Privacy Policy

IvaFlow is a WhatsApp marketing, CRM and automation platform developed and operated by Designiva. For all privacy matters, the data controller is Designiva, reachable at ivaflow@designiva.in and +91 78428 74377. We are an Indian business and this Service is operated from India.

Account information. When you sign up we collect your name, email address, company name (optional) and phone number (optional). We also create a unique user ID for your account.

Contacts you upload. Your contacts' names, phone numbers, emails, tags, group memberships, CRM stage, notes and lead sources — you upload or enter this data yourself. It belongs to you; we process it only to provide the Service to you.

WhatsApp connection data. When you connect a WhatsApp Business number through our embedded Meta signup, we store the access token, token expiry, phone number ID and related identifiers needed to send and receive messages on your behalf.

Messages and campaign activity. Message templates you create, campaign content, delivery status, read receipts and reply data, plus inbound messages processed for your auto-replies and AI chatbot (including recent conversation history used to generate relevant AI responses).

Payment information. Payments are processed by our PCI-DSS compliant secured payment gateway partner. We never receive or store your full card or UPI credentials. We store the payment reference IDs, plan, amount, currency and billing status needed to maintain your subscription and invoices.

Security data. If you enable two-factor authentication, we store your TOTP enrolment with our authentication provider. We keep basic audit logs (such as administrative actions) to keep accounts secure.

Technical data. Authentication session cookies and rate-limiting information. We do not run third-party advertising trackers on this Service.

We use your information to: operate the Service (sending your campaigns, running your CRM, powering auto-replies and the AI chatbot); authenticate you and keep your account secure; process subscriptions and produce invoices; provide customer support; send service and transactional communications such as OTP codes, token-expiry warnings, and (if you have not opted out) weekly report emails; detect abuse and enforce our Terms; and comply with legal obligations.

You control non-essential email from Notification Preferences in your dashboard — toggles there take effect immediately.

The AI chatbot and AI message generation are powered by our integrated AI engine. When the chatbot answers an incoming message on your connected number, we send that message, your chatbot instructions (persona, tone, FAQs) and recent messages from that conversation to generate a reply. We do not use your contact lists or CRM data to train models, and we do not send your full database to any AI provider — only what is needed to answer the specific conversation.

To run the Service we share limited data with these processors, under contract:

• Meta (WhatsApp Business Cloud API) — to send and receive WhatsApp messages through your connected number, under Meta's own terms and privacy policy.
• Our payment gateway partner — PCI-DSS compliant payment processing and subscription billing (we never see your card details).
• Our internal infrastructure providers — carefully vetted cloud services that power application hosting, encrypted database storage, secure authentication, transactional email delivery and AI processing. They process data only on our instructions, under strict confidentiality and security agreements. For the security of the Service, we keep our internal vendor architecture confidential.

We do not sell your personal data, and we do not share it with advertisers.

You keep your data while your account is active. When you delete your account from Settings → Danger Zone, we require a confirmation phrase plus a one-time code sent to your registered email, and then permanently delete your personal data, contacts, campaigns, CRM records, WhatsApp configuration and authentication record. Some minimal records (e.g. payment references needed for accounting compliance, audit logs) may be retained where legally required.

If your subscription lapses, your data is retained for a reasonable grace period so you can resume service, after which inactive dormant accounts may be cleaned up — we will attempt to notify you first at your registered email.

We protect your data with: encrypted connections (HTTPS/TLS) everywhere; encrypted cloud databases with row-level security so users can only access their own records; role-based access control for teams; optional two-factor authentication (TOTP); signature verification on all payment and WhatsApp webhooks; rate limiting; and least-privilege access on our servers. No online service can promise absolute security, but we design and review the platform continuously to keep your data safe, and we will notify you promptly if a breach affecting you ever occurs.

You can access and update your profile information at any time in Settings; export or delete contacts from the CRM; opt out of non-essential emails in Notification Preferences; enable or disable 2FA in Settings → Security; and delete your entire account and data as described above. For anything else — including questions about what data we hold about you — email us at ivaflow@designiva.in and we will respond.

IvaFlow is a business tool and is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a minor has created an account, contact us and we will remove it.

We may update this policy as the product evolves. Material changes will be announced on the platform or by email before they take effect, and the "Last updated" date at the top will always tell you how current this document is.

Privacy questions, data requests or complaints: email ivaflow@designiva.in, call +91 78428 74377, or message us on WhatsApp — details on our Contact page.