Privacy · BeartFlow
This policy explains what information BeartFlow processes, why, who it is shared with and how you can control or delete your data, including data received from Instagram, Facebook Messenger and WhatsApp.
This is an English translation provided for convenience. The Spanish version is the official text and prevails in case of any discrepancy.
We use the data needed to provide BeartFlow to your business, protect it and meet our obligations. We do not sell personal data, we do not use it for advertising, and you can disconnect your channels or request deletion of your data at any time.
Summary of how BeartFlow processes information. The details are in sections 01 to 10.
Account: contact name, email, phone, company and an optional profile image. Meta channels: messages, identifiers and names of the people who write, profile information Meta provides and identifiers of the page, Instagram account or WhatsApp number; access tokens are stored encrypted. Usage: technical logs (IP, browser, events). Cookies: only the session cookie.
Providing the inbox, generating AI replies when the customer enables them, handing the conversation over to a person, protecting the platform, offering support and complying with the law. We do not sell data or use it for advertising.
Only with necessary providers (processors): Meta (messaging channels), the enabled AI provider (xAI or Cloudflare Workers AI), Cloudflare (infrastructure: hosting, database, files, transactional email, network and security), the payment providers (PayPal, NOWPayments, VEXPay), Google (reCAPTCHA and, if you connect them, Calendar and Sheets), Hostinger (beartflow.app mailboxes), and when required by law.
While the account is active; if the service ends, at most 90 days afterwards. We use HTTPS, hashed passwords, encrypted tokens and data separation per company.
Access, correction, deletion, export (portability), withdrawing consent and disconnecting channels. You can delete the account in Configuración → Eliminar cuenta (Settings → Delete account) or write to info@beartflow.app.
Instructions to delete it in Data deletion. BeartFlow is not directed at minors and we will announce changes on this page.
Francisco Pino, RIF 19819344-1, domiciled in Bello Monte, Caracas, Venezuela, is the controller of the personal data processing carried out in BeartFlow, Beart's service available at beartflow.app. BeartFlow is a product (sub-brand) of Beart Marketing (Beart Agencia), operated by Francisco Pino from Caracas, Venezuela. In this policy, “Beart”, “we”, “us” or “our” refers to that operator. Contact: info@beartflow.app.
This policy applies to the BeartFlow website and web application at beartflow.app, to customer company accounts and to the channels the customer connects (Instagram, Facebook Messenger and WhatsApp Business). Third-party platforms are also governed by their own terms. Use of the service is also governed by the BeartFlow Terms of Use.
When BeartFlow processes a customer business's messages and contacts, that customer decides the purpose and acts as controller; Beart provides the service as processor or service provider, in accordance with applicable law and the contract.
Company name, contact name, email address, phone, optional profile image, password (stored only as a salted hash), role, sessions and activity logs needed for security and support.
Services, frequently asked questions, tone, rules, welcome and handoff messages, keywords and other instructions the customer defines for its assistant.
Contacts, conversations, messages, notes and lead statuses the customer receives or records in its inbox, including the data received from Meta described in section 09.
Plan, amount, gateway, status and receipt number of each payment. Payment details (card, PayPal account or crypto wallet) are entered in PayPal, NOWPayments or VEXPay; BeartFlow does not store them.
IP address, browser, dates and technical events logged by the server and the delivery network for operation, security and abuse prevention.
Do not request or upload sensitive or high-risk data to BeartFlow —medical, biometric or full financial information, passwords, data about minors or government identifiers— unless there is a legitimate need and a written agreement with specific measures.
| Purpose | Typical data | Legal basis |
|---|---|---|
| Creating and managing the account and authenticating its users. | Account, protected credentials and sessions. | Performance of the contract. |
| Providing the service: inbox, replies, AI assistant and handoff to a person. | Customer Data, configuration and data from connected channels. | Performance of the contract and the customer's documented instructions. |
| Protecting the platform and preventing abuse, fraud or unauthorized access. | IP, device, logs and activity. | Legitimate interest and security. |
| Handling support, privacy requests and legal obligations. | Contact details, communications and minimal logs. | Legal obligation, contract and defense of rights. |
BeartFlow does not sell personal data, and does not use it for advertising or to build commercial profiles unrelated to the customer's service.
