fluxy
Book a demo

Privacy policy

Last updated: 20 October 2026

Who we are

Fluxy ("Fluxy", "we") is a service operated by 1924 Digital, Istanbul, Turkey, and available at getfluxy.io and console.getfluxy.io. Fluxy lets businesses run AI agents that answer their customers on WhatsApp, Instagram and web chat. Contact for privacy matters: info@getfluxy.io.

Two kinds of people this policy covers

  • Business users: people who sign in to the Fluxy console to set up and supervise agents for their business.
  • End customers: people who write to a business through a channel the business connected to Fluxy. For their data, the business is the controller and Fluxy processes it on the business's instructions.

Data we collect

From business users

  • Account details: name, work email, password (stored as a hash), role in the workspace.
  • Workspace configuration: agent instructions, approved business facts, connected channels, integration settings and access tokens (stored encrypted).
  • Usage data: sign-in events, actions taken in the console, technical logs.

From end customers, on behalf of the business

  • Message content and attachments sent to the business through WhatsApp, Instagram or web chat, and the replies sent back.
  • Channel identifiers such as a WhatsApp phone number, an Instagram-scoped user id or a web chat session id, plus display name where the platform provides it.
  • Details the customer chooses to share in the conversation, for example a name, an order number or a preferred call-back time.

Data from Meta platforms

When a business connects a WhatsApp Business account or an Instagram professional account, Fluxy receives messages and related metadata through Meta's WhatsApp Business Platform and Instagram messaging APIs, and sends replies through the same APIs. We use this data only to provide the messaging service to that business: to generate and deliver replies, to show the conversation to the business's team, and to keep the conversation history the business relies on. We do not use Meta platform data for advertising, we do not sell it, and we do not build profiles of end customers across businesses. Our use of these APIs is subject to Meta's Platform Terms and Developer Policies.

Data from business tools a business connects

A business can connect its own tools to Fluxy, such as a CRM (Pipedrive, HubSpot), a store (Shopify, WooCommerce, ikas, Trendyol) or a payment provider (Stripe). Fluxy only accesses a tool after a workspace admin authorises it, uses the access only to do what that business configured, and stores the access credentials encrypted. Each integration's page in the console lists what it reads and writes.

Pipedrive

  • Read: the connected Pipedrive user and company name, and the company's pipelines and stages, so the business can map conversation stages to Pipedrive stages.
  • Written on the business's behalf: a person record with the name, phone number or email an end customer gave in the conversation, a deal linked to that person when the conversation reaches the first stage the business mapped, and updates to that deal's stage.
  • Fluxy does not read existing deals, contacts, emails, notes or activities in Pipedrive, and does not use Pipedrive data for any purpose other than this integration.
  • When the business disconnects in Fluxy or uninstalls the app in Pipedrive, Fluxy stops accessing Pipedrive and deletes the stored Pipedrive access and refresh tokens. Records already created in Pipedrive remain in the business's Pipedrive account under its control.

Shopify

  • Read: the store's products, so the agent can answer product questions, and its orders: order number, date, fulfilment and payment status, items, total and shipment tracking. The email and phone number on an order are used only to check that the person asking about the order is its owner. To set up the connection, Fluxy also reads the store's name, contact email, domain and currency, and the login email of the store owner who opens the app, to confirm that only the store owner can connect the store.
  • Written on the business's behalf: nothing.
  • Fluxy does not read customer records, customer names or addresses in Shopify. Fluxy checks the email and phone number on an order itself and never sends them to AI model providers; from an order, the AI receives only its number, date, status, items, total and tracking.
  • When the business disconnects in Fluxy or uninstalls the app in Shopify, Fluxy stops accessing the store and deletes the stored Shopify access tokens immediately; for a store connected through the Fluxy app in Shopify, disconnecting in Fluxy also uninstalls the app from the store. 48 hours after the app is uninstalled, Fluxy deletes the store connection and the order and product lookups saved with conversations, unless the store is reconnected to the same workspace within that time. Conversation messages remain in the business's conversation history.
  • Shopify customer erasure requests are processed on receipt: Fluxy removes the order and product lookups linked to that customer's email or phone number, while the conversation text stays as the business's own correspondence with the customer. Shopify customer data requests are recorded and our team answers them within 30 days.

