Privacy Policy
At ProfileFlow, we take the protection of your data seriously. This policy explains what information we collect, how we use it, and the rights you have when you use our Instagram automation platform at profileflow.bio.
By using ProfileFlow, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the service.
Information We Collect
We collect only the information necessary to provide our services. This falls into the following categories:
- Account Information: Your name, email address, and professional role when you register or sign in via Google OAuth.
- Google Profile Data: When you authenticate with Google, we receive your name, email address, and profile picture. We do not access Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service.
- Instagram Account Information: When you connect an Instagram Business or Creator account, we receive your Instagram username, profile data, and account metadata required to enable automations.
- Instagram Interaction Data: We process direct messages, comments, mentions, story interactions, and keyword triggers from your connected Instagram account solely to execute the automation workflows you configure. This data is processed in real-time and is not used for advertising.
- Link-in-Bio Store Data: Product listings, storefront configuration, and transactional data associated with your ProfileFlow store.
- Analytics & Usage Data: Anonymized data about how you interact with the ProfileFlow dashboard — pages visited, features used, and performance metrics for your automations.
- Technical Data: IP address, browser type, operating system, device identifiers, and security event logs collected to maintain platform security and prevent unauthorized access.
Google Authentication
ProfileFlow uses Google OAuth 2.0 to allow you to sign in securely without creating a separate password.
- Data Accessed: Your full name, email address, and profile picture from your Google account.
- Data Not Accessed: We do not request or access your Gmail messages, Google Drive files, Google Calendar events, Google Contacts, or any other Google Workspace data.
- Purpose: Google data is used exclusively for account creation, authentication, and populating your ProfileFlow profile. It is not shared with third parties or used for advertising.
- Revocation: You may revoke ProfileFlow's access to your Google account at any time via myaccount.google.com → Security → Third-party apps with account access.
Meta / Instagram Authentication
ProfileFlow integrates with Instagram Business and Creator accounts through Meta's official OAuth flow. Connecting your Instagram account is entirely optional and necessary only to use automation features.
- Permissions Requested: We request only the permissions required for automation:
instagram_business_basic,instagram_business_manage_messages, andinstagram_business_manage_comments. - Data Accessed: Instagram account profile, incoming direct messages, comments, mentions, and story interactions — processed only to execute your configured automations.
- Scope Limitation: ProfileFlow accesses only the data required for features explicitly approved by Meta during our app review process. We do not access personal Facebook profiles, ad accounts, or data beyond the approved Instagram Business API scopes.
- Revocation: You may disconnect your Instagram account at any time via ProfileFlow's dashboard (Settings → Connected Accounts) or directly via Instagram Settings → Apps and Websites → Remove ProfileFlow. See our Data Deletion page for full instructions.
Automation Processing
What We Process
When you enable automations, ProfileFlow processes incoming DMs, comments, mentions, story replies, and keyword triggers in real-time on your behalf to execute the workflow rules you have configured.
Authorization Requirement
Automation processing occurs only after you have explicitly connected your Instagram account and activated a workflow rule. ProfileFlow never processes your Instagram data without your prior authorization.
User Responsibility
You are responsible for the automation rules you configure, including the content of automated responses and the keywords that trigger them. ProfileFlow processes your instructions as configured; we do not independently review the content of your automation workflows.
Payment Processing
All subscription payments are processed securely by Razorpay, a PCI-DSS compliant payment gateway. ProfileFlow does not store, handle, or have access to your full card number, CVV, or banking credentials.
- What Razorpay Handles: Card details, UPI credentials, net banking authentication, and payment authorization. Razorpay's privacy policy governs data collected during their payment flow.
- What ProfileFlow Stores: Your Razorpay customer ID, subscription ID, billing email, and invoice history for account management and support purposes. We also retain the last 4 digits of your card and card brand for display in your billing dashboard.
- Data Retention: Billing records are retained for 7 years to comply with applicable tax and financial regulations.
Data Retention
- Active Accounts: Your account data, automation rules, and connected account tokens are retained for as long as your account remains active.
- Deactivated Accounts: Upon deactivation, your account enters a 30-day grace period. All automation rules are paused and Instagram tokens are revoked immediately. If you do not reactivate within 30 days, your account and all associated data are permanently deleted.
- Backup Systems: Encrypted backups may retain data for up to 90 days after permanent deletion before being purged from backup systems.
- Billing Records: Invoice and payment records are retained for 7 years as required by applicable financial regulations.
- Security Logs: Security and audit logs are retained for 90 days to support incident investigation.
Your Rights & Control
ProfileFlow users have the following rights over their data, consistent with GDPR, CCPA, and India's DPDP Act:
Access
Request a full export of all data we hold about you.
Correction
Update or correct inaccurate information in your profile.
Export
Download your automation rules, store data, and account information.
Deletion
Request permanent deletion of your account and all associated data.
To exercise any of these rights, visit our Data Deletion page or email support@profileflow.bio. We will respond within 30 days.
Data Security
We apply industry-standard security measures to protect your data against unauthorized access, disclosure, and loss.
- Encryption at Rest: AES-256 encryption for all stored data including account information, automation rules, and Instagram access tokens.
- Encryption in Transit: TLS 1.3 for all data transmitted between your browser and our servers, and between our servers and third-party APIs.
- Token Protection: OAuth access and refresh tokens are stored in encrypted vaults and are never exposed in logs or error messages.
- Access Controls: Role-based access controls within workspaces ensure team members can only access data appropriate to their role.
For a detailed breakdown of our security practices, see our Security page.
International Data Transfers
ProfileFlow is operated from India. Your data may be processed by us or our third-party service providers (such as Razorpay, Meta, Google, and cloud infrastructure providers) in countries outside your own. Where such transfers occur:
- We ensure that any international transfer of personal data is subject to appropriate safeguards, such as standard contractual clauses or the recipient's participation in a recognized privacy framework.
- Third-party processors (Razorpay, Google, Meta) are contractually required to protect your data in accordance with applicable privacy laws.
- By using ProfileFlow, you acknowledge that your data may be transferred to and processed in countries outside your jurisdiction.
Contact Our Privacy Team
For privacy-related questions, data requests, or to exercise your rights, please reach out:
General & Support: support@profileflow.bio
Privacy Officer / Compliance: admin@profileflow.bio