We share only the minimum information necessary with providers bound by their contracts and security measures:
Some providers or data centers may be located in the United States or other countries with privacy rules different from those where you live. Where required by law, we will use contracts or other valid mechanisms to protect that data. We may also disclose data if a valid law or order requires it.
The BeartFlow application uses one necessary session cookie (HttpOnly, SameSite=Strict and Secure) to keep you signed in for up to 12 hours, or 30 days if you choose “Recuérdame” (Remember me) when signing in. BeartFlow does not use third-party advertising or analytics cookies in the application. You can delete or block cookies in your browser; without the session cookie you will not be able to sign in.
In addition, the website and the application store preferences in your browser's local storage (localStorage and sessionStorage), such as the chosen language (Spanish or English), inbox filters and unsent drafts. These are not cookies, are not used for advertising or analytics, and you can delete them from your browser.
We keep data while the customer's account is active and for the time needed for the purposes described, legal periods or dispute resolution. The specific periods for Meta data and for the end of the service are stated in sections 09 and 10. Backups are overwritten in their rotation cycle, which does not exceed 90 days.
We apply technical and organizational measures proportionate to the risk: encrypted connections (HTTPS), hashed passwords, access tokens encrypted at rest, data separation per company, access control and logs. No system is infallible; if an incident affects personal data, we will investigate it, limit its effects and notify when required by law.
Depending on your location and applicable law, you may request:
Write to info@beartflow.app with the subject “Solicitud de privacidad BeartFlow” (BeartFlow privacy request), stating the right you wish to exercise and the information needed to locate your data. We may reasonably verify your identity before replying. If you wrote to a business that uses BeartFlow, you can also contact that business, which is responsible for the conversation.
BeartFlow is intended for companies and professionals; it is not designed to knowingly collect data from children under 13. Customers must not use it to direct services to minors without a legal basis and adequate protections.
We may update this policy when the service, providers or legal requirements change. We will publish the current version at this URL and update the date above. If you are not satisfied with our response, you may complain to the competent authority in your jurisdiction where that right exists.
BeartFlow (beartflow.app), also presented as Beart Flow, is Beart's tool that lets a customer business handle, in a single inbox, the messages of its Instagram professional account, its Facebook Page (Messenger) and its WhatsApp Business number, with manual replies or with an artificial intelligence assistant configured by the customer itself. BeartFlow connects to those platforms through the Meta app BEARTFLOW APP and only receives the data the customer authorizes when connecting each channel. Regarding its contacts' messages, the customer acts as controller and Beart as processor or service provider.
| Source | Data BeartFlow receives |
|---|---|
| Customer account (Instagram, Facebook Page, WhatsApp Business) | Identifier and username of the Instagram professional account; identifier and name of the Facebook Page; phone number identifier, display number, verified name and WhatsApp Business account (WABA); access tokens granted by Meta, which we store encrypted. |
| Direct messages (Instagram, Messenger, WhatsApp) | The person's identifier on Instagram or Messenger (assigned by Meta) or their phone number on WhatsApp; display name and, when Meta provides it, profile photo; text content of the messages, button replies and date and time. We do not download or store attachments, photos, audio or video: when non-text content arrives, we only store an “unsupported content” notice so the business can review it in the Meta app. If a customer unsends an Instagram message, BeartFlow replaces the stored text with an “unsent message” placeholder and does not process it with AI. |
| Instagram comments | Text and identifier of comments posted on the customer's posts, identifier and username of the commenter, and date and time, to detect keywords defined by the customer. |
| WhatsApp with coexistence | If the customer connects the number it uses in the WhatsApp Business app and agrees in Meta to share them: contacts from that app (number and name), chat history Meta sends after connection and the messages the customer sends from its phone. |
Showing the conversations in the customer's inbox; sending the replies written by the customer or its AI assistant; replying privately and publicly to comments containing a keyword; if the customer enables "Reply to other comments with AI", replying with AI publicly (and, if enabled, also by private message) to Instagram comments that do not contain a keyword, using the comment text and the post caption; handing the conversation over to a person when the end customer asks for one or the assistant should not reply. We only reply to messages started by the person, within Meta's messaging windows.
