Data Deletion Policy

ChatFlow Limited ("ChatFlow," "we," "us," or "our") respects your right to control your personal data. This Data Deletion Policy explains how you can request the deletion of your personal information, what data is removed, our retention obligations, and the timeframe for processing your request. This policy operates in conjunction with our Privacy Policy and Terms of Service.

1. Your Right to Erasure

Under the Jamaica Data Protection Act (JDPA 2020), the General Data Protection Regulation (GDPR – EU/UK), and other applicable privacy laws, you have the right to request the erasure of your personal data ("Right to be Forgotten"). This right enables you to ask ChatFlow to delete the personal information we hold about you, subject to certain legal exceptions.

You may exercise this right when:

• Your personal data is no longer necessary for the purpose it was originally collected
• You withdraw consent where consent was the legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• Your personal data has been unlawfully processed
• Your personal data must be erased to comply with a legal obligation

2. How to Request Data Deletion

You may request the deletion of your data through any of the following methods:

1. Email Request: Send a written request to [email protected] with the subject line "Data Deletion Request." Please include your full name, the email address associated with your ChatFlow account, and any relevant account identifiers.
2. Facebook / Meta Platform: If you connected your account through Facebook or Instagram, you may initiate a deletion request directly through your Facebook settings. Meta will forward the request to ChatFlow via our automated data deletion callback endpoint, and you will receive a confirmation code for tracking.
3. Account Dashboard: If you have an active ChatFlow account, you may request account and data deletion through your account settings within the platform.

3. What Data Is Deleted

Upon receiving and verifying a valid deletion request, we will permanently remove the following categories of personal data:

• Account Information: Name, email address, login credentials, profile settings, and authentication tokens
• Contact Data: Phone numbers, billing addresses, and other contact details you provided
• Chat and Conversation Data: Chat transcripts, conversation history, messages, and associated metadata
• Integration Data: OAuth tokens, connected social media account identifiers, and webhook configurations
• Usage Data: Session logs, feature usage history, and analytics data linked to your identity
• Uploaded Content: Documents, files, knowledge base materials, and training data uploaded to your account

4. Data We May Retain

In certain circumstances, we may be required or permitted to retain specific data even after a deletion request. This includes:

• Legal and Regulatory Obligations: Billing records, transaction history, and tax-related information may be retained for up to 6 years as required by Jamaican tax law and applicable international financial regulations
• Fraud Prevention and Security: Records necessary to prevent fraud, enforce our terms, or protect the rights, property, and safety of ChatFlow and its users
• Dispute Resolution: Data necessary for the establishment, exercise, or defense of legal claims may be retained until the relevant limitation period expires
• Aggregated and Anonymized Data: Data that has been fully anonymized or aggregated in a manner that it can no longer be associated with an identifiable individual is not subject to deletion requests

Where we retain data under these exceptions, we will inform you of the specific legal basis and the expected retention period.

5. Processing Timeframe

We process data deletion requests as follows:

• Acknowledgment: We will acknowledge receipt of your deletion request within 5 business days
• Identity Verification: We may require verification of your identity to prevent unauthorized deletion. This typically involves confirming the email address associated with your account or providing additional identifying information
• Processing: Valid deletion requests are processed within 30 calendar days from the date of verification, consistent with GDPR and JDPA requirements
• Complex Requests: Where a request is particularly complex or involves a large volume of data, we may extend the processing period by an additional 60 days, in which case we will notify you of the extension and the reasons for the delay
• Confirmation: Upon completion, we will send you a written confirmation that your data has been deleted

6. Deletion via Facebook / Meta

ChatFlow integrates with Facebook and Instagram for social media messaging and account connection. In accordance with Meta Platform requirements, we provide an automated data deletion callback mechanism.

When you request data deletion through Facebook:

1. Meta sends a signed deletion request to ChatFlow's secure callback endpoint
2. ChatFlow verifies the request authenticity using cryptographic signature validation
3. A unique confirmation code is generated and returned to Meta
4. Your Facebook-linked data is queued for deletion within 30 days
5. You may check the status of your request using your confirmation code on this page

7. Impact of Data Deletion

Please be aware that data deletion is permanent and irreversible. Once your data has been deleted:

• Your ChatFlow account will be permanently deactivated and cannot be recovered
• All chatbot configurations, knowledge base content, and training data will be removed
• Historical conversation data and analytics will be permanently erased
• Any active subscriptions will be canceled (refund eligibility is governed by our Terms of Service)
• Connected third-party integrations (WhatsApp, Instagram, Messenger) will be disconnected

We strongly recommend exporting any data you wish to keep before submitting a deletion request.

8. Enterprise and Business Accounts

If you are an end-user of a business that uses ChatFlow (for example, you interacted with a business's chatbot), your conversation data is controlled by that business. In such cases:

• Please direct your deletion request to the business you interacted with
• ChatFlow, acting as a Data Processor, will assist the business in fulfilling your request in accordance with our Data Processing Addendum
• If the business is unresponsive, you may contact us directly at [email protected] and we will make reasonable efforts to assist

9. Complaints and Appeals

If you believe your deletion request has not been handled properly, you have the right to:

• Contact our Data Protection Officer at [email protected] to escalate your concern
• Lodge a complaint with the Office of the Information Commissioner (Jamaica)
• Lodge a complaint with your local EEA/UK data protection authority if you are located in the European Union or United Kingdom

10. Changes to This Policy

We may update this Data Deletion Policy to reflect changes in our practices, legal requirements, or regulatory guidance. Material changes will be communicated through a notice on our website and, where appropriate, via email to registered users. The "Last Updated" date at the top of this page indicates when this policy was most recently revised.

11. Contact Information