Privacy Policy

1. Who we are

Flash CRM is a WhatsApp customer messaging and marketing platform sold to businesses on a monthly subscription. Each customer company (a "workspace") is the data controller for the contacts and conversations it stores; Flash CRM acts as the processor on its behalf.

2. Data we process

• Account data: name, email, workspace name, role and billing status.
• Contact and lead data your workspace collects: name, phone number, email, company, tags, pipeline stage, consent status and consent timestamp.
• Conversation data: WhatsApp and website chat messages, delivery/read status, attachments and any AI-generated translations or suggested replies.
• Operational data: audit logs, webhook delivery logs, analytics counters and error reports used to keep the service reliable and compliant.

3. How we use it

To deliver and secure the service: route and store messages, apply consent and messaging safety rules, generate analytics and AI assistance, prevent abuse, handle billing and provide support. We never sell personal data and never use your customer data to train third-party models beyond the request needed to produce a response for you.

4. Consent and marketing rules

Marketing messages may only be sent to contacts who have opted in. Flash CRM records the consent flag and timestamp for every lead and blocks campaigns to contacts without consent. Workspaces must comply with WhatsApp Business Policy, GDPR/ePrivacy, CAN-SPAM and local marketing regulations. Every recipient can opt out at any time and the opt-out is honoured immediately.

5. Sub-processors

We rely on Meta (WhatsApp Cloud API) for message delivery, a managed cloud database and hosting provider for storage and compute, a payment provider for subscriptions, and AI model providers for assistant features. Access is limited to what each service needs.

6. Retention

Workspace data is retained while the subscription is active. After cancellation, data is kept for 30 days and then deleted, unless a shorter deletion request is submitted. Append-only audit logs may be retained longer where law requires it.

7. Security

Data is isolated per workspace with row-level security, API keys are stored hashed and scoped, incoming WhatsApp and plugin webhooks are signature-verified, and administrator accounts can enable two-step authentication. All traffic is encrypted in transit.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in and remember interface preferences. We do not run third-party advertising trackers in the app.

9. Your rights

You can export all workspace data as JSON and request account or workspace deletion from Settings → Data & privacy. You may also request access, correction, restriction or portability by contacting us. Deletion requests are processed within 30 days.

10. Contact

Questions about this policy or your data: reach out to your Flash CRM account manager or the support address shown in your workspace billing details.