Privacy Policy

1. Who we are

QFlow (“we”, “us”) provides real-time queue and appointment management for businesses — clinics, salons, government counters and service businesses. Customers book and track their token live, and can reach the business over WhatsApp, Instagram Direct or Facebook Messenger as well as on the web. Operated at qflowlive.com. For any privacy question, contact support@qflowlive.com.

In this policy, “business” means the organisation using QFlow to run its queue, and “customer” means the person booking or enquiring. The business decides what customer data is entered and why; QFlow processes it on the business’s behalf.

2. What we collect

• Business account data — business name, contact details, staff logins, billing information.
• Customer queue data — name, phone number, token number, appointment time and queue status, entered by the business or supplied by the customer when booking.
• Messages you send us — when a customer messages a business on WhatsApp, Instagram Direct or Facebook Messenger, we store the content of that conversation: the text of each message, any photo, document or file sent, and a text transcript of any voice note. This is what lets the assistant answer, and what lets staff read the conversation and reply.
• Channel identifiers — the account identifier the platform gives us for the sender (a phone number on WhatsApp; an opaque, account-scoped identifier on Instagram and Messenger, which is not a phone number and cannot be used to contact you anywhere else).
• Message delivery status — whether a notification we sent on the business’s behalf was delivered or read.
• Technical data — basic logs (IP, browser type) needed to operate and secure the service.

3. How we use it

Solely to operate the service: taking bookings, sending token notifications, showing the live tracker, answering questions about a booking, and letting the business’s own staff read and reply to messages. We do not sell personal data, and we do not use customer data for advertising or for training AI models.

Automated replies. To answer a message, its text is sent to a third-party AI language-model provider, which returns a suggested reply. That provider processes the text to produce the answer and does not use it to train its models. Files a customer sends are stored so the business can view them and are not sent to the AI provider. A member of the business’s staff can read any conversation and reply personally at any time.

4. Messaging platforms & third parties

Meta platforms. Conversations happen on the WhatsApp Business Platform, Instagram Direct and Facebook Messenger, all operated by Meta. Messages between a customer and a business pass through Meta’s infrastructure and are also subject to Meta’s own privacy policy. On Instagram and Messenger we receive an account-scoped identifier rather than a phone number, and we only receive messages sent to a business that has connected its own account to QFlow.

AI provider. Message text is sent to a third-party language-model provider to generate replies, as described above.

Infrastructure. We use trusted hosting, database and object-storage providers, bound by data-processing obligations.

We share data with these providers only to run the service. We do not sell it, and we do not share it for advertising.

5. Retention & deletion

Queue and booking data is retained for the business’s operational and record-keeping needs. Conversations and any files sent with them are retained so the business has a record of what was asked and answered.

All of it is deleted on account closure, or earlier on request. A business may request export or deletion of its data at any time via support. A customer may ask the business, or us directly at support@qflowlive.com, to delete their data — including their conversation history — and we will action verified requests as described below.

6. Security

Data is encrypted in transit (HTTPS/TLS), access is restricted to authorised personnel, and patient tracker links are unique and unguessable.

7. Your rights

Customers may ask the business, or us, to access, correct or delete their data, including messages they have sent. We respond to verified requests within 30 days, subject to applicable law in India and the GCC.

8. Changes

We will post any changes to this policy on this page with an updated date.