What we store, for how long, and why
This covers data about you as a Channelflow customer. Data about your channel subscribers stays with Telegram — we never receive it.
We keep your account details, your prompts, and the posts that passed through a flow. Message bodies are deleted 30 days after publishing. We have never received a government request, and if we do we will say so here.
What we collect
Three kinds of data, and nothing else: account data you type, content data your flows process, and technical logs the service produces while running.
Why we are allowed to hold it
Account and content data is processed to perform the contract you signed up to. Technical logs are processed on legitimate interest — keeping the service secure and debuggable. Marketing email only ever goes out with explicit consent, and the unsubscribe link works in one click.
How long we keep it
Shorter than you might expect, on purpose.
Who else touches it
Sub-processors are listed in full in the DPA, with the region each one runs in. The short version: infrastructure in the EU, model providers for translation and rewriting, a payment processor, and an email sender. No advertising networks, ever.
Where it lives
Primary storage and processing is in Frankfurt, with backups in Ireland. Enterprise customers can pin processing to the EU only, which limits which model providers are available — we will tell you which ones drop out before you sign.
Your rights
You can ask for a copy of everything we hold, correct anything wrong, or have it deleted. Requests go to privacy@channelflow.io and are answered within 30 days, usually within two working days.
If we handle a request badly you can complain to the Spanish AEPD, or to your own national authority.