Legal · Privacy
FlumenChat Privacy Policy
Last updated: October 27, 2026 · Version 1.1
§ 01
Who we are
FlumenChat is a business messaging platform developed and operated by FLUMEN SOLUTIONS S.A.S., tax ID (NIT) 902.004.333-8, at Carrera 128 # 144-28, Bogotá D.C., Colombia. Contact: contacto@flumensolutions.com. The Service integrates WhatsApp Business Platform and, when enabled, Instagram through Meta’s official APIs. Businesses or individuals subscribing to the Service (“Tenants”) can manage interactions with their customers and participants (“End Users”). Instagram features are in controlled testing; describing them in this Policy does not mean they are available or approved for all accounts.
§ 02
Who this Policy applies to
This Policy covers data processed in FlumenChat when business accounts are connected and WhatsApp messages, authorized Instagram conversations and interactions, and the product’s web chat are managed. It includes connected-account data and data of people interacting with those accounts, depending on the enabled feature. The corporate policy for other relationships with FLUMEN SOLUTIONS S.A.S. is available at https://www.flumensolutions.com/legal/privacy. Read both policies together with the Tenant’s instructions and applicable data processing agreements.
§ 03
Roles in data processing
• The Tenant is the Controller of its End Users’ data: it determines support purposes and configured automations, and must have the required authorizations and legal grounds. • FlumenSolutions acts as Processor for that data, following the Tenant’s instructions and applicable agreements. It acts as Controller for its own accounts and for contracting, administration and security data whose purposes it determines. • Meta processes data on its platforms under its own terms and policies. Not all processing by Meta is presumed to follow FlumenSolutions’ instructions. Providers needed to deliver FlumenChat are described in section 7. Data subjects may contact the Tenant or use the FlumenSolutions channel in section 10. Where appropriate, we coordinate the request with the Controller.
§ 04
What data does FlumenSolutions process through FlumenChat?
4.1 Account, identity and authorization • Available WhatsApp numbers, profile names and identifiers. • Instagram professional account identifiers, usernames and profile information available through the API. • Participant, conversation and authorized asset identifiers; granted permissions, access tokens and expiry information needed to maintain the integration. Authorization takes place on Meta or Instagram; FlumenChat does not request Instagram passwords. 4.2 Communications and interactions • Message text, available attachments, comments and replies, participants, and message or post identifiers. • Story replies, mentions and interaction events only where delivered by the API and permitted by authorization. • WhatsApp templates and context needed for support or the configured assistant. 4.3 Content and metrics, when enabled • Authorized own posts, images, videos, reels, stories, captions, links and metadata available through the API. • Publishing files and instructions, and account or content statistics where the feature exists and its permissions have been granted. 4.4 Technical data • Available timestamps, statuses and events; security logs, technical identifiers and data necessary for web chat. We do not request sensitive data for ordinary support. A message may contain information its sender chooses to share; the Tenant must limit it to what is necessary and apply the appropriate safeguards. The integration does not provide unrestricted access to private accounts, third-party content or general follower lists.
§ 05
What are the data used for?
Data is processed to deliver authorized and contracted features: • Receive and reply to messages; retain support context, assign conversations to agents and run configured automations. • Generate replies or classify requests with AI when the Tenant enables an assistant, sending only the necessary context to the provider. We do not use this data to train general-purpose AI models. • Synchronize approved WhatsApp templates. • Manage Instagram comments and apply rules such as keywords and public or private replies only when authorized and active. • Select own content for automations and, when implemented and enabled, import, download or publish it, or produce reports using permitted metrics. • Maintain account connections, protect the Service, handle support requests and manage data subject rights. Accepting this Policy alone does not activate planned features. Each requires implementation, granted permissions and compliance with Meta’s conditions. A comment or follow does not authorize an unlimited DM sequence. We do not sell End User data or use it for our own advertising. The Tenant is responsible for informing users and establishing lawful grounds for its communications.
§ 06
How long is data retained?
