Privacy Policy

LarkFlow, operated by Bytelark Private Limited ("we", "our", or "us"), is a WhatsApp Business CRM platform accessible at larkflow.io. This Privacy Policy explains how we collect, use, store, and protect information when you use our platform.

By using LarkFlow, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Account Information

When you register for LarkFlow, we collect:

• Full name and email address
• Company name and business details
• Password (stored in encrypted form)

1.2 WhatsApp Business Credentials

To enable WhatsApp messaging, we collect and store:

• WhatsApp Phone Number ID
• WhatsApp Business Account ID (WABA ID)
• Meta API Access Token (stored encrypted)
• Webhook verification tokens

These credentials are provided by you and belong to your Meta Business account. We use them solely to send and receive WhatsApp messages on your behalf.

1.3 Message and Contact Data

As part of operating the CRM, we process:

• WhatsApp messages sent and received through your connected number
• Contact names and phone numbers of people you communicate with
• Conversation history and message metadata
• Campaign data and message templates you create

1.4 Usage Data

We automatically collect certain technical information including:

• Log data (IP address, browser type, pages visited)
• Device and operating system information
• Feature usage and interaction data

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the LarkFlow platform
• Send and receive WhatsApp messages on your behalf using your Meta API credentials
• Process and store your contacts, conversations, and campaigns
• Authenticate your account and maintain security
• Send administrative emails (account updates, security alerts)
• Respond to your support requests
• Comply with legal obligations

We do not sell your personal data or your customers' data to third parties. We do not use your WhatsApp message content for advertising purposes.

3. WhatsApp and Meta Platform Data

LarkFlow integrates with the WhatsApp Business Platform via the Meta Cloud API. When you connect your WhatsApp Business number:

• Your API credentials are stored securely and used only to operate your account
• Incoming and outgoing messages are processed through Meta's infrastructure
• Message content is subject to WhatsApp's Privacy Policy
• You are responsible for obtaining appropriate consent from your contacts before messaging them

We comply with the Meta Platform Terms and WhatsApp Business Data Processing Terms.

4. Data Storage and Security

Your data is stored on Supabase infrastructure with the following protections:

• Data encrypted at rest and in transit (TLS/SSL)
• Row-level security ensuring each company only accesses its own data
• API credentials stored with restricted access controls
• Regular security audits and access logging

While we implement industry-standard security measures, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

Staff access to your conversations

We process your WhatsApp, Instagram, Messenger and email conversations, and your contacts, on your behalf to provide the service. LarkFlow staff do not read them as part of normal operations. Our internal tools show only technical details such as message status, direction, type and time, and contact details are masked.

A staff member may view the content of a specific message only when it is needed to answer your support request, investigate a security incident or abuse report, or comply with a legal obligation. Each time, they must record a reason, and the access (who, when, which message and why) is written to your workspace's audit log, which owners and admins can review under Settings → Audit log.

5. Data Sharing

We do not sell, trade, or share your personal information except:

• Service providers: Supabase (database), Vercel (hosting), Meta (WhatsApp API) — only as needed to operate the service
• Legal requirements: If required by law, court order, or governmental authority
• Business transfers: In connection with a merger, acquisition, or sale of assets

6. Data Retention

We retain your account data for as long as your account is active. Message and contact data is retained to provide the CRM service. You may request deletion of your data at any time by contacting us.

Upon account termination, your data will be deleted within 30 days, except where retention is required by law.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and associated data
• Export your data in a portable format
• Withdraw consent for data processing where consent is the legal basis

To exercise these rights, contact us at hello@bytelark.net.

8. Cookies

LarkFlow uses essential cookies and local storage for authentication and session management. We do not use advertising or tracking cookies. You can disable cookies in your browser settings, but this may affect your ability to log in.

9. Children's Privacy

LarkFlow is a business platform not intended for children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on the platform. Continued use of LarkFlow after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us: