The Short Version
- We don't sell your data. We don't show ads, and we don't share your data for advertising.
- Your messages and contacts belong to you. We process them only to run Flukko for your business.
- We use Meta's official WhatsApp Business Platform. Messages travel through Meta's servers under Meta's own terms.
- Each workspace has its own private database, and sensitive secrets such as access tokens are encrypted.
- You can ask us to see, correct or delete your data at any time by writing to hello@flukko.com.
1.Who We Are
Flukko is a WhatsApp Business Platform operated by Think Hat Business Solutions, Madhyamgram, West Bengal, India ("Flukko", "we", "us" or "our"). Flukko lets businesses connect their WhatsApp numbers through Meta's WhatsApp Business Platform (Cloud API) and use a shared team inbox, campaigns, templates and contacts.
This policy explains what personal data we collect, why we collect it, who we share it with and the choices you have. It is written with India's Digital Personal Data Protection Act, 2023 in mind, and with other privacy laws that may apply to you, such as the EU and UK General Data Protection Regulation.
2.What This Policy Covers
This policy applies to:
- our website, www.flukko.com, and its pages;
- the Flukko web application at app.flukko.com, where businesses sign up and use the service ("the Platform"); and
- emails, WhatsApp messages and support conversations between you and us.
Two kinds of people use Flukko. Our customers are the businesses that hold a Flukko workspace, and their team members. Their contacts are the people those businesses talk to on WhatsApp. For our customers' account details we decide how data is used. For the messages and contacts a business manages in Flukko, the business decides how that data is used and we process it on the business's behalf — see Data You Manage in Flukko.
3.Information We Collect
Information You Give Us
- Account details — your name, email address, mobile number, password (stored only as a secure hash) and the workspace code and business name you choose.
- Team members — the names, email addresses, optional phone numbers and roles of people you invite to your workspace.
- Billing details — the legal name, address, state, country, tax number (for example GSTIN), billing email and phone of the organisations you are billed as.
- Workspace settings — country, time zone, currency, language and date formats.
- Messages to us — what you send through our contact form, by email or in support conversations, including your name, email, phone and company if you provide them.
Information From Meta When You Connect WhatsApp
When you connect a number, you log in with Facebook in Meta's own Embedded Signup window and choose what to share. Meta then gives us:
- the IDs of your Meta business portfolio, WhatsApp Business Account and phone number;
- your WhatsApp phone number, display name, verification status and quality rating;
- an access token that lets Flukko send and receive messages for that WhatsApp Business Account; and
- your message templates, their approval status and quality updates.
If you connect a number that is also on the WhatsApp Business App and agree to share it, Meta can also send us the contacts saved in the app and up to six months of your chat history, plus messages you send from the app afterwards, so they appear in your Flukko inbox.
We use this data only to provide Flukko to you. We do not use it for advertising and do not sell it.
Messages and Contacts You Handle in Flukko
- WhatsApp messages sent and received through your connected numbers, with their delivery and read statuses;
- contacts you add, import or receive messages from — names, WhatsApp numbers, email addresses, tags, groups, opt-in status and any custom details you store;
- campaigns, templates and the files you upload to send (images, videos, documents).
Payment Information
Payments are processed by Razorpay. Your card, UPI or bank details are entered on Razorpay's secure checkout and are never seen or stored by Flukko. We keep the order and payment references, amounts, taxes and the invoices we issue.
Information Collected Automatically
- Sign-in and security records — IP address, time of sign-in, failed sign-in attempts and an audit log of actions taken in a workspace (who did what, and when).
- API usage — if you use our API, the IP addresses and times of requests made with your API keys.
- Basic server logs — technical information such as browser type and the pages requested, kept to run and protect the service.
4.How We Use Information
- to create and run your workspace, and to send and receive WhatsApp messages for you;
- to verify your phone number with a one-time code sent on WhatsApp when you sign up;
- to process payments, issue invoices and keep accounting and tax records;
- to keep accounts secure, prevent fraud and abuse, and investigate problems;
- to answer your questions and give support;
- to send you service messages — for example about your trial, subscription, invoices, security or changes to Flukko;
- to improve Flukko, using information about how features are used, not the content of your messages; and
- to meet our legal obligations.
