Legal Center
Privacy Policy
How WorkFlicks collects, uses, shares, retains and deletes personal data across the marketing website, the WorkFlicks CRM and the messages the CRM sends on our customers’ behalf.
This policy is issued by JINS MATHEW (GSTIN 32DFUPM8363E1Z1), trading as WorkFlicks, of Cherukarayalunkal, Channaplavu, Koruttodu, Kottayam, Kerala 686513, India.
In short: we collect the minimum a feature needs, we never sell personal data, and we act only as a processor for the contact records our customers keep inside their own workspace.
If you received a WhatsApp or email message from a business using WorkFlicks and want it to stop, reply STOP to that conversation, or email us and we will erase your details from our systems.
Section 01
Who we are and who this policy covers
This policy is issued by JINS MATHEW, a proprietorship registered in India under GSTIN 32DFUPM8363E1Z1, trading as WorkFlicks (“WorkFlicks”, “we”, “us”). The principal place of business is Cherukarayalunkal, Channaplavu, Koruttodu, Kottayam, Kerala 686513, India.
You can reach us at hello@workflicks.online or +91 94953 51619. The same inbox handles privacy requests and grievance escalations.
It applies to three things, which are described separately below because our role in each is different: the public marketing website at workflicks.online, the WorkFlicks CRM application at app.workflicks.online, and the outreach messages that the CRM sends on a customer’s behalf over the WhatsApp Business Platform and email.
- Website visitors and enquiry submitters — we are the data controller.
- CRM account holders (our paying customers and their team members) — we are the data controller for account, billing and usage data.
- Contacts stored inside a customer’s CRM workspace — the customer is the controller and WorkFlicks acts as their processor, handling that data only on their instructions.
Section 02
Operator identity (for verification)
The following details identify the person who operates workflicks.online and app.workflicks.online. They match the GST registration certificate (Form GST REG-06) used for business verification with Meta and other partners.
- Legal name: JINS MATHEW
- Trade name: WorkFlicks
- Constitution of business: Proprietorship
- GSTIN: 32DFUPM8363E1Z1
- Principal place of business: Cherukarayalunkal, Channaplavu, Koruttodu, Kottayam, Kerala 686513, India
- Phone: +91 94953 51619
- Email: hello@workflicks.online
Section 03
Personal data we collect
We collect only what a feature needs to function. We do not buy personal data, and we do not sell personal data to anyone.
- Account data: name, work email address, password hash or federated identity (for example a Google account identifier), workspace name, team member roles and preferred currency.
- Enquiry data: the business name, category, city, website or social profile, email address, WhatsApp number, budget range and message you submit through our audit or contact forms.
- Billing data: subscription plan, billing status, renewal dates, invoice records and the last four digits and brand of a card. Full card numbers are entered on our payment provider’s systems and never reach WorkFlicks servers.
- Workspace contact data: the business records a customer sources or imports into their CRM — typically business name, category, address, phone number, website, public rating and any notes or pipeline stage the customer adds.
- Message data: the content, timestamps, direction and delivery status of WhatsApp and email messages sent or received through the workspace, including inbound replies from a customer’s contacts.
- Technical data: IP address, browser and device type, pages viewed, referring page, and security and error logs.
Section 04
Business records sourced from public places
The CRM’s lead sourcing feature retrieves business listing information — such as business name, category, address, publicly listed phone number, website and public review rating — from Google Maps and equivalent public business directories. These are business contact details published by the business itself for the purpose of being contacted.
Where such a record identifies an individual (for example a sole trader whose business number is also their personal number), it is personal data and is treated as such under this policy. The customer who sourced the record is its controller and is responsible for having a lawful basis to contact that business, for honouring opt-out requests, and for complying with local marketing and anti-spam law.
- We do not scrape private profiles, logged-in areas, or content behind authentication.
- We do not collect special category data (health, biometric, political, religious or similar) through lead sourcing.
- Any business can ask to be removed from our systems entirely — see the data deletion section.
Section 05
WhatsApp Business Platform and Meta
When a customer connects a WhatsApp Business account, WorkFlicks sends and receives messages through the official WhatsApp Business Platform (Meta Cloud API). We are not affiliated with, endorsed by, or a partner of Meta Platforms, Inc. beyond being a user of that platform.
To deliver a message we transmit the recipient’s phone number, the message body or approved template and its variables, and the sending business’s WhatsApp phone number identifier to Meta. Meta returns message identifiers and delivery, read and failure receipts, which we store against the conversation so the customer can see what happened. Meta’s own handling of that data is governed by Meta’s terms and privacy policies, not by this one.
We store message content so that customers have a conversation history and so that automated sequences can stop when a person replies. We do not use the content of customer conversations to train AI models, and we do not read conversations except where strictly necessary to investigate a fault, respond to a support request, or comply with law.
- Outbound business-initiated messages use only message templates that Meta has reviewed and approved.
