FeedbackFlow FeedbackFlow ← Back to home

Privacy Policy

Last updated: October 23, 2026 · feedbackflow.co.ke

1. Introduction and Who We Are

FeedbackFlow is operated by Mediadev Solutions (“FeedbackFlow,” “we,” “our” or “us”). We provide a platform that lets businesses, such as short-stay hosts and hotels (our “Clients”), communicate with their guests and customers and collect feedback through WhatsApp (the “Service”). This Privacy Policy explains what personal data we collect, how we use and protect it, and the choices you have.

We act in two roles:

  • Controller. We decide how we use the account, billing, usage and technical data of our Clients and website visitors, and the access credentials we receive from Meta to operate the Service.
  • Processor. We handle the personal data of our Clients’ guests and customers (“End Users”) only on behalf of, and on the instructions of, the Client who collects it.

FeedbackFlow is an independent software provider that uses the WhatsApp Business Platform (Cloud API) provided by Meta. We are not Meta or WhatsApp, and we are not affiliated with or endorsed by them.

By using the Service you agree to this policy. If you do not agree, please stop using the Service.

2. Information We Collect

2.1 Account and registration data (Clients)

  • name, email address and phone number
  • business name and contact details
  • billing and payment information, processed by third-party payment processors
  • WhatsApp Business Account (WABA) ID and phone number ID

2.2 Platform usage data (Clients)

  • messages sent and received through the platform
  • campaign details such as name, schedule and recipient count
  • message templates you create and submit
  • contact lists and audience segments you upload
  • chatbot conversation logs
  • booking and feedback records

2.3 Technical and log data

  • IP address, browser type and device information
  • pages visited, features used and session duration
  • error logs and crash reports
  • API request and response logs

2.4 End User data (your guests and customers) When an End User receives a message through the Service or chats with a Client’s WhatsApp number, we process their WhatsApp phone number, their profile name where WhatsApp provides it, the content of their messages (including ratings and written feedback), and metadata such as delivery status and timestamps. We process this data only on the Client’s behalf.

3. How We Use Information and Our Legal Bases

We use information to:

  • provide, operate and maintain the Service (to perform our contract with you);
  • send and receive WhatsApp messages on your behalf through Meta’s Cloud API (contract);
  • run campaigns, chatbot flows and feedback collection (contract);
  • authenticate users and keep sessions secure (contract and our legitimate interests);
  • process billing and subscriptions (contract and legal obligation);
  • send transactional emails such as account alerts and password resets (contract);
  • analyze usage to improve features and performance (our legitimate interests);
  • comply with legal obligations and Meta’s policies (legal obligation and legitimate interests); and
  • respond to support requests (contract and legitimate interests).

Where we rely on consent, we will say so when we ask, and you can withdraw it at any time.

For End User data, the Client decides why and how it is used and is responsible for having a lawful basis and any required consent. We do not use End Users’ WhatsApp messages for advertising, and we do not sell personal data.

4. WhatsApp and Meta Data

We connect your WhatsApp Business Account to the Service to enable automated messaging, templates and chatbot interactions.

What we access through the WhatsApp Business Platform

  • your WABA ID and associated phone numbers
  • message templates you create and submit for Meta’s approval
  • inbound and outbound message content and delivery status
  • webhook events from Meta, such as message received, delivered and read

How we connect. You may give us your WhatsApp Business Account details directly or connect through a Meta flow such as Embedded Signup. In a Meta connection flow, we receive a temporary authorization code, which we exchange for an access token. We store access tokens encrypted and use them only to operate the WhatsApp Business Platform for you. You can revoke our access at any time in your Meta Business settings or WhatsApp Manager.

Our commitments. We use data we receive from Meta only to provide the Service, in line with the WhatsApp Business Policy and Meta Platform Terms. Message content travels over TLS-encrypted connections. We do not read or analyze End User message content beyond what is needed to operate the Service.

5. How We Share Information

We share data only in these cases.

5.1 Meta and WhatsApp. To deliver messages, data is sent to Meta’s WhatsApp infrastructure. Meta handles it under its own terms and privacy policy.

5.2 Service providers (sub-processors). We use:

  • Render, for application hosting and database;
  • email delivery providers, for transactional email; and
  • payment processors, for billing and subscriptions.

They may use data only to provide their service to us, and they must protect it under written terms.

