Skip to content
SixFlowEcommerce
ES Log in Book your demo

Legal

Privacy and personal data processing policy

Last updated: October 12, 2026 · Effective as of that date

This is an English translation provided for convenience. If there is any discrepancy, the Spanish version prevails.

This policy explains what personal data SixFlow processes, why, who we share it with, and how you can access it, correct it or ask us to delete it. It complies with Colombian Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and Meta Platforms’ developer terms.

Contents

1. Who the data controller is

SixFlow is a product of Six AI Studio. The controller of the personal data described in this policy is Six Art Media, owner of the Meta app that connects WhatsApp, Instagram and Messenger with SixFlow.

  • Legal name: Six Art Media
  • NIT (tax ID): [NIT pending]
  • Registered in: Bogotá D.C., Colombia
  • Address: [Address pending]
  • Phone: [Phone pending]
  • Email for personal data matters: [email protected]

The SixFlow support team handles personal data inquiries and complaints at that email address.

2. Two different roles: controller and processor

The law distinguishes between whoever decides what data is used for (the controller) and whoever processes it on someone else’s behalf (the processor). At SixFlow, both happen:

  • We are the controller of the data of people who visit sixflow.co or request a demo, and of the data of the businesses that hire SixFlow and the people who use it.
  • We are a processor of the data of those businesses’ customers (the people who message them on WhatsApp, Instagram or Messenger, or who buy from them). There, the business is the controller: it decides how it serves its customers, must have its own data policy and must obtain the authorizations the law requires. We process that data only to provide the service and according to its instructions.

3. Data from sixflow.co visitors

What we collect. When you request a demo, you give us your name, your business name or website, your WhatsApp number, your type of business or platform, an approximate volume of orders or chats and what you’re interested in, and you pick a day and time for the demo. Along with that, we save where you came to the page from (for example, the campaign or ad, and Google or Meta click IDs if they’re in the link), with no personal data in that source. If you message us on WhatsApp or by email, we keep the conversation.

What for.

  • To contact you on WhatsApp or by email to schedule and run the demo, and send you the confirmation.
  • To prepare a proposal for your business and follow up on it.
  • To know which channels and ads bring us customers, so we can invest better in advertising.

We use this data only with your authorization, which you give by checking the box on the form. We don’t sell it or hand it over to third parties.

4. Data from businesses that use SixFlow

What we collect. Name, email, phone and role of the people at the business who use SixFlow (owner, admins, agents); billing details (legal name, NIT or ID number, address, email); the messages the owner and their team send to the SixFlow assistant on WhatsApp; the log of access and actions on the platform; and the connection permissions the business gives us for its accounts (Meta, its online store, payment gateways, shipping carriers, calendar, among others), which we store encrypted.

What for. To provide and maintain the contracted service, give support, notify of outages or changes, charge and invoice, meet legal and accounting obligations, and improve SixFlow with aggregated usage metrics. Payments are made through recognized payment gateways: SixFlow does not store card numbers.

5. Data from people who message those businesses

Here we act as the business’s processor. Depending on the channels and modules the business turns on, we process:

  • Name, phone number, username and the identifier assigned by WhatsApp, Instagram or Messenger, and public profile photo.
  • The messages, voice notes, images and documents the person sends or receives, and comments on the business’s posts.
  • Order, appointment or purchase data: products, amounts, delivery address, shipping status and payment receipts.
  • Which ad or channel the person came from (chat source).
  • Email address, if the business uses the email module.

What for: to reply to and serve the person (with an artificial intelligence assistant and with the business’s team), record orders, appointments and payments, send order updates, reminders and surveys scheduled by the business, measure which channel drove each sale and, if the business turns it on, report those sales to Meta or Google to improve its ads. In that report, contact details are irreversibly encrypted, as those platforms require.

If you messaged a business that uses SixFlow and want to exercise your rights, you can contact the business or write to us: we’ll pass your request on and help fulfill it.

6. WhatsApp, Instagram and Messenger (Meta) data

When a business connects its WhatsApp number, its Facebook page or its Instagram account, SixFlow receives through Meta’s platforms the messages and comments its customers send to that business, with the public name, username and identifier Meta assigns to each person. We also store, encrypted, the access permission the business granted SixFlow.

  • We use that data only so the business and its virtual assistant can reply, record orders and see which channel each customer came from.
  • We don’t sell it, don’t use it for our own advertising, don’t build profiles for other purposes and don’t share it with anyone outside the business, except the providers we need to deliver the service (section 8), under confidentiality agreements.
  • We follow Meta’s platform terms, the WhatsApp Business policy and Instagram and Messenger messaging rules (for example, the 24-hour response window).
  • The business can disconnect its account at any time from SixFlow or from its Meta settings. When it does, we delete the stored permission and the stored comments for that account.

Anyone can ask us to delete their data as explained in section 12 and at sixflow.co/en/delete-data.

