Privacy Policy

1. Who we are

Thinflow (https://thinflow.co) is operated by [Your full legal name], [Postal address], Tunisia ("we", "us"). Contact for any privacy question: hello@thinflow.co.

This policy covers two groups of people: merchants who create a Thinflow account ("you"), and the buyers who message a merchant's Facebook page, Instagram account or WhatsApp number that the merchant has connected to Thinflow ("buyers").

2. Our role

For merchant account data, we decide how the data is used (we are the controller).

For buyer data — messages, names, phone numbers, delivery addresses and orders — the merchant decides how it is used, and we process it on the merchant's behalf to provide the service (we are a processor). Buyers should first contact the merchant they talked to; we will help the merchant answer, and buyers may also contact us directly (section 8).

3. Data we collect

• Account: email address, password (stored only as a secure hash by our sign-in provider), and, if you sign in with Google, your name and profile picture from Google.
• Store profile (optional, entered by you): store name, phone, website, logo, industry, store description, policies, delivery and payment options.
• Catalogue: products, prices, stock, variants and product photos you upload.
• Connected accounts: your Facebook page, Instagram and WhatsApp identifiers, and the access tokens Meta issues for them, stored encrypted. We never see or store your Facebook, Instagram or WhatsApp password.
• Buyer data processed for you: conversation messages, and the names, phone numbers, addresses and order details buyers give in those conversations.
• Billing: your plan, and payment confirmations you send us (we receive no card details; payments are made by bank transfer, D17 or E-Dinar).
• Technical data: error reports (browser type, page, error details) and server logs (IP address, request time), kept for security and troubleshooting.
• Consent records: the date and version of the Terms and Privacy Policy you accepted, and your confirmation that you are 18 or older.

We do not use advertising or analytics trackers, and we do not build profiles of you or your buyers for advertising.

4. Why we use it

• To provide the service you signed up for: running your AI sales agent, showing your conversations, leads and orders, creating shipments (performance of our contract with you).
• To keep the service secure and working: preventing abuse, fixing errors (our legitimate interest).
• To meet legal obligations, such as keeping billing records.
• To send service emails about your account. We do not send marketing emails without your consent.

5. Who we share it with

We never sell personal data. We share it only with the service providers below, who process it for us under contract, and when the law requires it.

• Supabase — Database, sign-in and file storage (product photos, logos) (EU (Paris, France))
• Railway — Hosting of the Thinflow application servers ([Railway region — check your project settings])
• Meta Platforms (Facebook, Instagram, WhatsApp) — Receiving and sending messages on the accounts you connect (United States / EU)
• Anthropic — AI-generated product descriptions from your product photos (United States)
• [AI model provider used by the n8n agent] — Generating the agent's replies to your buyers ([Location])
• Sentry — Error monitoring (technical crash reports) ([EU or US — check your Sentry organisation's data region])
• Resend — Sending service emails (e.g. platform invitations) (United States)
• Colissimo (La Poste Tunisienne) — Creating shipments, only when you connect your own Colissimo account (Tunisia)

Some of these providers are outside Tunisia. Where we transfer personal data abroad we do so only as the law allows and with appropriate safeguards.

6. How long we keep it

• Account and store data: while your account is open. After you close it, it is deleted within 30 days, except billing records we must keep by law.
• Buyer conversations, leads and orders: until the merchant deletes them or closes their account.
• Server logs and error reports: up to 90 days.

7. Security

Data is sent over encrypted connections (HTTPS/TLS). Connected-account tokens and other stored credentials are encrypted in our database, and each merchant's data is kept separate from every other merchant's. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

8. Your rights

You can ask to access, correct or delete your personal data, to object to its use, or to receive a copy of it. You can also withdraw any consent you gave. To do this, use the Data Deletion page or email hello@thinflow.co. We answer within 30 days and may need to confirm your identity first.

If you are in Tunisia you can also complain to the Instance Nationale de Protection des Données Personnelles (INPDP). If you are in the European Union, you can complain to your local data protection authority.

9. Children

Thinflow is a business service for people aged 18 or older. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. Changes

We will post any update here with a new date and, for important changes, tell account holders by email or in the app before the change takes effect. Last updated: 25 October 2026.