Privacy Policy

Last updated: August 2026

Plain Flow ("we," "us," "our") builds and operates automation services for small businesses, including automated reception and messaging, appointment booking, social media marketing, and customer follow-up. This policy explains what information we handle on behalf of the businesses that hire us, how it is used, and how it is protected.

Who this applies to

This policy covers the businesses that use our services ("you," "your business"), and the information about your customers that passes through our automations while we act on your behalf. Where we handle information about your customers, we do so as a service provider to you — your business remains responsible for its own relationship with its customers.

What we collect

• Business information you provide: business name, contact details, opening hours, services offered, pricing, staff availability, and product details and photos.
• Customer contact and booking information, where an automation requires it: name, phone number, appointment times and history, and the content of messages sent to or from your business.
• Account access to the tools you ask us to connect — such as your calendar, WhatsApp Business number, or Facebook, Instagram and TikTok accounts. This is granted through each platform's own official authorization process. We do not receive or store your passwords.
• Records of automated activity: which messages were sent, which bookings were made, which posts were published and when, and whether each succeeded or failed.

How we use it

• To answer calls and messages, take bookings, publish content, and send follow-up messages on your behalf, as configured with you.
• To generate content — replies, captions, reminders, and edited images — using AI text and image generation services.
• To notify you when something needs your approval or when an automation fails.
• To keep a record of what the automations did, so you can review it.

We do not sell your data or your customers' data. We do not use your business information, product photos, or customer messages to train AI models.

Who we share it with

Information is processed by third-party providers only as needed to perform a specific step of the service:

• AI processing providers, which process message content, product details and photos in order to generate replies, captions and edited images.
• Messaging and telephony providers, which deliver calls and messages to and from your customers.
• Calendar and scheduling tools you have connected, used to read availability and create appointments.
• Cloud storage providers, used to host generated images so they can be published.
• Social media platforms you have connected (Facebook, Instagram, TikTok), which receive the final image and caption at the moment of publishing, under your own account's terms with that platform.
• Record-keeping tools, used to store your catalog, bookings and activity history.

We do not permit these providers to use the data for their own purposes beyond performing the service.

How long we keep it

Business records, booking history and publishing history are kept for as long as your business uses our services, so you have a continuous record. Message content is retained only as long as needed to operate the automation and provide you with a history of it. You can request deletion of your data at any time using the contact details below.

Your controls

• You can revoke our access to any connected account at any time, from that platform's own settings.
• You can request a copy of the information we hold about your business.
• You can request that we delete your business's data, and your customers' data, from our systems.
• You can require manual approval for anything that goes out, or pause any automation entirely.
• If one of your customers asks you to delete their information, contact us and we will remove it from our systems.

Customer opt-outs

Every automated message we send on your behalf includes a way for the recipient to stop receiving them. Once someone opts out, they are excluded from future automated messages across all of your automations.

Security

Access tokens and credentials are stored securely and are never shared in plain text. Access to your business's data is limited to what is needed to operate your automations.

Changes to this policy

If this policy changes in a way that affects how information is used, we will update the date at the top of this page and notify you directly if the change is significant.

Contact us