OrderFlow Privacy Policy

1. Data we collect

1.1 From end customers (via WhatsApp)

When an end customer sends a message to a merchant's WhatsApp number connected to OrderFlow, we receive and store:

• WhatsApp phone number (in E.164 format)
• First name and last name, if provided during the ordering flow
• Delivery address, if provided during the ordering flow
• Message content (text, interactive button/list responses)
• Message timestamps and WhatsApp message identifiers
• Media files sent in-chat, if any (images, documents)
• A rolling AI-generated summary of the conversation, used to maintain context across messages
• Order details created from the conversation (products, quantities, prices, payment status, shipping details)

We do not collect WhatsApp profile pictures, status updates, location data (unless explicitly shared in a message), or contact lists.

1.2 From merchants

When a merchant onboards to OrderFlow, we collect:

• Business name, address, contact email, phone number
• WhatsApp Business Account ID, phone number ID, and API access tokens provided via Meta's Embedded Signup flow
• Store configuration (product catalog, pricing, courier settings)
• User account credentials for OrderFlow staff (hashed passwords)
• Activity logs of actions performed inside OrderFlow

1.3 Automatically collected

• IP address and basic device/browser information when accessing the OrderFlow web application
• Server logs for security and debugging purposes

2. How we use the data

• Deliver the service: route WhatsApp messages, generate AI replies, create and track orders, dispatch courier bookings
• Generate AI responses: message content and the rolling conversation summary are sent to Google Gemini to produce the reply that is posted back to the end customer
• Product retrieval: product catalog data (not customer messages) is embedded and stored in a Qdrant vector database to let the AI recommend relevant products
• Service improvement and debugging: aggregated, de-identified usage patterns
• Fraud prevention and security: detecting abuse, rate limits, suspicious logins
• Legal compliance: responding to lawful requests and enforcing our terms

We do not sell personal data, and we do not use WhatsApp message content to train third-party AI models.

3. AI processing disclosure

OrderFlow uses Google Gemini to generate automated replies on behalf of merchants. When an end customer sends a message, the message text, the rolling conversation summary, and the merchant's configured system prompt are transmitted to Google's Gemini API. Google processes this data under its own terms: https://ai.google.dev/terms

Replies generated by the AI are then sent back to the end customer via the WhatsApp Business Platform. Merchants can review, override, or disable AI replies at any time.

4. Third parties we share data with

We require each third-party processor to maintain appropriate security and confidentiality safeguards.

5. Data retention

• Conversation messages and summaries: retained for 24 months from the last message in the conversation, then deleted
• Order records: retained for 7 years from order date, as required for tax and accounting purposes
• Customer records (name, phone, address): retained for as long as the merchant account is active, and deleted within 90 days of merchant account closure or on documented end-customer request
• Server logs: 90 days
• Backups: up to 30 days beyond the primary deletion date

Merchants can request earlier deletion of specific customer records via the OrderFlow admin interface or by emailing us.

6. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to or restrict certain processing
• Withdraw consent (where processing is based on consent)
• Lodge a complaint with your local data protection authority

End customers should contact the merchant directly in the first instance, since the merchant controls the chat. If the merchant does not respond within 30 days, contact us at the address below and we will act on the merchant's behalf.

Merchants can exercise these rights by emailing us at the contact below.

7. Security

• Data in transit is encrypted using TLS 1.2 or higher
• Database connections are authenticated and firewalled
• WhatsApp access tokens and other secrets are encrypted at rest using AES-256
• Staff access to production systems is limited and logged
• We review our security practices regularly

No system is perfectly secure. If you discover a vulnerability, please email security@hexdive.com.

8. International data transfers

OrderFlow is operated from Sri Lanka. Data may be transferred to and processed in other countries where our service providers operate (including the United States, where Meta and Google process data). These transfers are governed by the providers' standard contractual clauses and equivalent safeguards.

9. Children

OrderFlow is not intended for use by individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data through a merchant's WhatsApp number, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified to merchants via email or in-app notice at least 14 days before taking effect. The "Last updated" date at the top reflects the most recent change.

11. Contact

Hexdive (Pvt) Ltd

• Email: privacy@hexdive.com
• Website: https://hexdive.com

For WhatsApp/Meta-specific data concerns, you can also contact Meta directly: https://www.facebook.com/privacy/policy/