Privacy policy

1. Data controller

The controller of the personal data collected through this website and in our commercial relationship with our customers is Oscar Luis Berrocal Caballero, an individual who operates this platform under the trade name Lania Flow, domiciled in Caldas, Antioquia, Colombia. In this policy, “Lania Flow” refers to its owner.

• Email: info@laniaflow.com
• Phone: +57 333 401 8369
• Website: https://laniaflow.com

This policy is governed by Law 1581 of 2012, Decree 1377 of 2013, compiled in Decree 1074 of 2015, and other Colombian personal data protection rules. For people located in the European Economic Area, and for the data we process on behalf of businesses established there, it is also governed by the General Data Protection Regulation (GDPR).

2. Scope and roles

Lania Flow is a software platform used by appointment-based service businesses (the “business”) to serve their customers on WhatsApp, Instagram, Facebook Messenger and the chat and portal of their website, send them confirmation and reminder emails, and manage their appointments.

• As controller, Lania Flow processes the data of people who visit this website or contact us, the contact details of customer businesses and those of the users on their team.
• As processor, Lania Flow processes the data of each business's customers on behalf of that business, following its instructions and under the personal data transmission agreement that forms part of our Terms and conditions. In that case the business is the controller, and requests about that data should be sent to it first; if they reach us, we forward them to the business concerned.

Each business decides which channels to connect, whether to turn on the AI assistant, what information it publishes for it, which terms its customers must accept and whether it sends campaigns. Lania Flow carries out those decisions as part of the service.

The service is offered to businesses in Latin America, the European Union and the European Economic Area and, in the United States, only to businesses that do not provide health services. It is not prepared for health information protected by the United States HIPAA law.

3. How the platform works

The platform has two parts, both managed by Lania Flow. Neither is installed on the business's own servers.

• Business server (“installation”): stores each business's data: contacts, conversations, appointments, attachments, forms and settings. Several businesses may share an installation, with each one's data kept separate.
• Central server: connects the installations with Meta (it receives WhatsApp, Instagram and Messenger messages and delivers them to each business's installation), sends emails, acts as a gateway to the artificial intelligence provider and hosts the platform administration. It stores the data of businesses as customers (name, contact details, plan, usage and administrators) and, for a short time, messages in transit (see Retention).

The central server is located in Boston (United States). The installations and backups of businesses in Latin America and the United States are in the United States; those of businesses in the European Union and the European Economic Area, in the European Union.

4. Data we process

• Visitors to this website: this website has no analytics tools. It only stores in your browser the currency you choose and, while you complete the sign-up, the reference of your request. The provider that hosts the website (Cloudflare) processes technical data of each visit, such as the IP address, to serve and protect it.
• Sign-up on this website: the business name, your name, your email, the business country, the page language, your browser time zone, the plan and billing period you choose, whether you want to pay right away, the code we email you to confirm it, and the IP address you sign up from, which we use to limit abuse.
• Sign-in on this website: the email you enter, the page language and the IP address you request it from, which we use to limit abuse.
• Sales contact: name, email, phone, company and the content of the messages you send us.
• Businesses and their team: the business's legal name, document type and number, email, phone, country, city and address; plan, usage and communications with Lania Flow; for each team user, name, email, role, language, password stored in a non-reversible form, two-factor authentication if enabled and access logs (IP address, browser and date).
• The business's customers: name or profile name, phone number, Instagram identifier or username, the Messenger identifier that Meta assigns to the person on the business's page and Facebook profile name (if Meta provides it), email, conversation content, date of birth (if the business asks for it and the customer provides it), attachments (photos, audio and documents) when the business has that feature turned on, appointments, form responses, survey ratings, communication preferences, appointment payments (amount, currency, status and the payment provider's technical identifiers, without card or bank account details) and, if the business uses pay outside the platform, the payment receipts the customer uploads, records of terms acceptance (the text shown, the date, the channel and, if they accept on the web, the IP address and browser) and requests about their data.
• Imported contacts: if the business connects its number in coexistence with the WhatsApp Business app on the phone, the contacts and message history that Meta allows to import (up to 6 months).
• Communications and follow-up: tags, segments and custom fields the business assigns to each contact; consent and opt-outs per channel, with their source and date; history of messages scheduled by the platform (sent, delivered, read, replied or failed), and appointment attendance recorded by the business's team.
• Technical data: access, security and audit logs, IP address, browser type and events needed to operate and protect the platform.

Depending on the business's activity, conversations may include sensitive data, such as health information. The business is responsible for having the corresponding authorization. The business can require, per channel, that the customer accept its terms and privacy policy before the AI assistant reads their messages: without that acceptance, the AI receives nothing. Those texts are written and published by each business. Answering questions about sensitive data or about minors is optional: you are not required to do so.

