Privacy Policy

1. Who We Are

NotifyFlow ("we", "our", "us") is a notification automation service operated at notifyflow.in. We help businesses receive instant notifications when their forms are submitted.

For any privacy concerns, contact us at: info@notifyflow.in

2. What Data We Collect

Account Information:

• Name, email address, and password (hashed — never stored in plain text)
• WhatsApp number (optional, for sending notifications)
• Telegram Chat ID (optional)
• Slack Webhook URL (optional)

Form Submission Data:

• When someone submits a form connected to NotifyFlow, we temporarily process the form data to trigger your notification
• Form submission data is used only to format and send the notification — it is not stored permanently beyond what appears in notification logs
• Notification logs (what was sent, when, status) are retained for 90 days

Google Account Data (if connected):

• OAuth access tokens to read your Google Sheets (read-only access)
• We only access sheets you explicitly authorize
• We never write to, modify, or delete your Google data

Usage Data:

• Number of notifications sent, flow activity, delivery status
• Standard server logs (IP address, browser type) for security purposes

3. How We Use Your Data

• To send you notifications when your forms receive submissions
• To operate your account and manage your flows
• To process payments (via Razorpay — we don't store card details)
• To send transactional emails (welcome, plan confirmation)
• To improve our service and fix bugs

We never sell your data to third parties. We never use your data for advertising.

4. Data Sharing

We share data only with essential service providers:

• Twilio / Meta WhatsApp API — to deliver WhatsApp notifications
• Brevo (Sendinblue) — to deliver email notifications
• Telegram Bot API — to deliver Telegram notifications
• Razorpay — to process payments securely
• Google APIs — to read authorized Google Sheets
• Hostinger — our hosting provider

All third-party providers are contractually required to protect your data.

5. Form Respondents' Data

• Their data is processed only to trigger your notification
• It is not stored beyond 24 hours after the notification is sent
• It is never shared with any third party except the notification channel
• As a NotifyFlow user, you are responsible for having appropriate consent from your form respondents

6. Google OAuth & Data

• We request read-only access to Google Sheets and Google Drive file list
• We store OAuth tokens securely in our database
• You can revoke access at any time from your Google Account settings at myaccount.google.com/permissions
• Revoking access will disable Google Forms notifications but will not delete your NotifyFlow account

Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

7. Data Security

• All data is transmitted over HTTPS (SSL encrypted)
• Passwords are hashed using bcrypt — never stored in plain text
• OAuth tokens are stored securely in our database
• We conduct regular security reviews
• In case of a data breach, we will notify affected users within 72 hours

8. Data Retention

• Account data: Retained as long as your account is active
• Notification logs: 90 days
• Form submission data: 24 hours maximum
• Payment records: 7 years (legal requirement)
• Google OAuth tokens: Until you disconnect or revoke access

9. Your Rights

• Access — Request a copy of your personal data
• Correction — Update incorrect data in your account settings
• Deletion — Request deletion of your account and all associated data
• Portability — Export your notification history
• Opt-out — Unsubscribe from marketing emails at any time

To exercise any of these rights, email us at info@notifyflow.in. We will respond within 30 days.

10. Cookies

• Session cookie — to keep you logged in (expires when browser closes)
• No tracking cookies, no advertising cookies, no third-party analytics

11. Children's Privacy

NotifyFlow is not intended for children under 13. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us and we will delete it immediately.

12. Changes to This Policy

We may update this policy occasionally. We will notify registered users by email for significant changes. The "Last updated" date at the top will always reflect the latest version.

13. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes shall be subject to the jurisdiction of courts in India.