Privacy Policy

TrustFlow ("TrustFlow", "we", "us") is a software service that helps brands moderate and reply to comments and direct messages across their social media (Facebook, Instagram, TikTok), connected email inboxes, and connected e-commerce stores, with the help of artificial intelligence.

This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights. For any question or request, contact us at arthur@trytrustflow.ai.

Depending on the features you use, we collect:

• Account & billing data: your name, email, organization details, and subscription information (payments are processed by InflowPay — we never store full card numbers).
• Connected social accounts: through OAuth, the pages/profiles you connect (Meta, Instagram, TikTok) and the comments, direct messages, and public profile information needed to moderate and reply.
• Connected email inboxes: if you connect a mailbox (via Nylas), the email threads you choose to manage.
• Connected Shopify stores: your shop domain and product catalogue; and, only if you enable order features, order and customer information (such as name, email, and order status).
• Usage & technical data: log data, device and browser information, and cookies strictly necessary to keep you signed in.

We use your data to:

• Provide the service: display, moderate, label, and reply to comments and messages, build your knowledge base, and run your automations and analytics.
• Provide AI assistance: message and knowledge-base content is processed through AI models to generate reply suggestions, labels, and summaries.
• Handle billing, provide support, ensure security, and comply with legal obligations.

We do not sell your data or your customers' data, and we do not use it for advertising.

We process personal data on the following legal bases: performance of our contract with you; our legitimate interest in operating, securing, and improving the service; your consent where required; and compliance with our legal obligations.

To deliver the service, we share the minimum necessary data with trusted providers acting on our behalf:

• OpenAI — AI text generation and embeddings.
• Qdrant — vector storage for your knowledge base.
• InflowPay — subscription billing.
• Meta, TikTok, Nylas, and Shopify — the integrations you choose to connect.
• Our hosting and infrastructure providers (EU-based) and Vercel — running and delivering the application.

These providers process data only to provide their service to us and are bound by confidentiality and data-protection terms.

When you connect a Shopify store, we access your product data to keep your knowledge base up to date. If you enable order features, we also access order and customer data to answer order-status questions and enrich your inbox. We access this data only to provide these features to you (the merchant) — never to sell or repurpose it.

We honour Shopify's mandatory data-protection webhooks:

• customers/redact — we delete the specified customer's personal data.
• shop/redact — we delete all of the store's data after the app is uninstalled.
• customers/data_request — we provide the requested customer data to the merchant.

For data belonging to your social followers, email contacts, or store customers, we act as a data processor on your behalf. You are the data controller; we process this data solely to provide the service to you and under your instructions.

We keep your data while your account is active and for as long as needed to provide the service. When you disconnect an integration or delete your account, we delete or anonymise the related data within 30 days, except where we must retain it for legal reasons (for example, invoices). Shopify shop/redact requests are honoured after uninstall as required.

We share data only with the sub-processors listed above and where required by law. We never sell personal data. Our infrastructure is primarily hosted in the European Union; some sub-processors may process data outside the EU under appropriate safeguards (such as Standard Contractual Clauses).

We encrypt data in transit (TLS) and encrypt sensitive credentials such as access tokens at rest. Access to personal data is restricted to authorised personnel.

Depending on your location, you may access, correct, delete, export, or object to the processing of your personal data. To exercise these rights, email arthur@trytrustflow.ai. You may also lodge a complaint with your local data-protection authority.

We use only the cookies strictly necessary to keep you signed in and to secure the service. We do not use advertising cookies.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new date and, for material changes, notify you.

Questions or requests regarding your data: arthur@trytrustflow.ai.