Who controls the data
For customer contact records, CRM notes, message content, WhatsApp numbers, conversation history and similar information a Customer puts into BATFLOWS for its own business purposes, the Customer generally acts as the Controller (or equivalent role under applicable law) and BATFLOWS acts as a Processor or service provider on the Customer's behalf.
BATFLOWS acts independently for information needed to operate its own account system, prevent abuse, secure the platform, manage billing and entitlements, maintain audit records, provide support and comply with law.
Processing details
Subject matter and duration
Processing covers the hosting, organization, transmission, retrieval, display, security and support of Customer Personal Data for the period the Customer uses BATFLOWS and for any limited retention period reasonably required for deletion, backup, security, dispute or legal purposes.
Nature and purpose
Processing may include receiving business messages, storing CRM records, routing conversations, assigning team access, organizing contacts, creating categories, recording notes and follow-ups, delivering notifications, supporting customer service and operating connected WhatsApp Business functionality.
Categories of data subjects
These may include the Customer's clients, prospects, leads, customers, suppliers, employees, team members, support contacts and other people the Customer lawfully communicates with or records in its CRM.
Types of personal data
These may include names, phone and WhatsApp numbers, email addresses, company information, communication content, timestamps, tags, categories, notes, follow-ups, call metadata, attachments and other information the Customer chooses to process through BATFLOWS.
Customer instructions
BATFLOWS processes Customer Personal Data to provide the Service and according to the Customer's use and configuration of BATFLOWS, the Terms of Service, this Data Processing section and documented support instructions that are consistent with the Service.
BATFLOWS is not required to follow an instruction that would require unlawful processing, compromise another customer's data, defeat security controls or exceed the functionality and scope of the Service.
Customer privacy responsibilities
The Customer is responsible for:
- having a lawful basis for collecting and using Customer Personal Data;
- providing notices and obtaining consent or opt-in where required;
- ensuring imported contacts and message recipients were obtained lawfully;
- responding to data-subject requests unless BATFLOWS assistance is required;
- configuring team access, retention and account permissions appropriately;
- not placing unnecessary sensitive credentials or secret authentication codes in the CRM; and
- complying with sector-specific rules that apply to the Customer's own business.
WhatsApp Business processing
When the Customer connects or uses WhatsApp Business functionality, BATFLOWS may transmit and receive data through Meta / WhatsApp systems to provide messaging features. The Customer determines which people it communicates with and remains responsible for the legal basis and permissions required for those communications.
WhatsApp's current business terms explain that customer contact information and business-solution data may be processed by WhatsApp and Meta under their applicable business terms and data-processing terms. Customers should review the current official requirements before using connected messaging.
Meta / WhatsApp disclosure
BATFLOWS is not owned by, operated by, sponsored by or endorsed by Meta Platforms, Inc., WhatsApp LLC or their affiliates. WhatsApp and Meta may independently process business-account information, usage data, diagnostics, message-related information and other data under their own terms and policies.
Meta / WhatsApp may impose messaging limits, template requirements, pricing, quality requirements, account restrictions or policy enforcement. Those decisions are outside BATFLOWS' control.
Subprocessors and service providers
BATFLOWS may use service providers to operate the platform. Current categories may include:
- Supabase for database, authentication, storage, realtime and related infrastructure;
- Meta / WhatsApp where the Customer enables WhatsApp Business messaging;
- Resend or a replacement transactional email provider for service communications;
- a deployment/hosting provider used to deliver the BATFLOWS web application; and
- security, monitoring or infrastructure providers introduced where reasonably necessary to operate the Service.
BATFLOWS remains responsible for selecting providers appropriate to their role and for limiting their access to what is reasonably necessary for the service they provide.
Confidentiality and security
BATFLOWS personnel and service-provider access to Customer Personal Data is limited to legitimate operational purposes. BATFLOWS uses access controls, private storage for protected files, authentication, role restrictions, server-side secrets, security logging, session controls, rate limiting and other measures designed to protect data against unauthorized access, loss, alteration or disclosure.
The Customer is responsible for its own endpoint security, staff access, credential protection and lawful use of exported or copied information after it leaves BATFLOWS.
Data-subject requests
Where BATFLOWS processes Customer Personal Data as a processor, BATFLOWS will provide reasonable assistance, taking into account the nature of the Service, to help the Customer respond to valid requests for access, correction, deletion, restriction, portability or other rights required by applicable law.
If a person contacts BATFLOWS directly about data controlled by a Customer, BATFLOWS may direct that person to the relevant Customer unless law requires BATFLOWS to handle the request differently.
Security incidents
If BATFLOWS confirms a personal-data breach affecting Customer Personal Data for which notification to the Customer is required by applicable law, BATFLOWS will notify the affected Customer without undue delay after becoming reasonably aware of the reportable breach and will provide information reasonably available to support the Customer's response.
International transfers
Infrastructure and communications providers may process data in more than one country. Where data-protection law requires a particular cross-border safeguard, the parties will cooperate in using the mechanism reasonably required for the relevant transfer.
Return and deletion
On account closure or termination, Customer Personal Data will be deleted, returned or made unavailable according to available product features and BATFLOWS' normal deletion process, subject to backups, security records, financial records and information BATFLOWS is legally entitled or required to retain.
Updates to this disclosure
BATFLOWS may update this disclosure when subprocessors, messaging integrations, security practices or applicable requirements change. Material changes affecting how Customer Personal Data is processed may be communicated through the Service or account communications.