Privacy policy

DasFlow is a platform for managing WhatsApp Business through Meta's official API, operated internationally by Das-Tec LLC, a limited liability company incorporated in New Mexico, United States. This policy describes the data we process, why we process it and your rights. We apply the data protection rules relevant to the operation and the people concerned, including Law No. 29733, Peru's Personal Data Protection Law, where applicable, in addition to Meta's platform terms.

Your account data: name, email address and password (stored as a cryptographic hash, never as plain text), your organization and your role within it.

Your business's WhatsApp data: the connected number, WhatsApp Business Account (WABA), message templates and their statuses, and access credentials granted by Meta, encrypted at rest with AES-256.

Your business customers' data, processed on your behalf: contacts (name, phone number), conversations, messages and media files your business exchanges through WhatsApp. Your business is the data controller for this information and DasFlow acts as the processor.

Technical data: activity and error logs needed to operate and secure the service, including IP addresses in access logs.

Cookies: we use an essential session cookie to keep you signed in and a language-preference cookie. We do not use advertising cookies or third-party trackers.

Exclusively to provide the service: deliver and receive your WhatsApp messages, operate your inbox and automations, generate AI agent answers when enabled, send operational emails (invitations and password recovery) and maintain platform security. We do not sell personal data or use it for advertising.

We only access Google Calendar after you authorize the connection. Manual scheduling and agent bookings have separate authorizations. Connecting Google does not activate agent replies or change the audience from test contacts to customers.

We access the connected account’s email to identify it, its availability intervals and primary-calendar events to check for conflicts and sync appointments. The events permission allows reading, creating, changing and deleting events on calendars you own; DasFlow limits its writes to events it has created and linked to your appointments.

We send Google the appointment title, description and time, along with internal identifiers to prevent duplicates. We do not add guests or send email invitations. Other event data is consulted to check availability and conflicts; it is not imported as contacts or added to the agent’s knowledge base.

We retain the connected email, permissions, encrypted tokens and sync records — identifiers, status, versions and technical errors — to maintain the connection and recover interrupted operations. Google processes Calendar requests and our infrastructure hosts these records. We do not sell this data, use it for advertising, or use it to develop, improve or train general-purpose AI or machine-learning models.

Our use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including its Limited Use requirements. Read Google’s policy.

You can disconnect each authorization from Appointments. DasFlow removes that connection’s tokens and stops syncing; appointments, records and existing events are retained. To revoke permission in Google, also remove the corresponding connection from your Google Account connections. Deleting DasFlow data does not by itself delete events remaining in Google. Manage Google connections.

You can request deletion of stored Calendar data using the same channel and timeframe described in this policy. To remove Google events through DasFlow, cancel and sync the appointments before disconnecting; you can also delete them directly in Google Calendar.

Only providers strictly necessary to operate the service, each under their own data protection safeguards:

• Meta Platforms (WhatsApp Business Platform) — WhatsApp message transport.
• Google — optional Google Calendar connection and syncing, only with your authorization.
• Hetzner Online GmbH (Germany) — hosting of the platform and database.
• Anthropic, OpenAI and Voyage AI (United States) — only if you enable the AI agent: processing content needed to generate answers.
• Stripe (United States) — processing subscriptions, payments and billing data; full card details do not pass through our servers.
• Culqi (Peru) — processing AI credit payments; card details go directly to Culqi and never pass through our servers.
• Resend (United States) — sending transactional emails.
• Sentry (United States) — monitoring technical errors.

Using providers in other countries may involve a cross-border transfer of data. We apply the safeguards and registration requirements of the applicable jurisdiction.

While your account is active. Database backups rotate on a 14-day cycle. If you delete your account, we permanently delete your data within a maximum of 30 days — see Data deletion.

TLS encryption in transit and AES-256 at rest for credentials and keys; hashed passwords; access separated by organization and role; event audit logs; infrastructure with restricted access.

You can exercise your rights of access, rectification, cancellation and objection by messaging us on WhatsApp at +1 650 705 6916 or from your dashboard. We respond within the time frames set by applicable law. When Law No. 29733 applies, you may contact the National Authority for Personal Data Protection of Peru's Ministry of Justice and Human Rights if you believe we have not addressed your request.

If we make a material change, we will notify you by email or within the platform before it takes effect. The last update date appears at the top of this page.