- Free-form replies are sent only inside the 24-hour customer service window that opens when a contact messages the business first, as the platform requires.
- Recipients can stop messages at any time by replying with an opt-out word such as STOP; the conversation is then marked opted-out and further automated messages are suppressed.
- We enforce per-account daily sending limits to protect recipients from bulk unsolicited messaging.
Section 06
AI features
The CRM can score a lead and draft a suggested reply. These features run only when a customer supplies their own Google Gemini or OpenAI API key, and only on the records the customer asks us to process. The relevant text is sent to the provider the customer chose, under that provider’s terms and the customer’s own account with them.
AI output is a suggestion. It is presented for a human to review, edit and approve before anything is sent. No automated decision with a legal or similarly significant effect on an individual is made by these features.
Section 07
How and why we use personal data
Where the General Data Protection Regulation or a similar law applies, our legal bases are: performance of a contract, our legitimate interests in operating and securing the service, compliance with a legal obligation, and consent where consent is the appropriate basis (for example non-essential cookies).
- To create and secure accounts, authenticate sessions and prevent unauthorised access.
- To provide the features a customer has subscribed to, and to enforce that subscription’s limits.
- To send messages a customer has instructed us to send, and to record their delivery outcome.
- To take payment, issue invoices and keep the accounting records we are legally required to keep.
- To provide support, investigate faults and maintain audit and security logs.
- To respond to an enquiry you submitted and to scope work you asked us to quote for.
- To detect, investigate and stop abuse, spam, fraud and violations of our acceptable use rules.
Section 09
International transfers
WorkFlicks operates from India and uses providers hosted in other countries, including the United States and the European Union. Where personal data moves out of its country of origin we rely on the transfer mechanism made available by the receiving provider, such as the European Commission’s Standard Contractual Clauses, together with our own technical safeguards including encryption in transit and access control.
Section 10
How long we keep data
We keep personal data only as long as it serves the purpose it was collected for, then delete or anonymise it.
- Workspace contact and message data: for the life of the subscription, then 30 days after the account is closed, after which it is deleted.
- Account data: for the life of the account, then up to 90 days to handle reactivation and disputes.
- Billing and invoice records: as long as tax and accounting law requires, which is normally up to eight financial years.
- Security, error and audit logs: normally up to 12 months.
- Website enquiry submissions: up to 24 months from the last contact, unless a project relationship starts.
- A verified deletion request overrides these periods except where we must retain a record by law.
Section 11
How we protect data
The service runs on Cloudflare’s network with TLS encryption in transit and encryption at rest for stored data. Access to production systems is restricted, authenticated and logged. Every workspace is logically separated, and a request is authorised against the signed-in identity before any record is read or written.
API keys and access tokens are stored as encrypted secrets and are never displayed back in full. No system can be guaranteed absolutely secure; if a breach affects your personal data and the law requires notification, we will notify you and the relevant supervisory authority within the applicable deadline.
Section 12
Your rights
Depending on where you live you may have the right to access a copy of your personal data, correct it, delete it, restrict or object to its processing, withdraw consent, receive it in a portable format, and complain to a supervisory authority. Residents of India have equivalent rights under the Digital Personal Data Protection Act, 2023, including the right to nominate another person to exercise their rights.
To exercise a right, email hello@workflicks.online from the address associated with your record, or use the in-app controls. We respond within 30 days and may need to verify your identity first. If you are a contact stored inside a customer’s workspace rather than our own account holder, we will pass your request to that customer, who is the controller, and support them in answering it.
If you are unhappy with our response you can escalate to our grievance contact at hello@workflicks.online, and then to your local data protection authority.
Section 13
How to delete your data
You can delete your own data at any time, and there is no charge for doing so.
- Individual records: open the record in the CRM and choose Delete. This removes it and its message history from the workspace.
- A whole workspace and account: go to Settings, then Danger Zone, then Delete workspace. This schedules irreversible deletion of every contact, conversation and message in that workspace and cancels the subscription.
- If you cannot sign in, or you are a message recipient rather than an account holder, email hello@workflicks.online with the phone number or email address you want erased and we will locate and delete it.
- Deletion completes within 30 days across live systems and backups, except for records we must keep by law, such as invoices.
Section 14
Children
WorkFlicks is a business tool sold to businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If we learn that we hold such data we delete it. Customers must not use the service to send marketing messages to children.
Section 16
Changes to this policy
We update this policy when the product, our providers or the law changes. The revision date at the top always reflects the current version. If a change materially reduces your rights or materially changes how we use your data, we will notify account holders by email or in-app notice before it takes effect.
Section 17
Contact us
Privacy questions and rights requests: hello@workflicks.online. Grievance escalation: hello@workflicks.online. General contact: hello@workflicks.online, or +91 94953 51619. Postal enquiries can be addressed to JINS MATHEW, trading as WorkFlicks, Cherukarayalunkal, Channaplavu, Koruttodu, Kottayam, Kerala 686513, India.