Privacy Policy

FlowSMM AI

Version 1.0 Effective Date 12 September 2026

This Privacy Policy explains what personal data the FlowSMM AI service collects and processes, the purposes for which such data is used, the parties to whom it may be disclosed, the measures used to protect it, and the rights available to users. This Policy applies to the website https://www.flowsmm.ai/, the FlowSMM AI application, and their related features, including the connection of Facebook and Instagram accounts through Meta tools.

FlowSMM AI enables users to create, schedule, manage, and publish content on connected social networks. The Service performs actions on social networks only after the user has connected the relevant account and only within the scope of the permissions granted by the user.

1 Personal Data Controller

The personal data controller is Individual Entrepreneur TURAEV BOBOJON ABDURAKHMONOVICH, registered in accordance with the laws of the Republic of Tajikistan, Taxpayer Identification Number 045691384, State Registration Certificate No. 0130230513 dated 1 July 2025, with an address at: Premises 1, 7/2 Moyonsho Nazarshoev Street, Shohmansur District, Dushanbe, Republic of Tajikistan (hereinafter referred to as "FlowSMM AI", "we", "us", or "our").

For privacy-related enquiries and requests to exercise user rights, please contact privacy@flowsmm.ai. General contact details: +992 110 725 555, info@flowsmm.ai.

2 Scope

This Policy applies to website visitors, registered users, client representatives, and persons who contact our support service. It does not govern the independent processing of data by Meta Platforms, Inc., Facebook, Instagram, or other third-party services. Their respective terms and policies apply to data processing carried out on their platforms.

3 Personal Data We Process

Category	Data Included
Account data	First name, last name, email address, telephone number if provided, company name, user identifier, language, and account settings.
Meta data	Profile identifier and publicly available profile information; email address, where provided by Meta and authorised by the user; identifiers and names of connected Facebook Pages and professional Instagram accounts; account categories; and the list of assets available to the user.
Permissions and tokens	Granted permissions, technical access tokens, and information about their validity periods. We do not receive or store the user's Facebook or Instagram password.
Content	Text, images, videos, captions, hashtags, drafts, publication schedules, AI prompts, and generated outputs.
Publications and analytics	Publication identifiers, status, and timestamps; metrics, reactions, comments, and other information available through the API, solely within the scope of the connected features and permissions granted.
Payment data	Subscription plan and payment status and history. Full payment card details are generally processed by the payment provider and are not stored by FlowSMM AI.
Technical data	IP address, device and browser type, operating system, login and activity logs, cookies, and error, security, and performance data.
Support enquiries	Support messages, attachments, and information voluntarily provided by the user.

4 Sources of Personal Data

directly from the user when the user registers, configures an account, creates content, makes a payment, or contacts support;
from Meta after the user authorises access and grants specific permissions;
automatically when the user accesses or uses the website or Service;
from payment, analytics, infrastructure, and other service providers, to the extent necessary to operate the Service.

5 Purposes and Legal Bases for Processing

We process personal data as necessary to perform our contract with the user, on the basis of the user's consent, to comply with legal obligations, and, where permitted, to pursue FlowSMM AI's legitimate interests, including maintaining security, preventing misuse, and improving the Service.

creating and maintaining a user account;
connecting and managing authorised social media pages and accounts;
creating, storing, scheduling, and publishing content at the user's direction;
providing analytics and a history of completed actions;
AI-assisted content generation, editing, and recommendations;
processing payments, issuing invoices, and maintaining legally required records;
providing support, diagnosing errors, securing accounts, and preventing fraud;
sending service-related notices; marketing communications are sent only where the required consent has been obtained and may be opted out of at any time.

6 Facebook and Instagram Integration

Accounts are connected through Meta's official authorisation process. The user selects the available assets and confirms the requested permissions. FlowSMM AI uses data received from Meta solely to provide features that are expressly made available to the user through the Service and in accordance with the applicable Meta Platform Terms and Policies.

FlowSMM AI does not publish content without a user instruction, a schedule configured by the user, or another form of automation set up in advance by the user. The user is responsible for ensuring that uploaded content is lawful and that the user holds all necessary rights to such content.

The user may terminate FlowSMM AI's access through the Service settings, the Facebook or Instagram integration settings, or by submitting a data deletion request. Once permission has been withdrawn, no new data will be requested from the relevant account, except for technical information strictly necessary to complete the disconnection process and comply with legal obligations.

7 Use of Artificial Intelligence

If a user uses AI features, the prompts entered by the user and the selected content may be transmitted to providers of AI models for the purpose of generating the requested output. We transmit only the data necessary to fulfil the request and apply contractual and technical safeguards. Users should not enter passwords, payment details, identity documents, special categories of personal data, or confidential information relating to third parties into AI input fields unless they have a lawful basis to do so.

