Home
Legal
Privacy

Privacy Policy

Last updated: November 2, 2026

This policy explains, in plain terms, what RSFlowHub collects, where your data goes, how long we keep it and how you can get it exported or deleted. If something here does not match what you see in the product, please tell us at support@rsflowhub.com.

RSFlowHub is operated from India.

1. The short version

We never use your requests or results to train AI models, and we never sell your data.
Text you send to an AI endpoint is forwarded to the AI provider for that endpoint only to produce your result (see section 4).
Our request logs store metadata (endpoint, character and token counts, credits, status, latency, request ID). They do not store your request text or the result.
Some endpoints keep a cache of identical requests for up to 24 hours so repeats are faster and free (see section 5). This is not “zero data retention”, and we do not claim it is.
Content you choose to save (knowledge bases, documents, chatbots, conversations, leads, form messages) is kept until you delete it or until the retention period you set.

2. What we collect

Account details: name, email address, password (stored only as a one-way hash), country, and optionally a phone number for verification. If you sign in with Google or GitHub we receive your name, email and profile ID from them.
Billing details: the plan you bought, amounts, payment status and, if you add them, billing name, address and GSTIN. Card and bank details are entered on Razorpay’s checkout and never reach our servers.
API request metadata: for every API call we log the endpoint, which API key was used, input and output size, credits charged, status, latency and a request ID. This is what powers your usage dashboard and billing.
Content you save: knowledge-base documents and the text chunks made from them, FAQ collections, chatbot settings, chat conversations, widget leads and tickets, form submissions and newsletter subscribers.
Messages to us: what you send through the contact form, support chat, support tickets (including files you attach) or email.
Lookups in a business’s chatbot: a business can connect its own system to its chatbot. If you ask such a chatbot about your order or booking and give a reference number, phone number or email address, we send them to that business’s system to get your answer. The business handles them under its own privacy policy. We keep your phone number or email masked in the conversation, keep only a short note of the answer and do not send either to our AI providers.
Technical data: IP address, browser and device information, used for security, rate limiting and abuse prevention. Our website uses Google Analytics to count visits, only after you accept analytics cookies (see the Cookie Policy).
Visit counts on our website: our own cookieless counter records each page view on our public and sign-in pages: the page address (without query details), the website you came from (its domain only), campaign tags in the link (utm_*), your country as reported by our network provider, and your device type, browser and operating system family. It sets no cookie, stores nothing in your browser and does not store your IP address or full browser details; a code made from them with a random key that changes every day lets us count visitors per day without recognising you on another day. It is switched off when your browser sends Do Not Track or Global Privacy Control, and the records are deleted after 395 days.
Promoter program: if you sign up through a promoter’s link, your account records which promoter referred you. The promoter sees a shortened form of your first name and email address, your signup date and the commission they earned on your payments; never your plan, usage or payment details. To stop abuse of the program we keep a keyed code made from your IP address at signup (never the address itself) for 90 days, and compare it with the promoter’s own codes. If you apply to be a promoter, we keep the channel, link and description you give us, a count of clicks on your link and your commission records (kept as financial records even if you delete your account).
Try-it demo on the industry pages: pages like /ai-chatbot-for/coaching-institutes let you type your own business details and chat with the chatbot built from them, no account needed. The details are used only to answer your questions in that demo and are kept in a temporary cache (a short-lived store, which on our servers is a table that expires entries) for 24 hours; they are never attached to a user account or kept as a record, and your messages are not used for advertising. A code made from your IP address with a daily-changing key counts demos and messages only for rate limits. If you choose to sign up afterwards, the session cookie carries a reference to your demo so the set-up form can show the same details — the details themselves never go into a link or a cookie.