We never sell personal data, never use it for advertising, and never read your conversations except when you ask us to help with a support issue or the law requires it.
5.Why We Are Allowed to Use It
Depending on where you are, we rely on one or more of the following:
- Your consent — for example when you create an account, connect your WhatsApp number or contact us. You can withdraw consent at any time; this does not affect what was done before.
- Performing our contract with you — to provide the service you signed up for.
- Legal obligations — such as tax, accounting and lawful requests from authorities.
- Legitimate uses and interests — such as keeping Flukko secure and preventing misuse, where this does not override your rights.
6.Data You Manage in Flukko
When a business uses Flukko to message its contacts, the business decides why and how that contact data is used (it is the "data fiduciary" or "controller"). Flukko processes the data only on the business's instructions and to provide the service (as a "data processor").
If you are a business using Flukko, you are responsible for:
- having a lawful basis, and where needed the consent (opt-in), to message your contacts on WhatsApp;
- honouring opt-outs — Flukko helps by turning a "STOP" reply into an opt-out automatically;
- following WhatsApp's Business and Commerce Policies and Meta's terms; and
- answering your contacts' requests about their data.
If you received a WhatsApp message from a business that uses Flukko and have a question about your data, please contact that business first. You can also write to us and we will pass your request on and help where we can.
8.Storage and Security
- Each workspace's business data is kept in its own separate database.
- WhatsApp access tokens, payment gateway keys and webhook secrets are encrypted (AES-256-GCM) before they are stored.
- Passwords are stored only as secure hashes, and API keys only as a one-way fingerprint — we cannot read them back.
- All traffic to Flukko uses encrypted HTTPS connections.
- Workspaces control access with roles and permissions, and important actions are recorded in an audit log.
No system is completely secure. If a personal data breach happens that affects you, we will inform you and the relevant authorities as the law requires.
9.How Long We Keep Data
We keep personal data only as long as we need it for the purposes in this policy, or as the law requires.
| Data | How long |
|---|---|
| Account, workspace and team details | While your account is active, then deleted within 30 days of closing it or of a verified deletion request |
| Messages, contacts, campaigns and templates | Until you delete them, or your account is deleted |
| Media files in messages | Stored on Meta's servers, which keep them for about 30 days |
| Raw notifications received from Meta | Up to 30 days |
| Logs of webhooks sent to your systems | 30 days |
| Sign-up verification codes | 10 minutes |
| Invoices and payment records | As long as tax and accounting laws require (in India, generally 8 years) |
| Messages sent through our contact form | As long as needed to answer and follow up |
10.Your Rights and Choices
Depending on the law that applies to you, you can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct or complete data that is wrong or out of date;
- delete your data;
- withdraw a consent you have given;
- object to or restrict some uses, or receive a copy of your data in a portable format; and
- nominate another person to exercise these rights for you if you die or are unable to.
Many details can be changed directly in your workspace. For anything else, write to hello@flukko.com. We may need to confirm your identity first, and we aim to reply within 30 days. You also have the right to complain to the Data Protection Board of India, or to your local data protection authority.
11.Deleting Your Data
You can ask us to delete your account and all the data in your workspace at any time. Step-by-step instructions, including how to remove Flukko's access from your Facebook and Meta business settings, are on our Data Deletion Instructions page.
Disconnecting a number in Flukko stops new messages from flowing through Flukko. It does not delete your WhatsApp Business Account at Meta, which you manage in your Meta business settings.
12.International Transfers
Flukko is run from India. Our service providers, and Meta, may process data in other countries. When data moves across borders, we take steps so that it stays protected as this policy describes and as the law requires.
13.Children
Flukko is a service for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
15.Changes to This Policy
We may update this policy as Flukko changes or the law changes. We will change the "Last Updated" date above, and for important changes we will tell customers by email or in the Platform before they take effect.
16.Contact and Grievances
For questions, requests or complaints about privacy, contact us:
Grievance Officer, Flukko
Think Hat Business Solutions
4, 17/4F, Eternia, Badu Road, Madhyamgram,
North 24 Parganas, West Bengal 700155, India
Phone: +91 62900 99353
Email: hello@flukko.com
We will acknowledge your request promptly and aim to resolve it within 30 days.