If the customer enables the assistant, the recent text of the conversation (or the comment and the post caption) and the business's instructions are sent to xAI (xAI API) or to Cloudflare Workers AI, depending on the assistant's configuration, solely to generate the reply. Beart does not use this data to train its own models, nor does it authorize its use for general training when the provider allows opting out. Sensitive topics are routed to a person, and the assistant always agrees to hand over to a person on the team when the end customer asks for one.
"Report reply": if a user of the business reports an AI reply from the panel, we send an email to info@beartflow.app with the reported reply, the end customer's message right before it with sensitive data masked (cards, codes, passwords) and the user's optional comment, to review and improve the assistant. BeartFlow does not store the report in its database.
We do not sell or rent data from Meta's platforms, we do not use it for advertising, commercial profiling or purposes unrelated to the customer's service, and we do not share it with third parties except the necessary providers in section 04 (Cloudflare as infrastructure, transactional email and Cloudflare Workers AI, xAI as AI provider, the payment providers, Google when the customer connects Google Calendar or Google Sheets, and Hostinger for the mailboxes), each only with the data its role needs, and when required by law.
BeartFlow writes to the calendar the customer chooses: for each new lead, an all-day event with the Instagram username or the name, the phone number (or «sin teléfono»), the channel and the text of the message it was captured from (the customer can turn this off in the Google Calendar settings); for each booked appointment, an event with the service, the name, the phone number, the channel and a link to the conversation in BeartFlow. To offer time slots it only reads busy intervals, without the details of other events. If the appointment is cancelled, its event is deleted.
Encrypted connections (HTTPS); access tokens encrypted at rest; verification of Meta's signature on every webhook; data separation per customer company; Beart team access only for support or security, with limited permissions.
Retention. We keep this data while the customer's account and the channel connection are active. When a channel is disconnected, BeartFlow stops receiving and sending messages through it and stops using its token; conversations already received remain in the customer's account until the customer deletes its account or requests their deletion. If the service ends and the customer did not delete its account, we will delete its data at most 90 days after termination. Backups are overwritten in their rotation cycle, which does not exceed 90 days.
Your rights. You can request access, correction, deletion or information about your data as described in sections 07 and 10. If you wrote to a business that uses BeartFlow, you can also contact that business, which is responsible for the conversation.
The use of data received from Meta's platforms complies with the Meta Platform Terms and the WhatsApp Business policies.
Instructions to delete the data BeartFlow obtains from Instagram, Facebook Messenger and WhatsApp. URL of these instructions: https://beartflow.app/privacidad/#eliminacion-de-datos.
Go to BeartFlow → Conexiones (Connections) and press Desconectar (Disconnect) on Instagram, Facebook Messenger or WhatsApp. We stop receiving and sending messages through that channel and delete its access token. To delete everything, go to Configuración → Eliminar cuenta (Settings → Delete account): your company's users, profile, contacts, conversations, messages, connections and tokens are deleted.
Facebook: Settings & privacy → Settings → Business integrations and remove “BEARTFLOW APP”. Instagram: Settings → Apps and websites and remove “BEARTFLOW APP”. WhatsApp: in Meta Business Suite / WhatsApp Manager remove the partner's access, or disconnect from the WhatsApp Business app. When you remove the app on Instagram, Meta notifies us and we disconnect the account and delete its token automatically. If you ask Instagram to delete your data, we delete that account's data in BeartFlow (the connection and its token or, if you messaged a business, your Instagram conversations) and Meta shows you a confirmation code and a link to check the status.
Write to info@beartflow.app with the subject “Eliminación de datos BeartFlow” (BeartFlow data deletion), stating the channel (Instagram, Messenger or WhatsApp), your username or number and, if you wrote to a business, its name. This also works if you cannot sign in to BeartFlow.
We acknowledge receipt within 5 business days at most, may reasonably verify your identity and complete the deletion within 30 days at most. We send you a confirmation with a request number. Backups are overwritten in their rotation cycle.
Deletion in BeartFlow does not erase the copy that Instagram, Messenger or WhatsApp keep in their own applications; that copy is managed by Meta under its policies. We may keep minimal technical logs for a limited time, without message content or tokens, when security or the law requires it.
The terms governing the use of BeartFlow (service, acceptable use, AI replies, payments, suspension, termination, liability and governing law) are published on their own page: BeartFlow Terms of Use.
Write to us and we will reply within the timeframes stated in this policy.