Privacy Policy

Last updated: July 2026

This Privacy Policy describes how StayFlow Studio (“we”, “us”, or “our”) processes personal data when you use BotFlow and related services, including communication through the WhatsApp Business Platform.

1. Service operator

The service is operated by StayFlow Studio. For privacy-related questions or requests, contact us at contact@stayflowstudio.com.

2. Scope

This policy applies to BotFlow, our WhatsApp-based chatbot and automation services, and related hospitality and guest communication features provided by StayFlow Studio. It covers data processed when you communicate with us or with BotFlow through WhatsApp or when you use related StayFlow Studio services.

3. Data we may process

Depending on how you interact with BotFlow and StayFlow Studio, we may process the following categories of personal data:

  • Phone number
  • WhatsApp profile name
  • Message content voluntarily sent by you
  • Message metadata (such as delivery and read status where available)
  • Timestamps of messages and interactions
  • Conversation identifiers
  • Technical logs related to service operation
  • IP address where technically applicable (for example, in server or security logs)
  • Booking information voluntarily provided by you
  • Accommodation information voluntarily provided by you
  • Service requests and related details you choose to share
  • Customer support information

4. How contact is initiated

You may initiate contact with BotFlow or StayFlow Studio through WhatsApp at your own discretion. When you send us a message, you voluntarily provide the information contained in that communication. We process this information to respond to you and operate the services you request.

5. Purposes of processing

We process personal data for the following purposes:

  • Responding to WhatsApp messages
  • Operating the BotFlow chatbot
  • Automated conversation handling
  • Customer support
  • Booking communication
  • Hospitality and guest service communication
  • Automation requested by users
  • Security and abuse prevention
  • Troubleshooting and service improvement

6. Third-party services and infrastructure

To provide BotFlow and related services, we use third-party providers and infrastructure, including but not limited to:

  • Meta Platforms and the WhatsApp Business Platform for messaging delivery and related functionality
  • Hosting, cloud, and infrastructure providers necessary to operate the service
  • API and technology providers required for automation, AI-assisted responses, and service delivery

These providers may process data on our behalf or as independent controllers where required by their own terms and policies. We do not claim that personal data is never shared with third parties, because messaging and infrastructure providers are essential to how the service works.

7. Legal bases (GDPR)

Where the General Data Protection Regulation (GDPR) applies, we rely on one or more of the following legal bases:

  • Consent — where you have given consent, for example by initiating contact or agreeing to specific processing
  • Performance of a contract — where processing is necessary to provide services you request
  • Pre-contractual steps — where processing is necessary before entering into a contract at your request
  • Legitimate interests — such as operating, securing, and improving the service, provided your interests do not override ours
  • Compliance with legal obligations — where we must retain or disclose data under applicable law

8. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, to comply with legal obligations, or to establish, exercise, or defend legal claims. Retention periods may vary depending on the type of data and the context of processing.

9. Your rights

Depending on applicable law, you may have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request deletion of your data
  • Request restriction of processing
  • Object to certain processing
  • Data portability, where applicable
  • Withdraw consent where processing is based on consent
  • Lodge a complaint with a competent supervisory authority

To exercise these rights, contact contact@stayflowstudio.com. For data deletion requests related to BotFlow, see our User Data Deletion Instructions.

10. International data transfers

Because we use global infrastructure and messaging platforms, personal data may be processed or transferred outside your country of residence, including to countries that may not provide the same level of data protection as your jurisdiction. Where required, we implement appropriate safeguards for such transfers.

11. Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children’s privacy

BotFlow and related StayFlow Studio services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Last updated” date. We encourage you to review this page periodically.

14. Contact

For questions about this Privacy Policy or our data practices, contact:

contact@stayflowstudio.com