ikas

  • Read: the store's products, variants, prices and stock, so the agent can answer product questions and link to products; Fluxy also keeps a search index of product names, categories, tags, brands, variant names and descriptions to find products, without prices or stock, which are always read from ikas. Orders: number, date, status, payment status, items, total, shipping and tracking. The email and phone number on an order are used only to check that the person asking about the order is its owner. Customer records are searched by phone number only to find the orders placed with the WhatsApp number an end customer writes from. Campaigns and coupons: only those that are public and valid now; campaigns limited to particular customers and coupon codes tied to one customer are filtered out. Order, product and stock events from the store keep this information current. To set up the connection, Fluxy also reads the store's id, storefront domain and the permissions granted.
  • Written on the business's behalf: only when an end customer asks in the conversation, and only on an order that is not packed yet: cancelling the order (its open lines, with stock returned) or replacing its delivery address with the one the customer gave. The customer must confirm first, and by default the business approves each change in the console; the business can choose to let these run without approval. For a return, Fluxy adds a return-request tag and a note to the order and hands the conversation to the business's team. Fluxy never issues refunds.
  • Optional, off until the business switches them on: order notifications on WhatsApp (order received, shipped with tracking) and abandoned cart reminders. For these Fluxy uses the customer's first name, phone number and preferred language, the order's number, total and tracking, and, for a reminder, the cart's items and the store's time zone (no reminder goes out between 21:00 and 09:00 store time). A message is sent only to a number with WhatsApp consent on record; a cart reminder also needs the customer to have accepted marketing messages in ikas.
  • From an order, the AI receives only its number, date, status, payment status, items, total and tracking. Fluxy checks the email and phone number on an order itself and never sends them, the customer's ikas id or the order's addresses to AI model providers. Product descriptions in the search index are not sent to the AI either.
  • When the business disconnects in Fluxy, Fluxy stops accessing the store, removes its event subscriptions in ikas and deletes the stored ikas access tokens and the product search index immediately; the app stays installed in ikas. When the business uninstalls the app in ikas, Fluxy stops accessing the store and deletes the stored tokens immediately. 48 hours after the app is uninstalled, Fluxy deletes the store connection, the order and product lookups saved with conversations and order actions, the product search index and the order notification and cart reminder records, unless the store is reconnected to the same workspace within that time. Conversation messages remain in the business's conversation history. Deleted data leaves our backups within 14 days.

Data from Google (Google user data)

A business user can choose to connect Google products to their Fluxy workspace. Each product is connected separately through Google's own consent screen and asks only for its own permissions. Fluxy accesses Google user data only for the features below, only for the account that granted access, and only after a business user has started the connection.

  • Google Calendar (calendar.readonly, calendar.events): we read the list of calendars and free/busy times so the agent can offer real open slots, and we create the appointment an end customer has confirmed in the calendar the business chose. We do not change or delete existing events.
  • Google Sheets (spreadsheets): in the spreadsheet the business selects, we read rows to look up information the business wants the agent to use (for example a price list) and append one row per new lead.
  • Google Drive (drive.file): we read only the files the business explicitly picks in Google Picker as knowledge sources, such as Google Docs, Sheets, Slides, PDFs and Word files. Their text is stored in the workspace as knowledge the agent answers from, after a business user approves it. We cannot see any other file in the user's Drive.
  • To connect any of these products we also receive the Google account's email address (openid, email) so the business can see which account is connected.

Google OAuth tokens are stored encrypted and are deleted when the business disconnects the product in the console; a business can also revoke access at any time from its Google Account permissions page. Knowledge copied from Drive is deleted when the business removes the source or deletes the workspace.

Fluxy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only to provide and improve the user-facing features described above for the business that connected it.
  • We transfer Google user data to others only as necessary to provide those features (for example, sending the relevant text to our AI model provider to generate a reply), to comply with applicable law, for security purposes, or as part of a merger or acquisition with notice to users.
  • We do not use Google user data for advertising, we do not sell it, and we do not allow humans to read it unless the business user gives explicit consent for specific data, it is necessary for security purposes or to comply with law, or the data is aggregated and anonymized for internal operations.
  • We do not use Google user data, or allow our AI model providers to use it, to develop, improve or train generalized or non-personalized AI or machine-learning models.

How we use data

  • To run the service: receive messages, generate replies, hand conversations to the business's team, keep history.
  • To generate replies, message content is sent to third-party AI model providers acting as our processors. They are contractually bound not to train on this data.
  • To keep the service secure and reliable: authentication, abuse prevention, error diagnosis.
  • To measure usage for billing, in aggregate counts, not by reading conversations.

Sharing

We share data only with processors needed to run the service: cloud hosting in the European Union (Amazon Web Services, Frankfurt), AI model providers for reply generation, Meta for message delivery on WhatsApp and Instagram, Google when a business connects Google products, and email delivery for console notifications. We share data with a business's own integrations (for example a CRM) only when that business connects them. Google user data is shared only as described in "Data from Google" above. We disclose data to authorities only when required by law.

Retention

  • Conversation data is kept while the business's account is active and deleted within 30 days after the business deletes the workspace or ends its contract.
  • Channel and integration access tokens are deleted immediately when the channel or integration is disconnected.
  • Technical logs are kept for up to 90 days.
  • Records we must keep by law, such as invoices, are kept for the legally required period.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to complain to a supervisory authority. Business users can exercise these rights by writing to info@getfluxy.io. End customers should contact the business they wrote to; if you write to us instead, we will forward your request to that business and help them act on it. Deletion is described on our data deletion page.

Security

Data is encrypted in transit (TLS) and at rest. Channel and integration credentials are stored encrypted with a key held separately from the database. Access to production systems is limited to named staff over a private network, and every action a business user takes in the console is attributed to their account.

Children

Fluxy is a business tool and is not directed at children. Businesses using Fluxy must not knowingly direct their agents at children under 16.

Changes

We will post changes on this page and update the date above. Material changes are announced in the console.

Contact

1924 Digital, Istanbul, Turkey · info@getfluxy.io