Privacy Policy

HomiFlow is operated by Oussama Ramdani, Place Andalous, Ghardaia 47000, Algeria. For anything in this policy, write to support@homiflow.online or message +213 660 87 55 11.

Our customer is the merchant. For the data belonging to the merchant's own customers we act as a processor: the merchant decides what happens to it, and we act on their instructions.

• Account data:name, email address and role of each person using the merchant's HomiFlow account.
• Store data (from Shopify, if connected): products, inventory, locations and orders, through the permissions granted at connection time.
• End-customer data: name, phone number, wilaya/commune and address — needed to confirm an order and deliver it.
• Meta platform data (if the merchant connects a channel): see section 3.
• YouTube data (if the merchant connects a channel): see section 4.
• Advertising data (optional):performance figures for the merchant's own ad account on Meta or TikTok, if connected.

A merchant may connect their own Facebook Pages, Instagram professional account and WhatsApp Business account. Nothing is accessed until they authorize it through Meta's own consent dialog, and the merchant chooses which Pages and accounts to include.

Once connected, and only for the accounts they selected, we access:

• Page and account details: the name and identifier of the Page, Instagram account or WhatsApp phone number, used to label the connection and route incoming messages to the right merchant.
• Conversations:messages people send to the merchant on Messenger, Instagram Direct and WhatsApp, with their attachments, together with the sender's platform-scoped identifier and public display name, so the merchant can read and answer them in one inbox.
• Comments:comments on the merchant's own posts and ads, so the merchant can reply publicly or move the conversation to a private message.
• Access tokens:issued by Meta at connection time, stored encrypted, and used only to perform the actions above on the merchant's behalf.
• Ad insights:spend and results for the merchant's own campaigns, shown next to the orders those campaigns produced, since in cash on delivery an order only counts once it is delivered and paid.

What we commit to:

• We use this data only to provide the merchant with the features they connected it for.
• We do not sell it, rent it, or share it with data brokers, and we do not use it to build advertising profiles or to target advertising.
• We reply to people who messaged the merchant first. We do not message anyone otherwise, except through WhatsApp message templates the merchant has had approved by Meta.
• A merchant can disconnect at any time; disconnecting deletes the token and ends our access immediately.
• We keep this data no longer than the merchant's account is active, and delete it on request — see Data Deletion.

HomiFlow uses YouTube API Services to let a merchant upload and schedule videos on their own YouTube channel. By connecting a channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

Nothing is accessed until the merchant authorizes it on Google's own consent screen and picks the channel. Once connected, we access only:

• Channel details: the channel name, handle and picture, to label the connection.
• Playlists:the channel's playlist names, so the merchant can choose where a video goes.
• Videos the merchant uploads through HomiFlow:the merchant's browser sends the file straight to YouTube (it never passes through or is stored on our servers) together with the title, description, tags, thumbnail, audience and playlist the merchant entered. We keep the video ID and read its processing and privacy status, to show it in HomiFlow and to make it public at the time the merchant scheduled.
• Access token: the refresh token Google issues at connection time, stored encrypted and used only for the actions above.

We do not read the channel's analytics, comments, subscribers or any other video, and we do not share YouTube data with anyone, sell it, or use it for advertising.

You can disconnect at any time: removing the channel in HomiFlow deletes the token and the records linked to it immediately. You can also revoke HomiFlow's access from your Google security settings; any YouTube data we still hold is then deleted within 30 days.

Essential cookies keep you signed in. On HomiFlow's public marketing and signup pages, optional Meta Pixel tracking starts only after you accept. It measures page visits, signup starts and successful new-account registrations to help measure our ads; Meta receives browser/device and event data. We do not send signup names, emails, passwords, merchant dashboard activity, order details or customer data through this Pixel. It is not installed in merchant storefronts or dashboards. You can reject optional tracking or change your choice using Privacy choices on the public site.

We also keep daily aggregate counts of public HomiFlow page views, signup/login/pricing link clicks and successful new registrations. These internal counts do not use analytics cookies, visitor identifiers, fingerprints, stored IP addresses, full URLs or signup details. They are not sent to Meta and do not identify unique visitors or attribute a registration to an ad campaign. Existing optional Meta choices remain separate.

• Managing orders, stock, confirmation calls and delivery.
• Bringing messages and comments from the connected channels into one inbox.
• Sending order updates to the customer on the channel they wrote from.
• Passing orders to delivery companies so the parcel reaches the customer.
• Syncing stock and orders with the merchant's Shopify store.
• Reporting and analytics that help the merchant run their business.
• Contacting the merchant about their account and subscription.

We do not use merchant or customer data for advertising, and we do not sell it.

We share the minimum necessary with providers that run parts of the service:

• Delivery companies (ZR Express, Ecotrack, Yalidine, Maystro, Noest and others the merchant chooses): customer name, phone, address and order details, to deliver the parcel.
• Hosting and database (Vercel, Neon): running and storing the platform.
• Email (Resend): account and invitation emails.
• Payments(Chargily in Algeria; Stripe for international cards): subscription and credit payments. Card details are entered on the provider's page — we never see or store the full card number.
• Shopify: syncing and billing where the merchant subscribes through Shopify.
• AI providers (Anthropic; Google Gemini for transcribing voice messages and describing videos a customer sends; OpenAI or DeepSeek when the merchant selects those models; fal.ai for image and video generation): where a merchant turns on an AI feature, the relevant text or media — which may include a customer message the AI is drafting a reply to — is sent to the provider to produce that reply or asset. These providers act on our instruction and do not use the content to train their models.
• Meta(WhatsApp, Messenger, Instagram and Marketing APIs): sending and receiving the merchant's messages and running the ad campaigns the merchant launches.
• Google / YouTube (YouTube Data API): uploading and publishing the videos the merchant sends to their own channel — see section 4.
• Error monitoring (Sentry): technical error reports that help us fix bugs.

All of them are bound to protect the data and to use it only to provide their service to us.

You can ask for access to your data or its deletion, at any time, free of charge, at support@homiflow.online. We respect privacy rights including those under the GDPR. Deletion is described step by step on the Data Deletion page.

For end-customer data coming from Shopify we support the official webhooks: customers/data_request (we provide what is stored about the customer), customers/redact (we redact that customer's personal data) and shop/redact(after uninstall, we delete the connection and redact the store's personal data).

We keep data while the account is active. Disconnecting a channel deletes its connection and token immediately. Closing the account, or asking us to delete stored data, results in deletion within 30 days, except records we are legally required to keep, such as invoices and audit-log entries — which contain no message content.

Traffic is encrypted in transit (HTTPS), secrets such as access tokens are encrypted at rest, every incoming platform notification is verified before it is trusted (HMAC), and each merchant's data is isolated from every other merchant's. No system is 100% secure, and we keep working on it.

HomiFlow is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

We may update this policy. Any significant change will be communicated, and the date at the top will be updated.