guide you and assist that organization in resolving it.

The applicable framework is Chilean Law No. 19,628 on the Protection of Private Life and, once in force, Law No. 21,719.

10. Cookies and local storage

We use only the cookies and local storage required to keep your session signed in and remember your preferences. We use no advertising or third-party tracking cookies, and no behavioural analytics tools.

11. Minors

AllFlow is a work tool for companies and professionals and is not directed at anyone under 18. We do not knowingly collect data from minors.

12. Changes to this policy

If we change this policy, we update the date in the header. If the change is significant, we notify you by email or inside the platform before it takes effect.