8 Disclosure of Data to Third Parties

We do not sell personal data. Access may be granted only to the extent necessary to:

providers of hosting, cloud infrastructure, databases, file storage, and content delivery services;
providers of AI models and automation tools;
payment, email, communications, analytics, and customer support providers;
Meta and other connected platforms, for the purpose of carrying out user-requested actions;
public authorities, courts, or other persons where disclosure is required by law or necessary to protect rights, security, or safety.

Before launch, an up-to-date list of the principal service providers must be published or identified directly in this Policy: Render and Supabase. All of our servers and databases are physically located in data centres in Frankfurt, Germany. Data is stored in encrypted form and is subject to restricted access controls. OpenAI: data included in text prompts is transmitted through the API to generate responses. Under our agreements, such data is processed in a secure environment and is not used to train publicly available AI models. We do not currently use embedded third-party analytics systems such as Google Analytics. The website does not use payment gateways, and we do not collect or store payment card details. We use Supabase's built-in tools to send system notifications and confirmations. Contact: legal@flowsmm.ai.

9 International Data Transfers

Certain service providers and social media platforms may process personal data outside the Republic of Tajikistan. In such cases, we implement available contractual, organisational, and technical safeguards and transfer data only where a lawful basis exists, including user consent where required.

10 Data Retention

We retain personal data no longer than necessary for the relevant purpose, unless a longer retention period is required by law, contract, security requirements, or the need to establish, exercise, or defend legal claims.

Data	Indicative Retention Period
Account data	While the account remains active and for up to 30 days after a verified deletion request, except for records that must be retained.
Meta tokens	Until the integration is disconnected or the token expires or is revoked, after which the token is deleted or securely deactivated.
Drafts and content	Until deleted by the user or until the account is deleted; backup copies may be retained for up to 90 days.
Security logs	Generally for up to 12 months, unless an incident investigation requires a longer retention period.
Payment and accounting records	For the period prescribed by applicable law.
Support enquiries	For up to 24 months after the enquiry is closed, unless a different period is required in connection with a dispute or legal obligation.

11 Data Deletion

A user may request deletion of personal data by any of the following methods:

in FlowSMM AI: Settings > Account > Delete Account;
through the page at flowsmm.ai/data-deletion;
by emailing privacy@flowsmm.ai from the email address associated with the account.

We may request verification of identity. Once a request has been verified, active data is generally deleted or anonymised within 30 days. Data contained in backups is deleted through the ordinary overwrite cycle, generally within no more than 90 days. Exceptions may apply to data that must be retained to comply with law, prevent fraud, maintain security, process payments, or resolve disputes.

12 User Rights

Subject to applicable law, a user may have the right to:

receive information about the processing of, and obtain access to, the user's personal data;
request correction of inaccurate or incomplete data;
withdraw consent and disconnect integrations;
request erasure, blocking, or restriction of processing where provided by law;
object to certain types of processing and opt out of marketing communications;
receive personal data in a portable format, where the right to data portability applies;
lodge a complaint with a competent authority or bring proceedings before a court.

To exercise any of these rights, please email privacy@flowsmm.ai. We will respond within the period prescribed by applicable law and may request information reasonably necessary to verify the identity and authority of the applicant.

13 Cookies and Analytics

We may use strictly necessary cookies for authentication, preference storage, and security, as well as analytics cookies to evaluate the operation of the Service. Non-essential cookies are used only after consent has been obtained where required. Users may change their browser settings or cookie preferences on the website. Disabling strictly necessary cookies may impair the operation of the Service.

14 Data Security

We implement reasonable organisational and technical measures, including access controls, encryption of data in transit, secure storage of access tokens, logging of critical actions, backups, monitoring, and incident-response procedures. No method of data storage or transmission is completely secure. In the event of a material incident, we will act in accordance with applicable law.

15 Personal Data of Third Parties and Minors

By uploading information relating to other persons, the user represents that the user has a lawful basis and all necessary permissions to do so. The Service is intended for persons aged 18 or over and is not designed to knowingly collect children's personal data. If we become aware that such data has been collected without a proper lawful basis, we will take steps to delete it.

16 Changes to This Policy

We may update this Policy to reflect changes to the Service, applicable law, or the service providers we use. The revised version will be published at flowsmm.ai/privacy-policy and will state its effective date. Where required, we will provide additional notice of material changes through the Service or by email.

17 Governing Law

This Policy is governed by the laws of the Republic of Tajikistan, including Law of the Republic of Tajikistan No. 1537 dated 3 August 2018 On Personal Data Protection, together with any other rules applicable to the relevant user or processing activity.

18 Contact Details

Individual Entrepreneur TURAEV BOBOJON ABDURAKHMONOVICH FlowSMM AI Address: Premises 1, 7/2 Moyonsho Nazarshoev Street, Shohmansur District, Dushanbe, Republic of Tajikistan Privacy email: privacy@flowsmm.ai Telephone: +992 110 725 555 Website: https://www.flowsmm.ai/