Privacy Policy

Who we are

SellFlow is software that helps businesses answer customers on WhatsApp, take orders, collect payments and follow up with interested buyers. It works with the official WhatsApp Business Platform from Meta — we do not use WhatsApp Web or unofficial WhatsApp tools.

Contact: support@sellflowng.com

Our two roles

• For businesses that use SellFlow (“merchants”) and their team members, we are the controller of account, billing and usage data.
• For the customers of those businesses — people who message a business on WhatsApp — we act as a processor on the business’s behalf. The business decides why their customers’ data is processed and is responsible for it. If you are a customer, please contact the business first; we will help them respond to you.

Data we collect

From merchants and their team

• Account details: name, email address, password (stored only as a secure hash by our authentication provider) and sign-in records.
• Business details: business name, description, industry, phone, address, website, social links, time zone and currency.
• Catalogue: products, prices, stock and images you upload.
• WhatsApp connection: your WhatsApp Business account and phone number IDs and an access token issued by Meta (encrypted).
• Payout details: the bank, the last four digits of the account number, and the account name returned by Paystack’s account lookup. We do not store full account numbers.
• Subscription billing: plan, invoices, and card brand, last four digits and expiry. Card numbers are handled by Paystack; we only keep an encrypted Paystack authorisation code used to charge renewals.
• Settings, AI instructions and policies you write, and records of actions taken in your account (audit logs).

From customers who message a business

• WhatsApp phone number, WhatsApp profile name, and the messages exchanged with the business (text and media sent through WhatsApp).
• Details shared to place an order, such as name, delivery address and email address.
• Orders, order status and payment status. Payments are made on Paystack’s checkout; we receive the payment result but never card or bank login details.
• Whether the customer has opted out of automated messages (by replying STOP).

Automatically

• Technical logs (IP address, browser, request times and errors) needed to run, secure and troubleshoot the service.
• Essential cookies that keep you signed in (see Cookies).

How we use it

• To provide SellFlow: receive and send WhatsApp messages for a business, answer customers, create orders, generate payment links and confirm payments.
• To send automated follow-ups that a business has turned on — never to customers who replied STOP.
• To show businesses their conversations, customers, orders and analytics.
• To bill merchants for their SellFlow subscription and enforce plan limits.
• To keep the service secure, prevent fraud and abuse, and meet legal obligations.
• To contact merchants about their account, billing and important changes.

Our legal bases are performance of our contract with merchants, our and the merchant’s legitimate interests in running and securing the service, compliance with legal obligations, and consent where required (for example, a business’s marketing messages). We do not sell personal data, and we do not use customers’ messages to advertise to them.

AI processing

When a business turns on SellFlow’s AI assistant, recent messages in the conversation, a short summary of the conversation, and the business’s own catalogue and policies are sent to an AI model provider to generate a reply. The AI can only look up information through SellFlow (such as product prices, stock and order status) for that business. Businesses can pause the AI or take over any conversation at any time.

We use AI providers through their business APIs. We send only what is needed for the reply and we do not authorise providers to use this data to train their models where their terms allow us to opt out.

Service providers we share data with

We share personal data only with providers that help us run SellFlow, under contracts that limit how they may use it:

• Meta Platforms (WhatsApp Business Platform) — to send and receive WhatsApp messages.
• Paystack — payment checkout, payouts to merchants’ bank accounts, refunds and SellFlow subscription payments.
• Supabase — database, authentication and file storage.
• Vercel — application hosting and, where used, routing requests to AI models.
• AI model providers (such as DeepSeek, and models made available through Vercel’s AI Gateway) — to generate assistant replies.
• Inngest — running background tasks such as processing incoming messages and follow-ups.

We may also disclose data if required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition (with notice to merchants). A business can see its own customers’ data in its SellFlow account; businesses never see each other’s data.

International transfers

Some of our providers store or process data outside Nigeria. Where we transfer personal data internationally, we rely on safeguards permitted by the Nigeria Data Protection Act, such as contractual protections and providers’ security commitments.

Security

• Each business’s data is separated at the database level, so one business cannot access another’s data.
• WhatsApp access tokens and payment authorisations are encrypted (AES-256-GCM) and never sent to browsers.
• Messages from WhatsApp and Paystack are accepted only with valid signatures, and payments are confirmed directly with Paystack before an order is marked paid.
• Access is limited by role and permission, and important actions are recorded in audit logs.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authority as the law requires.

Retention

We keep merchant and customer data for as long as the merchant’s account is active, so the business can see its history. When a merchant closes their account or asks us to delete data, we delete it within 30 days, except records we must keep for legal, tax, accounting, fraud-prevention or dispute purposes (such as invoices and payment records), which we keep only as long as required. See Data deletion.

Your rights

Subject to the law, you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict processing, and withdraw consent. To stop automated messages from a business, reply STOP in the WhatsApp chat (reply START to resume).

Customers of a business should contact that business first; you can also email support@sellflowng.com and we will help the business respond. We answer requests within 30 days and may need to verify your identity. You can also complain to the Nigeria Data Protection Commission.

Cookies

The SellFlow dashboard uses only essential cookies: to keep you signed in securely and to remember which business you are working in. We do not use advertising or third-party tracking cookies. Payment pages are provided by Paystack under its own policies.

Children

SellFlow is a business tool and is not directed at children under 18. Merchants must not use SellFlow to knowingly market to children where the law forbids it.

Changes to this policy

We may update this policy. We will post the new version here with a new date and, for significant changes, notify merchants by email or in the dashboard.

Contact

Questions or requests: support@sellflowng.com