Privacy Policy

1. Who We Are

HeyFlou is an AI automation and consulting firm that helps small and medium-sized businesses (SMBs) streamline operations through intelligent automation. Our services include business process automation, AI-powered communication tools, CRM integrations, scheduling systems, and custom AI solutions.

We operate primarily in Mexico and serve clients across healthcare, fitness, education, and other service-based industries.

Contact: hello@heyflou.com | https://heyflou.com

2. Information We Collect

We may collect the following types of information:

• Contact Information: Name, email address, phone number, and business name provided via contact forms, email, or WhatsApp.
• Business Information: Industry, size, and operational details shared during discovery calls or onboarding.
• Client Data: Information you provide to configure your automations (e.g., appointment details, customer lists, scheduling preferences).
• Usage Data: Analytics on how visitors interact with our website (pages visited, time on site, referring pages).
• Communications: Messages exchanged via email, WhatsApp, or Telegram for support and project delivery.
• Social Media Data: Public metrics and engagement data from social media platforms (Instagram, LinkedIn, X/Twitter) when authorized by you.

3. How We Use Your Information

We use your information to:

• Deliver and maintain our automation services and AI solutions
• Communicate with you about your project, proposals, and support requests
• Manage client relationships and project workflows
• Send relevant updates about our services (with your consent)
• Improve our website, products, and service quality
• Comply with legal and regulatory obligations
• Analyze social media performance metrics on behalf of clients who authorize access
• Publish content on social media platforms on behalf of clients who explicitly authorize each action

Social Media Posting: HeyFlou will never post, comment, or take action on any social media account without explicit prior approval from the account owner. All content is reviewed and authorized before publication.

4. Third-Party Services

To deliver our services, we use the following third-party platforms. Each has its own privacy policy:

• Supabase — Database and backend infrastructure
• n8n — Workflow automation platform
• Meta (Instagram / Facebook) — Social media analytics and content management
• LinkedIn — Professional network analytics and content publishing
• X / Twitter — Social media content publishing and analytics
• WhatsApp Business API — Client communication automation
• Resend — Transactional email delivery
• Cloudflare — Website hosting and security
• Vercel — Application hosting
• HubSpot — Customer relationship management

We only share your data with third parties as necessary to deliver the services you have contracted. We do not sell your personal information to anyone.

5. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill our contractual obligations, or as required by law. When a client relationship ends, we delete or anonymize personal data within 90 days unless legal requirements mandate longer retention.

Social media access tokens are stored securely and revoked immediately upon client request or end of service.

6. Data Security

We implement appropriate technical and organizational security measures including:

• Encrypted storage for all credentials and API tokens
• Role-based access controls — only authorized personnel access client data
• Secure HTTPS connections for all data transmission
• Regular security audits of our internal systems
• No hardcoded credentials in source code or public repositories

7. Your Rights (ARCO Rights — Mexican Law)

In accordance with Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), you have the following rights regarding your personal data:

• Access (Acceso): Request a copy of the personal data we hold about you
• Rectification (Rectificación): Request correction of inaccurate or incomplete data
• Cancellation (Cancelación): Request deletion of your personal data
• Opposition (Oposición): Object to the processing of your personal data

To exercise these rights, email us at hello@heyflou.com with the subject "ARCO Request". We will respond within 20 business days.

8. Cookies and Tracking

Our website uses minimal cookies for essential functionality (e.g., session management) and analytics (page views, traffic sources). We use privacy-respecting analytics and do not track users across third-party websites.

You can disable cookies through your browser settings. Disabling essential cookies may affect website functionality.

9. International Data Transfers

As we use cloud-based infrastructure, your data may be processed on servers located outside Mexico, including the United States and the European Union. Where we transfer data internationally, we ensure appropriate safeguards are in place consistent with applicable privacy laws.

10. Children's Privacy

Our services are intended for businesses and adults (18+). We do not knowingly collect personal information from individuals under 18 years of age.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify clients of material changes via email or by posting a notice on our website. The "Last Updated" date at the top of this page indicates when the policy was last revised. Continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related questions, data requests, or concerns, please contact us:

• Email: hello@heyflou.com
• Website: https://heyflou.com
• WhatsApp: Available via our website contact form

HeyFlou · AI Automation & Consulting · Mexico