Privacy Policy

Base Flows LLC · Last updated: 24 October 2026

Base Flows LLC ("Base Flows", "we", "us") builds client portals and business systems for companies ("Clients"). This policy explains how we handle personal data on our websites and when we provide WhatsApp messaging services to our Clients through Meta's WhatsApp Business Platform.

1. Our role

When we connect a Client's WhatsApp Business number to the WhatsApp Business Platform and send or receive messages on its behalf, the Client is the data controller and Base Flows acts as a data processor, following the Client's instructions and our agreement with them. For our own website and business contacts, Base Flows is the controller.

2. Data we process

• Client account data: business name, Meta business portfolio ID, WhatsApp Business Account ID, phone number ID and the access token Meta issues when the Client connects its number.
• Messaging data: phone numbers, profile names, message content and metadata (timestamps, delivery and read status) of messages exchanged between the Client and its contacts, and, where the Client uses coexistence and chooses to share it, its WhatsApp Business app contacts and recent chat history.
• Website and contact data: name, email and the information you send us, plus basic technical logs.

3. How we use it

Only to provide the services our Clients ask for: delivering and receiving WhatsApp messages, showing message history and notifications inside the Client's own systems, managing message templates, troubleshooting and keeping the service secure. We do not sell personal data, use it for advertising, or use it to train AI models.

4. Who we share it with

• Meta Platforms, which operates the WhatsApp Business Platform.
• Infrastructure providers that host our services (such as Vercel and Supabase), under data processing terms.
• The Client's own systems (for example its Softr portal or automations) to which the Client asks us to forward events.

We may also disclose data where the law requires it.

5. International transfers

We are based in the United States and our providers may process data outside your country. Where required, transfers are covered by appropriate safeguards such as Standard Contractual Clauses or the UK International Data Transfer Addendum.

6. Retention

We keep messaging data only as long as needed to provide the service to the Client, or as the Client instructs. When a Client disconnects its number or ends its agreement with us, we delete its access tokens and messaging data within 30 days, unless the law requires us to keep it longer.

7. Security

Data is encrypted in transit, access tokens are stored only on our servers and never exposed in web pages, webhook requests are verified with Meta's signature, and access is limited to the people who need it.

8. Your rights and data deletion

If you exchanged messages with one of our Clients, please contact that business first, as it controls your data; we will help them respond. You can also email us at eric@base-flows.com to access, correct or delete personal data we hold. Clients can ask us at any time to disconnect their number and delete their data. Depending on where you live (for example under the UK GDPR, the EU GDPR or US state laws), you may also have the right to object, restrict processing or complain to your data protection authority.

9. Changes

We will update this page if our practices change and revise the date above.

10. Contact

Base Flows LLC · eric@base-flows.com · base-flows.com