7. Artificial intelligence

The SixFlow assistant uses artificial intelligence models from third-party providers (for example, OpenAI, Google or Anthropic) to understand messages and write replies. Each business chooses its provider and pays for it with its own account; SixFlow only uses its own account for its support assistant. We send them the text needed to reply at that moment. Under their business terms, these providers don’t use that data to train their models. The assistant doesn’t make decisions with legal effects on people: when something is beyond it, it hands the conversation to a person at the business.

8. Service providers that help us deliver the service

We share data only with providers that process it on our behalf (processors), with the security and confidentiality measures the law requires:

  • Meta Platforms (WhatsApp, Instagram and Messenger): to receive and send messages.
  • Hostinger: servers that run the chat inbox and automation flows, and hosting for this website.
  • Supabase: platform databases.
  • Cloudflare: network, security, applications, attachments and encrypted backups.
  • Resend: email delivery (confirmations, alerts and, if the business uses them, its email campaigns).
  • Artificial intelligence providers chosen by each business (section 7).
  • The tools the business connects (its online store, payment gateways, shipping carriers, calendar, CRM): they receive only what’s needed for the integration the business requested.

We may also hand data over to authorities when a law or court order requires it.

9. Data stored outside Colombia

Several of these providers store or process data on servers located mainly in the United States. When data goes to a processor in another country, it is a transmission: we do it under contracts that require the provider to use it only to provide us the service and to protect it, in accordance with Article 26 of Law 1581 of 2012 and Decree 1377 of 2013. By accepting this policy, you authorize that transmission.

10. Your rights

As the owner of your data, you have the right to:

  • Access, update and correct your data.
  • Request proof of the authorization you gave us.
  • Know how we have used your data.
  • Revoke your authorization or ask us to delete your data, when there is no legal or contractual duty to keep it.
  • Check your data free of charge at least once a month and every time this policy changes.
  • File complaints with Colombia’s Superintendency of Industry and Commerce (SIC), after first submitting your inquiry or complaint to us.

11. How to exercise them and how fast we respond

Email us at [email protected] with your name, how to reach you, what you’re requesting and, if you’re a customer of a business that uses SixFlow, the business name and your number or username. We may ask for some information to confirm it’s you (or that you represent the data owner).

  • Inquiries (finding out what data we have and how we use it): we respond within 10 business days at most. If we can’t, we’ll tell you why and respond within 5 more business days at most.
  • Complaints (correcting, updating, deleting or revoking authorization): we respond within 15 business days at most from the day after we receive it. If we can’t, we’ll tell you why and respond within 8 more business days at most. If the complaint is missing information, we’ll ask for it within the next 5 days; if we don’t receive it within 2 months, we’ll consider it withdrawn.

While we resolve a complaint, we mark your data as “complaint in progress”.

12. How to ask us to delete your data

  1. Email us at [email protected] with the subject “Delete my data”.
  2. Tell us who you are: if you requested a demo, your name and WhatsApp number; if you’re a customer of a business that uses SixFlow, the business name and your WhatsApp number, Instagram username or Facebook name.
  3. We delete your conversations, comments and contact details within 15 business days at most and confirm by email. If a law requires us to keep something (for example, an invoice), we’ll tell you what and for how long.

If you’re a business and you remove SixFlow’s permission in your Facebook or Instagram settings, Meta notifies us and we delete the stored permission and the stored comments for your account. All the steps are at sixflow.co/en/delete-data.

13. How long we keep data

  • People who request a demo and don’t sign up: up to 2 years from the last contact, unless you ask us to delete it sooner.
  • Client businesses: for as long as the service lasts. When it ends, we hand the business its contacts and chat history in standard formats and delete its information from the platform within the following 30 days. Invoices and accounting records are kept for as long as the law requires (up to 10 years).
  • The businesses’ customers: for as long as the business decides while it uses SixFlow, and at most up to 30 days after the service ends.
  • Backups: deleted automatically within 30 days at most. System technical logs are deleted automatically in about two weeks.

14. Security

We protect data with encrypted connections (HTTPS), permissions and access keys stored encrypted, separation of each business’s information, access restricted to staff who need it, and daily encrypted backups. No system is 100% foolproof: if an incident affects your data, we will notify those affected and the Superintendency of Industry and Commerce as the law requires.

15. Cookies and browser storage

This site does not currently use advertising or analytics cookies. It saves a few preferences in your browser (light or dark theme, currency, what you filled in on the quote builder) and the source of your visit (campaign or ad, with no personal data), so we know which channel brought us your request. If we turn on measurement or advertising tools in the future (such as Google or Meta), they will stay off until you give your consent. You can clear all of this from your browser settings.

16. Minors and sensitive data

SixFlow is a service for businesses and this site is not directed at anyone under 18. We don’t ask for sensitive data (health, origin, beliefs, biometrics, among others) and you are not required to provide it. If a business processes sensitive data or data about minors through SixFlow (for example, a clinic), it is responsible for obtaining the special authorization the law requires and for respecting the best interests of children and adolescents.

17. Changes to this policy

If we make material changes to this policy, we’ll publish them here with the new date and notify client businesses by email before they take effect. The databases will remain in effect for as long as the purposes described here apply.

Please also read SixFlow’s terms and conditions.

Back to home