Privacy policy
Last updated October 21, 2026 · Limited creator access
FollowersFlow is based in Lebanon. This notice explains how we handle information for creator accounts, workspace access and our Instagram integration. Access is currently limited. Contact hello@followersflow.com for privacy questions or requests.
Information we process
- Creator and staff account information, including email addresses, authentication records, access applications, workspace membership, invitations and roles.
- Connected Instagram professional account identifiers, usernames, granted permissions and encrypted access credentials.
- Supported Instagram messages and comments, participant identifiers, usernames when provided, media identifiers, timestamps and delivery records.
- CRM contact details, notes, tags and any consent information entered by authorized workspace users.
- Account and invitation email delivery information, including sent, delivered, delayed, failed, bounced, complained and suppressed events when provided.
- Technical and security information needed to operate the service, such as request metadata, errors and access records.
We receive information from workspace users and from Instagram when an authorized professional account is connected. An Instagram interaction does not automatically provide an email address, phone number or marketing consent.
How we use information
We use this information to authenticate users, review creator access, manage workspace invitations, send account verification and recovery emails, maintain authorized account connections, organize contacts, display conversations and interactions, support permitted replies when enabled, handle support and privacy requests, and prevent misuse or duplicate processing. Creator email campaigns, WhatsApp, payments and hosted course delivery are not enabled in this limited release. Account emails do not subscribe recipients to marketing.
Creators determine how they use their customer information in their workspace. FollowersFlow operates the platform and processes workspace information to provide the service. Contact the creator as well if your request concerns their separate use of your information.
Who receives information
Authorized workspace members can access their workspace data. Limited operator access is used for access review, maintenance, security and support. We use Meta for Instagram integration, Supabase for authentication and database storage, Cloudflare for hosting and delivery, Resend for account and invitation email delivery, including Supabase authentication emails, and Zoho Mail for support and privacy correspondence. We do not sell personal information or use Instagram data for unrelated advertising. We may disclose information where required by applicable law or necessary to protect the service and its users.
International processing
The current database is hosted in Mumbai, India. Cloudflare operates a global network, and Meta, Resend and Zoho Mail process information through their service infrastructure. Your information may be processed outside Lebanon or your country of residence.
Retention and deletion
We retain CRM information while the workspace uses it to provide the service. You can request deletion at any time. We process verified deletion requests within 30 days and remove the relevant data from active systems, subject to any applicable legal retention requirement that we explain to you.
We retain only limited request and security records where necessary, including protected identifiers used to prevent deleted Instagram data from being recreated by later events. Backup copies are not used operationally. If a backup is restored, recorded deletions must be reapplied before the restored service becomes accessible. Removing data here does not remove messages or comments held by Instagram or another person's account.
Your choices and requests
Contact our privacy email to request access, correction or deletion, or raise an objection about processing. Depending on your location, you may have additional rights under applicable law, including contacting a privacy authority. We verify identity and authority before disclosing or deleting information. See our data deletion instructions.
Workspace owners can disconnect Instagram in Connections. Disconnecting removes locally stored access credentials and stops that connection, but does not erase existing CRM history. You can also manage the app's authorization in Instagram's Apps and Websites settings.
Security and cookies
We use HTTPS, workspace access controls, encrypted Instagram token storage, webhook signature verification and Cloudflare Turnstile security checks on enabled account forms. No service can guarantee absolute security. Essential authentication cookies maintain sign-in sessions; this limited release does not use advertising cookies or third-party marketing analytics.
Changes to this notice
We will update this page when our practices change and revise its effective date. Material changes will be communicated through the service where appropriate.