Privacy Policy

Who operates the service

Flowmora is the brand of a multi-tenant real estate CRM and of this public website. The legal entity that operates the service is [TODO: legal entity name].

The public website address is https://flowmora.cc. The CRM application is intended to run at https://app.flowmora.cc. The API is intended to run at https://api.flowmora.cc. The published office address is [TODO: office address].

What this policy covers

This policy describes personal data processed on this marketing website and inside the Flowmora CRM. The CRM is used by real estate businesses to organize leads, contacts, pipelines, tasks, team users, and WhatsApp communications.

It does not replace a customer’s own notice to buyers, and it does not describe Meta’s or WhatsApp’s separate privacy practices.

Business customers and individuals

A brokerage, developer, or other business customer decides why its CRM records are used. Flowmora processes those records to provide the service. The legal role and the legal basis for that processing are [TODO: controller or processor role and legal basis].

This draft does not invent a legal basis. The confirmed wording has to replace the placeholder before publication.

Account information

The CRM stores the user’s name, email address, role, company membership, and authentication secret. Roles in the product are platform owner, company admin, and sales agent.

Passwords are stored by the API as a one-way hash. This marketing website does not create CRM accounts and does not store session tokens.

Business customer data

Company records include the company name, default country code, time zone, currency, and the preference for assigning new WhatsApp leads. Each company is stored separately from other companies.

Leads and contacts

Customers and their users enter, or receive through a connected channel, lead and contact details. Those details can include a name, phone number, source, property interest, budget, notes, tasks, assignment, pipeline status, and an activity history.

WhatsApp and Meta integration data

When a company connects WhatsApp, the CRM processes message content, phone numbers, delivery status, template identifiers, and the WhatsApp Business account identifiers required to send and receive messages for that company.

An admin can enter Cloud API settings in the CRM, or start Embedded Signup when a Meta app id is configured. Flowmora does not claim that Meta has approved or certified the product.

Message traffic is sent through Meta’s WhatsApp Cloud API. Meta processes that traffic under its own terms. Webhook requests are received by the Flowmora API.

Marketing website

This website is a static site. It has no account, no contact form, and no analytics package in this version. Choosing a language uses a normal link, not a stored profile.

The server that later hosts these files may keep ordinary access logs, such as IP address, user agent, and the page requested. Those logs are not a CRM record. No tracking cookies are set by the pages themselves.

Why data is processed

Flowmora processes data to provide the CRM, authenticate users, keep each company’s records separate, deliver WhatsApp messages a customer chooses to send, protect the service, and handle support, privacy, and deletion requests.

Sharing and service providers

Data is shared with the infrastructure used to host the website, application, and database once those providers are engaged, with Meta when a customer uses WhatsApp, with advisers when the operator needs professional advice, and with authorities when the law requires it.

Named service providers are [TODO: named service providers]. Production hosting has not been commissioned, so this draft does not list a current host. Flowmora does not sell personal information.

Security

CRM routes require a signed-in user. The API selects the company from that user. A platform owner may pass a company identifier, and the API accepts it only when that company exists and is active. The browser is not allowed to read another company’s records by supplying an unchecked identifier.

WhatsApp credentials are kept for the API connection. They are not included in this public website. These measures reduce risk. They do not guarantee that unauthorized access is impossible.

Retention

The confirmed retention schedule is [TODO: retention schedule]. This draft does not state a number of days, because that period has not been set.

International transfers

The confirmed transfer arrangement is [TODO: international transfer mechanism]. If operators or hosts process data outside the country where it was collected, the mechanism has to be written here before publication. No destination country is claimed today.

Your rights

Depending on the law that applies, a person may ask for access, correction, deletion, restriction, or a copy of personal data, and may object to certain processing. This draft does not promise a right that a specific statute has not been confirmed to provide.

When a business customer decides how CRM records are used, its staff and the people in those records should also be able to contact that customer. Requests can still be sent to Flowmora at the privacy contact below.

Access and deletion requests

Deletion is requested by a person, not performed automatically by this website. The data deletion instructions explain what to send and how account removal differs from disconnecting WhatsApp. The privacy contact is [TODO: privacy contact email].

Contact for privacy requests

Privacy contact: [TODO: privacy contact email]. Support: [TODO: support email]. Phone: [TODO: phone number]. Postal address: [TODO: office address].

Until those details are published, this website cannot receive a privacy request. Do not send personal data to an address that is still a placeholder.

Changes and effective date

The effective date of this policy is [TODO: effective date]. When the policy changes, the updated text will be posted at this same address.