Privacy Policy

1. Who we are

FlowFunnel is the brand under which RiverWorks IT LLC publishes its products. RiverWorks IT LLC operates them and is responsible for the data this policy describes.

RiverWorks IT LLC · 21750 Hardy Oak Blvd, Ste 104 #208505, San Antonio, TX 78258-4946, USA · apps@flowfunnel.io

Section 2 applies to every product. What each product collects is in its own section.

2. What applies to all our products

• We do not sell your data, we do not use it for advertising and we do not share it with anyone for their marketing.
• Where it lives. Our servers are at DigitalOcean, in New York, United States. If you use our products from another country, your data is processed in the United States.
• Payments. Stripe processes the payment and your card; we never see the card number. We keep the billing email you give Stripe, your Stripe customer ID, the status of your plan and the notifications Stripe sends us about your payments.
• Email. Our mailboxes are at Google Workspace. If you write to us, your message is stored there.
• Server logs. Our servers record each request they receive: IP address, date and time, the address requested and the browser or app that made it. We use them to keep the service running and to detect abuse.
• Backups. The database behind DeskFlow and our payments is copied every night. The copies stay on the server for 7 days, and one copy is also kept outside it, at DigitalOcean Spaces in the United States, with no expiry date today. StartToFlow's database is backed up by DigitalOcean, which runs it. Backups are only used to recover from a failure.

3. This website

flowfunnel.io has one form: the one to book a DeskFlow demo, described below. Our server logs each visit as described in section 2.

Google Analytics, only if you accept it. The first time you open the site we ask. If you accept, Google Analytics sets cookies in your browser and records which pages you visit, how you arrived, your type of device and browser, and your approximate location (city and country, worked out from your IP address). That data goes to Google LLC, in the United States. We use it only to see how the site is used, we keep it for 14 months, it is not linked to any advertising and Google Signals is off. If you decline, nothing from Google Analytics is loaded and no cookie is set. You can change your choice at any time with the link below this section.

LinkedIn Insight Tag, also only if you accept. It measures our ads on LinkedIn: whether your visit came from an ad and whether you then pressed a WhatsApp button. If you accept, it sets cookies in your browser and sends that to LinkedIn, which may link it to your LinkedIn account under its own policy. It depends on the same choice as Google Analytics.

Where you came from, in your WhatsApp message. The DeskFlow WhatsApp buttons, and those of the site assistant, add a short code to the end of the message, such as “(ref: linkedin-deskflow)” or “(ref: web)”, so we know which link or page brought you. You can see it and delete it before sending. It is kept in your browser only until you close the tab, and it does not identify you.

How many people press a WhatsApp button, without knowing who. When you press one, the site adds one to a counter on our server: the day, the product, the page, the link code you arrived with (such as “linkedin-deskflow”) and whether you were on a phone or a computer. On a computer we also show a QR code next to the button: scanning it goes through our server, which counts it and opens WhatsApp with the same message. Nothing else: no cookie, and your IP address is used for a moment to stop abuse and is not stored. Because it cannot identify you, it does not depend on your cookie choice.

Booking a DeskFlow demo. If you book one, we keep your name, your WhatsApp number, your email, the time you chose, and the page and link code you came from, in our database. Jorge receives it by email to confirm it, and writes to you on WhatsApp or by email with the Google Meet link; the call happens on Google Meet, under Google's policy. We keep it until you ask us to delete it.

The site assistant. The chat bubble on every page answers questions about our products automatically. What you write in it goes through our server to StartToFlow’s system, which sends it to Anthropic, in the United States, so that one of its models writes the reply; Anthropic handles it under its own policy. We keep the conversation for 30 days to see what people ask and improve the answers: your messages, the replies, the page, the language and the link code you came from, grouped under a random number your browser creates for that tab, which does not identify you. After 30 days it is deleted automatically. Your IP address is used to stop abuse and is not stored. Please do not write sensitive data in it. If you want a conversation deleted sooner, write to apps@flowfunnel.io with its approximate date and time.

The fonts are loaded from Google Fonts, so Google receives your IP address when you open the site. The WhatsApp buttons open WhatsApp: from then on, what you send is also handled by WhatsApp (Meta) under its own policy.

4. StartToFlow

StartToFlow is an assistant you talk to on WhatsApp. To work, it stores:

• Your WhatsApp number, your profile name, your time zone and your language.
• The messages you send it, including voice notes and their transcription, and each message as WhatsApp delivers it to us.
• What you ask it to keep: reminders, lists and memories.
• Your plan and your payments, as described in section 2.

Who else handles it:

• Meta (WhatsApp Business Platform), to receive and send the messages.
• Anthropic, whose models read your messages to understand them and write the reply.
• OpenAI, to transcribe voice notes and to build the search index of your memories.
• Langfuse, where we record each conversation turn to find and fix errors.
• DigitalOcean, where its server and its database run.

