Your information, in plain words

FlowSocial is an online tool that helps businesses plan posts and run Facebook and Instagram ads. In this policy, “we” and “us” mean FlowSocial, and “you” means anyone who uses it, including team members and clients you invite.

We are responsible for looking after your information. If you have any question about it, write to help@flowsocial.site.

We collect information in four ways:

• What you give us: your name, email address and password when you sign up; your brands, logos and colours; the posts, pictures and videos you upload; comments and approvals; the emails of people you invite; and what you tell the assistant about your business.
• What Facebook and Instagram share when you connect them, and only with your permission: the names and IDs of your Pages, Instagram business account and ad account; a secure access key that lets us post and run ads for you; and results such as reach, reactions, clicks, cost and follower totals by age group and place. We do not receive your Facebook password.
• What you pay: your plan, the amount, the date and the payment reference from our payment provider. Your card details go straight to the payment provider. We never see or store them.
• What we record to keep the service safe: when you sign in, a scrambled (one-way) version of your network address and of a random ID saved in your browser, and whether your email address comes from a temporary-email service. We use these only to stop the same person opening many free accounts, not to follow you around the web.

If you sign in with Google, Google shares your name, email address and profile picture with us. We use them only to create and sign in to your account.

• To give you the service: save your work, send posts at the times you choose, create and check the ads you approve, and show your results.
• To protect your money: check running ads against the limits you set, and pause or lower ones that cost too much.
• To write with AI when you ask: we send what you typed (for example a description of your business or a post idea) to an AI service so it can write a reply.
• To send emails you need: invitations, sign-in links, approval requests, weekly summaries, reminders before your plan ends and alerts about your ads.
• To keep the service safe and fair: stop misuse, repeat free sign-ups and attacks, and fix errors.
• To follow the law: keep payment records and answer lawful requests.

We don't sell your information. We don't use your content or your Facebook data to advertise to you or to anyone else, and we don't build profiles of your customers.

Under the Nigeria Data Protection Act 2023, and similar laws elsewhere such as the GDPR in Europe, we need a lawful reason for each use:

• To keep our agreement with you — running the service you signed up for.
• Your permission — for example connecting Facebook and Instagram. You can take it back at any time by disconnecting.
• Our genuine interest in keeping the service safe, fair and working — balanced against your rights.
• A legal duty — for example keeping payment records for tax.

We share information only with companies that help us run FlowSocial, and only what each one needs:

• Meta (Facebook and Instagram) — to publish your posts, run your ads and fetch your results. Meta's own privacy policy also applies to what you do on Facebook and Instagram.
• Our hosting and database providers (Lovable Cloud, built on Supabase, and Cloudflare) — they store the service and your files securely.
• The AI service that writes for you — at present this may be Lovable AI (which uses Google's Gemini models), Anthropic (Claude), Google (Gemini) or DeepSeek. Only the text of your request is sent. Some AI services, especially free versions, may keep requests for a time under their own terms, and DeepSeek is based in China. Please don't put private details such as customers' phone numbers in AI requests.
• Our email provider — to deliver the emails listed above.
• Our payment provider (Squad, by GTCO) — to take payments safely.
• Google — only if you choose “Continue with Google” to sign in.
• The people you invite — team members and clients see the brand you share with them, in line with the access you give.

We may also share information if the law requires it, to protect people from harm, or if FlowSocial is sold or merged — in which case this policy keeps applying to your information.

• We use it only to provide the features you use in FlowSocial, such as posting, ads, results and comparing with public business accounts.
• We never sell it, and never use it to target ads for anyone else.
• Only the owners and admins of a brand can use its connection. Team members and clients never see the access key.
• When you disconnect, or delete your brand or account, we delete the access key and stop collecting new information.
• You can also remove FlowSocial from Facebook at any time: on Facebook go to Settings & privacy → Settings → Business integrations, and remove it.

Our use of information from Google sign-in follows the Google API Services User Data Policy, including its Limited Use rules.

Our providers keep information on secure servers that may be outside Nigeria, for example in Europe or the United States, and an AI request may be handled where that AI service works. When information leaves Nigeria, we rely on the protections the law allows, such as the provider's contract terms and security promises.

• Your account, brands and posts: for as long as your account is open.
• Your Facebook and Instagram access key: until you disconnect, or delete the brand or your account.
• Ad results and budget changes: while the brand exists, so you can look back at your history.
• Payment records: as long as the law requires, usually up to six years.
• Safety records about sign-ups: only as long as needed to stop misuse.

When you ask us to delete your account, we delete or anonymise your information within 30 days, apart from what the law makes us keep. Copies in our backups disappear as those backups expire.

You can ask us to:

• Show you the information we hold about you, and give you a copy.
• Correct anything that is wrong. Most of it you can change yourself in Settings.
• Delete your information — see our Delete your data page.
• Stop or limit a use you object to, or withdraw a permission you gave.

Write to help@flowsocial.site from the email address on your account. We reply within 30 days and never charge for a reasonable request. If you are unhappy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or to the data protection authority where you live.

We don't use advertising cookies or tracking tools from other companies. Your browser stores only what the service needs to work: that you are signed in, which brand you were looking at, a random ID used for the safety checks above, and an unsent note you typed for the AI planner. Clearing your browser's site data removes them and signs you out.

Everything travels over encrypted connections. Passwords are stored scrambled by our sign-in provider, so nobody at FlowSocial can read them. Each brand's information is walled off so only its own members can reach it. See How we keep you safe for more. No system is perfect, so if something ever went wrong that put you at risk, we would tell you and the authorities as the law requires.

FlowSocial is for businesses and adults aged 18 or over. We don't knowingly collect information from children. If you think a child has given us information, tell us and we will delete it.

If we change this policy, we will update the date at the top. If a change is important, we will tell you by email or in the app before it takes effect.