Subprocessors

Effective: 2026-10-20 · Version: 2.1

Operator: Flow, Dhaka, Bangladesh. Questions about this policy? Contact us.

Flow AI uses the following third-party service providers (“subprocessors”) to run the service. Each one only receives the data needed for its purpose, under written terms that require it to protect that data. See our Privacy Policy for details.

Core subprocessors

• Meta Platforms, Inc. and Meta Platforms Ireland Ltd. (WhatsApp Business Platform, Graph API and Instagram APIs): sends and receives WhatsApp, Facebook Messenger and Instagram messages, comments, templates, and media; receives ad referral data; and receives conversion events through the Conversions API. Location: United States and EU.
• WhatsApp Personal gateway (operated by Flow AI): links a personal WhatsApp number by QR code as a WhatsApp Web linked device. It is not a third-party subprocessor; the linked number connects through our own gateway.
• OpenAI, L.L.C.: provides the GPT large language models (the models behind ChatGPT) for AI assistant replies, knowledge-base search, voice-note transcription, image and document understanding, and the AI flow builder. Data sent through the OpenAI API is not used to train OpenAI’s models. Used only when a workspace turns on AI features. Location: United States.
• Cloud infrastructure provider: hosts our application servers, databases, file storage, and backups.
• Email delivery provider: sends account, security, and notification emails.

Optional subprocessors

These are used only when a workspace connects or chooses them:

• Google LLC (Google Sheets, Google Calendar, Google Drive): reads and writes the spreadsheets and calendars a workspace connects. Location: United States.
• Your own AI provider (OpenAI or Google Gemini): only when a workspace connects its own API key. Flow’s AI features can run on Flow’s own AI provider (OpenAI, acting as our subprocessor), or you can connect your own OpenAI or Gemini API key. When you use your own key, your data is processed by that provider under your own agreement with them.
• SMTP email provider: sends email through a mail server a workspace connects.
• Payment processors (such as Stripe or PayPal): take payments on their own hosted checkout pages. We never receive full card numbers.

Workspaces can also connect their own tools, such as webhooks, HTTP APIs, Shopify, WooCommerce, or their own account with another AI provider. Those services work under the workspace’s own agreements with them and are not our subprocessors.

Changes

We update this page before a new subprocessor starts processing customer data. To be notified of changes, or for questions, email hello@clickcast.net.