← Back to Flas CRM

Privacy Policy

Last updated: 26 August 2026

Security & trust at a glance

Your workspace is separated from other companies at the data layer. Access to customer records is limited to signed-in members of that workspace, and sensitive connection credentials are handled by server-side operations rather than returned to the browser.

  • Workspace-level access controls protect contacts, chats, invoices and integrations.
  • Important actions such as consent, imports, exports and message actions are recorded in an audit log.
  • Incoming WhatsApp and supported plugin webhooks are verified before they are processed.
  • Admins can enable authenticator-app two-factor authentication.
  • Workspace admins can download their data or submit a deletion request from Settings.

We do not claim a security certification unless one has been independently completed and published.

1. Who we are

Flas CRM is a WhatsApp customer messaging and marketing platform sold to businesses on a monthly subscription. Each customer company (a "workspace") is the data controller for the contacts and conversations it stores; Flas CRM acts as the processor on its behalf.

2. Data we process

  • Account data: name, email, workspace name, role and billing status.
  • Contact and lead data your workspace collects: name, phone number, email, company, tags, pipeline stage, consent status and consent timestamp.
  • Conversation data: WhatsApp and website chat messages, delivery/read status, attachments and any AI-generated translations or suggested replies.
  • Operational data: audit logs, webhook delivery logs, analytics counters and error reports used to keep the service reliable and compliant.

3. How we use it

To deliver and secure the service: route and store messages, apply consent and messaging safety rules, generate analytics and AI assistance, prevent abuse, handle billing and provide support. We never sell personal data. AI features only send the information needed for the requested workspace feature to the configured model provider, such as a draft, translation or suggested reply.

4. Consent and marketing rules

Marketing messages may only be sent to contacts who have opted in. Flas CRM records the consent flag and timestamp for every lead and blocks campaigns to contacts without consent. Workspaces must comply with WhatsApp Business Policy, GDPR/ePrivacy, CAN-SPAM and local marketing regulations. Every recipient can opt out at any time and the opt-out is honoured immediately.

5. Sub-processors

We rely on Meta (WhatsApp Cloud API) for message delivery, a managed cloud database and hosting provider for storage and compute, a payment provider for subscriptions, and AI model providers for assistant features. Access is limited to what each service needs.

6. Retention

Workspace data is retained while the subscription is active. After cancellation, data is kept for 30 days and then deleted, unless a shorter deletion request is submitted. Append-only audit logs may be retained longer where law requires it.

7. Security

Data is isolated per workspace with row-level security. Sensitive integration credentials are restricted to server-side operations and are not returned through normal browser data requests. Incoming WhatsApp and supported plugin webhooks are signature-verified, and administrator accounts can enable two-step authentication. All traffic is encrypted in transit.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in and remember interface preferences. We do not run third-party advertising trackers in the app.

9. Your rights

You can export all workspace data as JSON and request account or workspace deletion from Settings → Data & privacy. You may also request access, correction, restriction or portability by contacting us. Deletion requests are processed within 30 days.

10. Contact

Questions about this policy or your data: reach out to your Flas CRM account manager or the support address shown in your workspace billing details.