FLOW GROUP L.L.C.
Privacy Policy
This Policy explains how Flow Group L.L.C. (“flow AI Agent”, “we”) processes information when you use app.flowkosova.com, connect a Facebook Page or professional Instagram account, or communicate with a business using flow AI Agent.
1. Controller and contact
Flow Group L.L.C., Bajram Kelmendi 68, 10000 Prishtina, Kosovo. Privacy contact: info@flowkosova.com. Contact person: Frashër Krasniqi.
2. Our roles
flow AI Agent is a controller for account administration, security, billing and operating the service. For customer conversations connected by a business, that business is normally the controller and flow AI Agent its processor. The business determines the purpose, assistant instructions and retention period.
3. Information we process
- Account information: name, email, username, language, role, verification and security records.
- Meta information: app-scoped user ID, Pages and professional accounts you select, their names/IDs, granted permissions and access tokens.
- Communications: messages, message identifiers, attachments, timestamps, delivery status and staff actions.
- Technical data: IP address (hashed where appropriate), device/browser, security, webhook and error logs.
- AI usage: technical model, token counts, request type and calculated cost. Review users see percentage only.
4. Purposes
We use data to create and protect accounts; connect only assets you select; receive and send messages for the Page; generate replies under configured instructions; enable human oversight and support; prevent abuse; audit operations; and meet legal duties. We do not sell personal data or use customer conversations to advertise flow AI Agent.
5. Legal bases
Depending on the context, we rely on contract performance and pre-contract steps, legitimate interests in secure service operation, consent where required, and legal obligations. Businesses must provide their own lawful basis and customer notices.
6. Meta Platforms
Connection uses Meta OAuth. flow AI Agent never receives your Facebook or Instagram password. Permissions are used only to list assets you may access, subscribe selected assets to webhooks and manage messages. You can remove the integration in Meta or request deletion from flow AI Agent. Meta’s own processing is governed by Meta policies.
7. AI and human decisions
A message, relevant instructions and limited context may be sent to the AI provider configured by the administrator. flow AI Agent supports customer-service replies; it is not used to make legal, credit, employment or similarly significant decisions without human intervention.
8. Recipients and transfers
Data may be disclosed to hosting, email, Telegram (only when enabled), Meta and AI providers only as needed. Where data crosses applicable jurisdictions, we use suitable contractual mechanisms and safeguards.
9. Retention and security
Tokens and keys are encrypted at rest. We use role-based access, CSRF protection, webhook signature verification, attempt limits, audit logs and HTTPS. Data is kept only as long as required for service delivery, the business-defined retention period, security and legal duties. Tokens are removed or disabled when a channel is disconnected.
10. Your rights
You may request access, correction, deletion, restriction, objection or portability as applicable. For a conversation with a business, contact that business first. For your flow AI Agent account use Data Deletion or email info@flowkosova.com. You may complain to the competent data-protection authority.
11. Children and changes
This business service is not directed to children. We may update this Policy; material changes will be notified in the service or by email and identified by a new version date.