Privacy policy

DasFlow is a platform for managing WhatsApp Business through Meta's official API, operated internationally by Das-Tec LLC, a limited liability company incorporated in New Mexico, United States. This policy describes the data we process, why we process it and your rights. We apply the data protection rules relevant to the operation and the people concerned, including Law No. 29733, Peru's Personal Data Protection Law, where applicable, in addition to Meta's platform terms.

Your account data: name, email address and password (stored as a cryptographic hash, never as plain text), your organization and your role within it.

Your business's WhatsApp data: the connected number, WhatsApp Business Account (WABA), message templates and their statuses, and access credentials granted by Meta, encrypted at rest with AES-256.

Your business customers' data, processed on your behalf: contacts (name, phone number), conversations, messages and media files your business exchanges through WhatsApp. Your business is the data controller for this information and DasFlow acts as the processor.

Technical data: activity and error logs needed to operate and secure the service, including IP addresses in access logs.

Cookies: we use an essential session cookie to keep you signed in and a language-preference cookie. We do not use advertising cookies or third-party trackers.

Exclusively to provide the service: deliver and receive your WhatsApp messages, operate your inbox and automations, generate AI agent answers when enabled, send operational emails (invitations and password recovery) and maintain platform security. We do not sell personal data or use it for advertising.

Only providers strictly necessary to operate the service, each under their own data protection safeguards:

• Meta Platforms (WhatsApp Business Platform) — WhatsApp message transport.
• Hetzner Online GmbH (Germany) — hosting of the platform and database.
• Anthropic, OpenAI and Voyage AI (United States) — only if you enable the AI agent: processing content needed to generate answers.
• Stripe (United States) — processing subscriptions, payments and billing data; full card details do not pass through our servers.
• Culqi (Peru) — processing AI credit payments; card details go directly to Culqi and never pass through our servers.
• Resend (United States) — sending transactional emails.
• Sentry (United States) — monitoring technical errors.

Using providers in other countries may involve a cross-border transfer of data. We apply the safeguards and registration requirements of the applicable jurisdiction.

While your account is active. Database backups rotate on a 14-day cycle. If you delete your account, we permanently delete your data within a maximum of 30 days — see Data deletion.

TLS encryption in transit and AES-256 at rest for credentials and keys; hashed passwords; access separated by organization and role; event audit logs; infrastructure with restricted access.

You can exercise your rights of access, rectification, cancellation and objection by messaging us on WhatsApp at +1 650 705 6916 or from your dashboard. We respond within the time frames set by applicable law. When Law No. 29733 applies, you may contact the National Authority for Personal Data Protection of Peru's Ministry of Justice and Human Rights if you believe we have not addressed your request.

If we make a material change, we will notify you by email or within the platform before it takes effect. The last update date appears at the top of this page.