5.3 Legal requirements. We may disclose information if the law, a court order or a government authority requires it, or to protect the rights, property or safety of FeedbackFlow, our users or the public. Where lawful and practical, we will tell the affected Client first.

5.4 Business transfers. If we are involved in a merger, acquisition or sale of assets, data may transfer to the successor, which must honor this policy.

We never sell personal data, and we never share it for marketing or advertising purposes.

6. International Transfers

Our hosting provider and Meta may process data in countries outside Kenya. When personal data leaves Kenya (or the EEA or UK, for people there), we take steps to keep it protected, such as using providers with appropriate contractual and security safeguards, as the Kenya Data Protection Act, 2019 and other applicable laws require.

7. Storage, Security and Retention

Your data is stored on our hosting provider’s infrastructure in managed databases. We use these security measures:

  • data sent between your browser and our servers is encrypted with TLS 1.2 or 1.3;
  • access tokens and other sensitive credentials are stored encrypted, and passwords are stored hashed with bcrypt;
  • database access is limited to authorized systems and personnel;
  • automated backups are taken regularly;
  • session cookies use the HttpOnly and Secure flags; and
  • rate limiting applies to authentication endpoints.

No system is completely secure. If a personal data breach occurs, we will notify the people and authorities the law requires, and we will tell affected Clients without undue delay so they can meet their own obligations.

Retention

  • Account data: kept while your account is active, and deleted within 30 days after your account is deleted or terminated, unless the law requires us to keep it (for example billing and tax records).
  • Message logs: kept for 90 days by default for debugging and compliance.
  • Contacts, feedback and campaign records: kept while your account is active so you can use them, and deleted with your account.

Backup copies are overwritten in the ordinary course.

8. Your Rights

Depending on where you live, including under Kenya’s Data Protection Act, 2019 and, where it applies, the GDPR, you may have the right to:

  • be told how your data is used;
  • access a copy of the personal data we hold about you;
  • have inaccurate or incomplete data corrected;
  • have your data erased;
  • restrict how we use your data;
  • receive your data in a machine-readable format;
  • object to processing in certain circumstances;
  • withdraw consent where processing is based on consent; and
  • complain to the Office of the Data Protection Commissioner in Kenya, or the data protection authority where you live.

To use any of these rights, email admin@feedbackflow.co.ke. We may need to verify your identity first. We will respond without undue delay and within 30 days.

If you are a guest or customer of one of our Clients (an End User), the Client is responsible for your data, so please contact the business first. You can also email us, and we will pass your request to the Client and help them act on it. To stop receiving messages, ask the business to stop messaging you, or block the number in WhatsApp.

9. Requesting Data Deletion

To have your data deleted, email admin@feedbackflow.co.ke with the subject “Data deletion request.” Send it from the email address linked to your account. End Users should include the WhatsApp phone number concerned and the name of the business that messaged them.

We will delete the data within 30 days, except where the law requires us to keep it. Revoking our access in Meta’s settings stops us from using your WhatsApp account but does not by itself delete data we have already stored, so please send a deletion request if you want it removed.

10. Cookies

We use these types of cookies:

  • Session cookies: needed for sign-in and the platform to work. They expire when you close your browser.
  • Persistent cookies: remember your login for up to 7 days if you choose “Remember Me.”
  • Analytics cookies: help us understand how people use the platform. They are optional and anonymized.

You can control cookies in your browser settings. Blocking essential cookies may stop parts of the platform from working.

11. Third-Party Services

The platform works with these third-party services:

  • Meta WhatsApp Business Platform, for core messaging;
  • Render, for hosting and database; and
  • Google Fonts, for typography (your browser requests font files from Google).

Each of them has its own privacy policy, which we encourage you to read. We choose providers carefully, but their own privacy practices are governed by their policies.

12. Children’s Privacy

FeedbackFlow is a business platform for adults and businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this policy to reflect changes in our practices, technology or the law. For material changes we will update the “Last updated” date, email registered account holders, and show a notice in the app. Continuing to use the Service after changes take effect means you accept the updated policy. The latest version is always at feedbackflow.co.ke/privacy.

14. Contact Us

For questions, concerns or requests about this policy or your personal data:

  • Mediadev Solutions, trading as FeedbackFlow
  • Email: admin@feedbackflow.co.ke
  • Website: feedbackflow.co.ke

We aim to acknowledge privacy inquiries within 5 business days and to respond to rights requests within 30 days.