FKFlowkick

Privacy Policy

Last updated: November 6, 2026

1. Overview

Flowkick ("we", "our", or "us") provides a hosted runtime infrastructure connecting Meta WhatsApp Flows with AI voice and chat agents. This Privacy Policy describes how we collect, use, and protect information when businesses and end users interact with our platform, website, and services.

2. Information We Process

WhatsApp Flow Interaction Data: When an end user completes an interactive WhatsApp Flow, Flowkick securely receives encrypted payloads from Meta pursuant to WhatsApp Cloud API standards. We decrypt payloads using ephemeral RSA-OAEP/AES-GCM keys to deliver the structured responses directly to the business's designated agent or integration.

Customer Phone Numbers: End-user phone numbers are never stored in plaintext or logged. We compute cryptographic HMAC-SHA256 recipient hashes for message routing and duplicate guard protection only.

Account and Business Information: For businesses creating an account on Flowkick, we store organization names, authentication credentials provided via our identity provider (Kinde), and configuration details necessary to manage Flows and third-party connections.

3. Google User Data and Google Calendar Integration

When a business connects Google services (such as Google Calendar) to Flowkick to automate appointment scheduling within WhatsApp Flows:

  • Use of Calendar Data: We access calendar availability and event creation capabilities solely to check free/busy slots and create appointments initiated and confirmed by the user within an interactive Flow.
  • Google API Services User Data Policy (Limited Use): Flowkick's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
  • No Human Access & No AI Training: We do not allow humans to read user calendar data, nor do we transfer or use Google user data to train generalized AI or machine learning models.

4. Analytics Disclosure

Our public marketing site uses PostHog Cloud EU in a strictly cookieless mode (memory persistence only). No cookies or persistent identifiers are placed on your device, and Do Not Track browser headers are strictly respected. We collect aggregate page view information to understand site performance and usage without identifying individual visitors.

5. Data Retention and Lifecycle

Flow session data, responses, and prefill information are ephemeral: they are purged automatically once delivered to the business's agent or upon session expiry (at most 24 hours). Design run snapshots not in an active or awaiting state are deleted after 30 days. When an organization account is deleted by a business, all corresponding tenant credentials, connections, Flow snapshots, and run data are immediately and permanently removed.

6. Contact and Inquiries

For questions, access requests, or privacy concerns, please contact us at privacy@flowkick.io or visit our Contact page.