The Service’s ordinary retention policy provides for: • Tenant messages, contacts, interactions and files: during the service relationship and a closing period of up to 90 days to address instructions and export requests, unless deletion is requested or a retention duty applies. • Backups: an additional rotation period of up to 30 days, with restricted access. • Audit and security logs: up to 12 months where necessary for their purpose. • Tax and accounting records: for applicable statutory periods; this does not justify indiscriminate retention of Instagram conversations or content. Data is deleted or anonymized when its purpose and applicable retention period end. Deletion is handled under the Controller’s instructions and the published procedure; this Policy does not imply automatic deletion on account disconnection. Erasure requests can be made before service termination. Copies of own content, metadata and tokens are also subject to their purpose and the relevant request. Disconnecting Instagram in FlumenChat disables the integration. Revoking access in Instagram or Meta withdraws authorization on that platform. Neither action by itself deletes all previously stored history or originals held by Meta.
§ 07
Who is data shared with?
Access is limited to authorized Tenant users, personnel who need it and providers required to deliver the service: • Meta Platforms: WhatsApp and Instagram connectivity and transmission of messages and interactions, under its own policies. • Hetzner: infrastructure and operational storage. • Cloudflare and the network or security providers used for service availability. • AI, storage or integration providers configured for enabled features, subject to the relevant processing agreements. If AI is enabled, the provider may receive conversation content and context necessary to generate a reply. Retention depends on the contracted service, configuration and provider terms; we do not promise zero storage. This does not authorize use for unrelated purposes of the provider. Valid requests from competent authorities may also be addressed. Information is not sold or disclosed to other Tenants.
§ 08
International data transfers
Providing the Service may involve processing outside Colombia. FlumenChat’s operational infrastructure is hosted by Hetzner in Germany; Meta, Cloudflare and AI or integration providers may process information in the United States or other countries depending on their services. The Controller and FlumenSolutions, according to their roles, must apply the authorizations, processing agreements and international transfer safeguards required for the service and affected data subjects. A provider’s location does not replace these safeguards. Information on applicable providers may be requested at contacto@flumensolutions.com.
§ 09
Minors
FlumenChat is intended for businesses, not minors. The Tenant must respect WhatsApp and Instagram age requirements and safeguards applicable to processing children’s and adolescents’ data. We do not intentionally request minors’ information for ordinary support. If we detect or receive notice of unauthorized processing of such data, we will coordinate the request with the Controller and take the measures and erasure actions required by applicable law.
§ 10
End User rights
You may request access, correction, deletion, withdrawal of consent and other applicable rights over your data. Email contacto@flumensolutions.com with the subject “Data rights request — FlumenChat”, including: • The right you want to exercise and the request’s scope. • The channel and related account or business. • For WhatsApp, the related number with country code; for Instagram, your username or available identifier. An Instagram request does not require a WhatsApp number. Do not send passwords or tokens. We will request only additional information necessary and proportionate to verify your relationship with the data. Deletion instructions are at https://flumenchat.com/en/data-deletion; requests are received by email, not through an automatic form. Access inquiries are addressed within ten business days, with up to five additional days where applicable; complaints, including correction or erasure requests, within fifteen business days, with up to eight additional days, explaining the extension and its reason under applicable law. When the Tenant is Controller, we coordinate with it. The requester is informed of the decision and any mandatory retention. You may approach Colombia’s Superintendence of Industry and Commerce after completing the applicable direct request process. Deletion in FlumenChat does not erase originals retained by Meta or other Tenant systems.
§ 11
Data security
We apply technical and organizational measures appropriate to the service, including TLS for communications, access controls by role and Tenant, credential and token protection, and security records. Data access should be limited to people and providers authorized for its purpose. These measures reduce risks but cannot guarantee that an incident will never occur. Where applicable, affected Tenants and authorities will be notified in accordance with applicable law.
§ 12
Cookies
The landing uses technologies necessary for language preference and the support widget. The widget may store a local identifier to maintain the chat session. The authenticated dashboard uses its own session mechanisms. See the Cookie Policy to distinguish these technologies from advertising or tracking tools.
§ 13
Changes to this Policy
FlumenSolutions may update this Privacy Policy at any time. When material changes are made, the Tenant will be notified by email with at least 30 days' notice. The updated version will be available on the site with the date of the last update.
§ 14
Applicable law and venue
This Policy is governed by the laws of the Republic of Colombia, in particular Statutory Law 1581 of 2012 and Decree 1074 of 2015. Any dispute will be resolved by the ordinary Judges and Courts of the city of Bogotá D.C., Colombia.
§ 15
Contact
Email: contacto@flumensolutions.com Address: Carrera 128 # 144-28, Bogotá D.C., Colombia Corporate policy: https://www.flumensolutions.com/legal/privacy Deletion instructions: https://flumenchat.com/en/data-deletion