3. How we use it

To run the service: answer API calls, run your chatbots and forms, and show your dashboard.
To bill you correctly and keep the records tax law requires.
To keep the platform secure: detect abuse, enforce rate limits and investigate incidents.
For team accounts: the account owner can invite people to work in the account. Members see and change the account’s data that their role allows (for example API keys, usage, knowledge bases, chatbots, forms or billing), and the owner and team admins see a log of member actions. Visitor personal data (widget leads and tickets, form messages and subscribers) is shown only to the owner and team admins. Your own profile, password and notification settings are never shared with a team. An owner can hand the account, with its data, plan, credits and payment records, to a team member; both people are emailed when that happens.
To send service emails (sign-in codes, receipts, API-key changes, low-credit and limit alerts you can control in Settings, and notices about outages, fixes and changes that affect your account). Product news is sent only if you opt in.

4. Who processes your data (sub-processors)

We use these third parties to run RSFlowHub. Each receives only what it needs for its job.

AI model providers — OpenAI, Google (Gemini), DeepSeek and xAI (Grok). The text of an API request is sent to the provider configured for that endpoint, or to a backup provider if the first one fails (automatic fallback). Each provider handles that data under its own API terms; we use their business APIs, not consumer chat apps.
Embeddings provider — Perplexity. When you upload a document to a knowledge base, its text chunks are sent to create search vectors.
Vector database — knowledge-base vectors are stored in a Postgres database (hosted by Supabase or on our own server).
Payments — Razorpay processes all payments.
Email and SMS delivery — our email delivery provider sends service emails; MSG91 or Twilio send phone verification codes.
Sign-in — Google and GitHub, only if you choose to sign in with them.
Analytics — Google Analytics on our public website, only if you accept analytics cookies.
Internal alerts — our team receives operational notifications (new sign-ups, payments, errors) through Telegram. These contain account identifiers, not your API request text.
Hosting — our application and main database run on a virtual private server.

5. Caching

To make repeated calls faster and free, some AI endpoints store the result of a request for up to 24 hours, keyed by a hash of the request. If the same request arrives again within that time, the stored result is returned. For endpoints that generate personal content (such as email replies and content generation) the cache is scoped to your account only. Chat and image generation are never cached. Cached results expire automatically.

6. How long we keep data

API request metadata and credit history: while your account exists, so your usage and billing history stay accurate.
Cached AI results: up to 24 hours.
Chat widget and Forms data: the retention period you choose (30, 90, 180 or 365 days, or until you delete it). Older data is deleted every night.
Try-it demo details: the business details typed into the industry-page demo expire from the cache after 24 hours and are not attached to an account; only anonymous counts (demos, messages, clicks) remain.
Knowledge bases, documents and chatbots: until you delete them.
Sign-in codes: deleted shortly after they expire.
Payment and invoice records: for as long as Indian tax and accounting law requires, even after account deletion.

7. Your rights and choices

Access and export: download a copy of your account data any time from Settings → Security → Your data. Chat widget and Forms owners can export or erase a visitor’s data themselves from the dashboard.
Correction: update your profile and billing details in Settings, or ask us.
Deletion: delete your account yourself from Settings → Security → Your data. It takes effect immediately: your API keys, knowledge bases and documents, chatbots, conversations, leads, tickets, forms, messages, support tickets and their attachments, subscribers, usage logs and unused credits are removed, and your name, email and phone number are erased from the account. Payment records and invoices are kept as tax law requires, and a welcome-bonus phone record is kept to prevent repeat claims. Deleting your account also removes you from every team you belong to; if you own a team account, remove its members first. If you cannot sign in, email support@rsflowhub.com from your account email and we will delete it within 30 days.
Email preferences: manage low-credit and limit alerts and product news in Settings → Notifications.

8. Security

All traffic uses HTTPS. API keys are stored only as SHA-256 hashes, so we cannot read them back; you can revoke any key at any time, which disables it immediately. Read more on our Security page.

9. Children

RSFlowHub is a developer and business service and is not meant for anyone under 18.

10. Changes to this policy

When we change this policy we update the date at the top of this page. The date changes only when the text changes.

11. Contact

Privacy questions and requests: support@rsflowhub.com
Security issues: security@rsflowhub.com