Privacy Policy

1. Who we are

MessageFlow is a multi-channel messaging automation platform operated by Datanetics (Pty) Ltd ("we", "us", "our"). Our platform allows organisations ("tenants") to design conversational flows, manage customer conversations, and send broadcast messages via WhatsApp, Telegram, and SMS.

For questions about this policy, contact us at cj@datanetics.co.za.

2. Data we collect

• Account data: Name, email address, and password when you register or are invited to an organisation.
• Organisation data: Organisation name, slug, timezone, and channel credentials (WhatsApp phone number ID and API token, Telegram bot token) stored per tenant.
• Contact data: Names, phone numbers, email addresses, company names, and custom fields you import or create for your contacts.
• Conversation data: Messages sent and received across WhatsApp, Telegram, and SMS channels, including timestamps and delivery status.
• Usage data: Log entries, queue job records, and activity logs generated during normal platform use.

3. How we use your data

• To deliver the MessageFlow platform and its features to you and your team.
• To route inbound messages from WhatsApp, Telegram, and SMS to the correct organisation and conversation thread.
• To send outbound messages on your behalf using your organisation's channel credentials.
• To provide analytics, delivery reporting, and audit logs within your organisation's workspace.
• To enforce role-based access control and maintain tenant data isolation.
• To comply with our legal obligations.

We do not sell your data or your contacts' data to third parties.

4. WhatsApp & Telegram messaging

MessageFlow integrates with the Meta WhatsApp Business API and the Telegram Bot API. When you use these channels:

• Messages are transmitted via Meta's and Telegram's infrastructure. Their respective privacy policies apply to data in transit on their platforms.
• Inbound webhook payloads are verified using HMAC-SHA256 signatures (WhatsApp) and secret tokens (Telegram) to ensure authenticity.
• Channel credentials (API tokens) are stored encrypted at rest in your organisation's settings and are never logged in plaintext.
• You are responsible for obtaining appropriate consent from your contacts before sending them messages through our platform.

5. Tenant data isolation

MessageFlow is a multi-tenant platform. Each organisation's data — including contacts, conversations, campaigns, and credentials — is logically isolated by organisation_id on every table. Users can only access data belonging to organisations they are members of. Superadministrators have cross-tenant read access for support purposes only.

6. Data retention

• Conversation and message records are retained for as long as your organisation account is active.
• Soft-deleted records (contacts, templates) are retained for 30 days before permanent deletion.
• Upon account termination, we will delete your organisation's data within 30 days unless required by law to retain it.

7. Data security

We take reasonable technical and organisational measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit.
• Encrypted storage for channel API tokens and credentials.
• HMAC-SHA256 webhook signature verification on all inbound channel requests.
• Role-based access control with least-privilege defaults.
• Queue-driven processing to decouple inbound webhook handling from direct database writes.

8. Third-party services

We use the following third-party services to operate the platform:

• Meta (WhatsApp Business API) — message delivery and webhook events.
• Telegram Bot API — message delivery and webhook events.
• Africa's Talking — SMS delivery (South Africa).
• Redis — queue processing and caching (self-hosted).

Each of these services has its own privacy policy. We recommend reviewing them for completeness.

9. Your rights

Depending on your jurisdiction, you may have the right to access, correct, or delete the personal data we hold about you. To exercise any of these rights, please contact us at cj@datanetics.co.za. We will respond within 30 days.

10. Cookies

MessageFlow uses session cookies to maintain your authenticated state in the admin panel. We do not use third-party tracking cookies or advertising cookies. The public-facing website does not set any cookies.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of the platform after changes constitutes acceptance of the updated policy.