These terms explain how Dunnflow handles the personal data of your customers when it runs a WhatsApp or Instagram assistant for your business. They sit alongside the terms of service and follow India's Digital Personal Data Protection Act, 2023 (the DPDP Act).
Roles
You, the business, decide why customer data is collected and what it is used for. In the words of the DPDP Act you are the data fiduciary. Dunnflow processes that data only on your instructions and only to provide the service. Dunnflow is the data processor.
What Dunnflow processes
- Phone numbers, Instagram usernames and profile names of people who message your business.
- The messages, button taps, photos and documents they send, and the replies the assistant sends.
- Details given in a conversation: bookings, names, order items, payment status.
- Consent records: who agreed to receive messages you start, and who asked to stop.
- Delivery and read receipts as provided by Meta.
What Dunnflow does with it
- Answers messages, takes bookings and orders, sends the reminders and receipts you configured.
- Shows the conversations, bookings and payments to you on your dashboard and in your daily summary and monthly report.
- Writes bookings and leads to a Google Sheet that you own, if you switch that on.
- Nothing else. No advertising, no selling, no use for other clients, no training of models on your customers' messages.
Where it is stored
Messages travel through Meta's WhatsApp Business Platform and Instagram messaging platform under Meta's own terms. Conversation records are stored on servers controlled by Dunnflow in India. Payment links are created by your own payment provider, Razorpay, Cashfree or your UPI handle; Dunnflow never sees card or bank details.
Your customers' rights
- Any customer can reply STOP to stop receiving messages your business starts. It takes effect immediately and is honoured on both channels.
- Any customer can reply DELETE MY DATA. Their conversation records with your business are removed from Dunnflow's systems within 7 days and you are told.
- You can ask Dunnflow to export, correct or delete any customer's records within 7 days of asking.
- Marketing messages are sent only to people recorded as having agreed to receive them.
Security
Every call between Meta and Dunnflow is signed and verified. Access to your records is limited to you, the people you add, and Dunnflow staff maintaining the service. Dashboard sign-in uses one-time codes sent to the owner's WhatsApp, with sessions you can end from any device.
Sub-processors
Meta Platforms (WhatsApp and Instagram messaging), Cloudflare (network and website hosting), Google (Sheets, only if you enable it, and the Gemini API, which reads the words of a message that matches no button or keyword so we can pick your approved reply; phone numbers and names are removed first), your chosen payment provider, and Anthropic (the optional AI assistant, which receives the customer's question and your approved information, nothing more). We tell you before adding any other.
Incidents
If we learn of a breach affecting your customers' data we tell you within 72 hours with what happened, what was affected and what we did.
When you leave
Within 7 days of the end of service we hand your records over in a standard format or delete them, as you instruct, and remove our access to your Meta assets.