Please don't send it passwords, card numbers or health information. Write STOP at any time and it stops messaging you.

5. ProFlow

ProFlow is in pilot, and no ProFlow software handles anyone's data yet. If you write to us about it on WhatsApp, that conversation reaches StartToFlow's number and section 4 applies. This section will describe ProFlow before it handles anyone's data.

6. DeskFlow

DeskFlow is a desktop app that connects to your WhatsApp as a linked device, the same way WhatsApp Web does.

What stays on your computer: your conversations, contacts, notes, labels and files, your WhatsApp session and the app's local backups. We do not receive them.

What the app sends us when it starts and every 6 hours while it is open:

• Your WhatsApp number and its WhatsApp identifier.
• The app version, the operating system, the language and the date you installed it.
• Five counters: how many chats, contacts, notes and labels you have, and on how many days you have used it. Only the numbers, never their content.
• About the computer: the name your operating system gives it (for example «DESKTOP-ABC123», which may include your name), the operating system version, and an identifier calculated on the computer itself, from which the original cannot be recovered.
• An installation token we give the app, so we know it is the same installation.

We use it to count your trial days, offer you updates, turn features on or off for your installation and know on how many computers your account is open.

Payments. If you pay for DeskFlow, Stripe also receives your WhatsApp number with the payment, to link it to your account.

Updates are downloaded from flowfunnel.io, and those downloads appear in our server logs. To stay compatible with WhatsApp Web, the app also checks public files on GitHub and npm; those requests do not include your number or anything from your account.

Support. The support button opens a WhatsApp chat, sent from your own account to our support number. The app attaches a diagnostic report only if you confirm it, with phone numbers masked and without the text of your messages.

Not WhatsApp. DeskFlow is not a WhatsApp or Meta product and connects through an unofficial library; the risk that implies is in section 5 of our Terms of Use.

Screenshots. If you decide to send screenshots to support, we receive them in that WhatsApp chat.

Deleting your DeskFlow data. Ask us at apps@flowfunnel.io and we delete what our portal holds about your number within 30 days. What is on your computer you delete yourself: uninstall the app and remove its data folder (%APPDATA%\flowfunnel on Windows).

6.1 The DeskFlow support assistant

When the support button opens our assistant, you are writing to an automatic system, and Jorge stays one click away (“Talk to a person”).

What is sent:

• The messages you write to the assistant.
• Your WhatsApp number and the state of your plan, which our server adds after checking that the request comes from your installation.
• Technical data from the app: its version, your operating system, the state of its connection to WhatsApp, the screen you are on and the last error lines of its log, without the content of your messages.

Only if you allow it, each time: the app’s diagnostic report (its technical log, without the text of your messages, with phone numbers masked and without passwords) and a screenshot, which may show whatever you have open at that moment.

What for: to give you technical and account support.

Who handles it: it goes through our server to StartToFlow’s system, which sends your messages, the technical data and an extract of the diagnostic report to Anthropic, in the United States, so that one of its models writes the reply; Anthropic handles it under its own policy. The screenshot is not sent to the model: only our support team sees it.

How long: the conversation, the diagnostic report and the screenshot are kept for 30 days and then deleted automatically.

What does not happen: your conversations with your clients do not leave your computer; DeskFlow does not send them to the assistant.

If you talk to a person, that is a normal WhatsApp chat with our number, sent from your own account and also visible on your phone.

6.2 “Earn a free month”: recommending DeskFlow

If you use it, the app sends a promotional message to your contacts, one by one and from your own WhatsApp, with your personal link (flowfunnel.io/?ref= followed by a code).

What we keep: your code, linked to your number. When you reach 10 contacts, the app also sends us, for each of them, a code calculated from their number (a SHA-256 hash, not the number itself) and the date it was sent. A hash like that can be matched against a list of numbers by trying them one by one; we only use it to check that they are 10 different contacts and that none of them is you.

What for: to give you the free month, once per number, and to know which visits to the site came from your link.

Someone who opens your link brings your code to flowfunnel.io, and section 3 applies to that visit, as with any other link code.

We keep it as section 7 says, and you can ask us to delete it.

7. How long we keep it

We keep your data while you use the product, and after that until you ask us to delete it. Application logs are rotated and overwritten as they grow. Conversations with the site assistant are deleted automatically after 30 days (section 3). Backups follow what section 2 says.

8. What you can ask of us

Write to apps@flowfunnel.io to ask for a copy of your data, to correct it or to delete it. Tell us which product it is about and which WhatsApp number or email; we may ask you to confirm from that number or email that it is yours. A person handles each request, and we write back when it is done.

Deleting your data does not remove it from backups already made: those copies stay as section 2 describes and are only used to recover from a failure. If we ever restore one, we delete your data again.

If you are not satisfied with our answer, you can complain to the data protection authority where you live.

9. Changes to this policy

When this policy changes, we update the date at the top. If a change affects what we collect or who handles it, this page will say so before the change applies.