Health businesses. If the business provides health services (for example, medicine, dentistry, physiotherapy, mental health or aesthetic medicine), Instagram and Messenger are only used for the first contact: the platform replies with an invitation to continue by email or WhatsApp, without the AI assistant, and does not answer further messages on those channels, although it stores them. The email conversation takes place in the business's own mailbox, outside the platform.

Lania Flow is not a medical records system: whatever the business must keep as such is kept in its own system.

5. Purposes

• Provide the service: receive and reply to messages, book and manage appointments, send reminders, surveys and verification codes, and show analytics to the business.
• Generate automatic replies with artificial intelligence when the business turns on the assistant.
• Send, on behalf of the business and only when it turns on campaigns or sequences, promotional WhatsApp messages to contacts who gave their consent, with templates approved by Meta, within the hours the business defines and with immediate opt-out at the contact's request.
• Measure AI usage and service costs with usage data that contains no content.
• Make backups and recover the service after failures.
• Create the accounts of businesses that sign up on this website, confirm their email with a code and prevent automated or abusive sign-ups.
• Send people who sign in on this website the link to their business panel, or a notice if we do not find an account with that email, and prevent automated or abusive requests.
• Handle sales and support inquiries, manage the contractual relationship and keep the list of customer businesses that Meta may request from us.
• Maintain security, prevent abuse and comply with legal obligations.

Legal basis (people in the European Economic Area). When we act as controller, we process data to perform the contract with businesses and manage their sign-up, their account and their team's access; on the basis of our legitimate interest in protecting the platform, preventing abuse, measuring usage and making backups; and to comply with our legal obligations, such as invoicing. When we act as processor, the legal basis of each processing is determined by the business.

We do not sell personal data or use it for our own or third-party advertising. We do not send commercial messages to businesses' customers on our own initiative: promotional messages are decided by each business and sent in its name.

6. Artificial intelligence

When the business turns on the assistant, the following is sent to the AI provider to generate each reply: the instructions and information the business published for the assistant, the latest messages of the conversation (up to 20 messages and 6,000 characters) and the results it needs to reply, such as free time slots or your upcoming appointments. The assistant does not access the database directly: it checks and books through the platform, which applies the business's rules.

The platform works with two artificial intelligence providers: OpenAI and Anthropic (Claude). The platform chooses which one each service uses and may change it to maintain quality and continuity. Neither of them uses the data to train or improve its models. With OpenAI, each request is sent with the option not to store it at the provider and, under its terms, OpenAI may keep its API data for up to 30 days to monitor abuse. Anthropic keeps its API data to monitor abuse for the limited period set by its commercial terms. When we change or add an AI provider, we will notify businesses in advance, in accordance with their contract.

The content travels encrypted from the business's installation to the Lania Flow central server, which acts as a gateway to the AI provider. The gateway only processes the content in memory during the call: it does not store it, log it or use it for any other purpose. We only keep usage data (business, model, amount processed, cost and date) to measure usage, apply spending limits and prevent abuse.

If the business uses its own OpenAI or Anthropic key, its conversations go directly from its installation to that provider, without passing through the gateway, under the business's contract with that provider, and it is up to the business to configure that account so the data is not used to train models.

If the business uses pay outside the platform, the AI provider reads the receipt the customer uploads to extract the amount, date and reference, and help the business review it; a person on the business's team always reviews the payment.

AI replies may contain errors. The assistant only books, changes or cancels appointments under the rules the platform validates, and you can ask to be served by a person.

7. Providers and integrations

To provide the service we use these providers, which process data on our behalf or on behalf of the business, each under its own data processing terms:

• Hostinger (Boston, United States): the platform's central server, through which messages, emails and AI requests pass.
• Installation provider (eastern United States and, for businesses in the European Union and the European Economic Area, the European Union): servers where each business's data is stored.
• Cloudflare: DNS, hosting of this website, abuse protection on this website's sign-up and sign-in and on the password recovery page (Turnstile) and storage of encrypted backups (R2), in the European Union for businesses in the European Union and the European Economic Area; Cloudflare does not have the key to read them.
• Meta Platforms (WhatsApp Business Platform, Instagram and Messenger), to send and receive messages on those channels.
• OpenAI, to generate the assistant's replies and knowledge drafts, as explained in Artificial intelligence.
• Anthropic, PBC (Claude): processes the conversations the AI assistant needs in order to reply, without using them to train its models, in accordance with its privacy policy.
• Amazon Web Services (Amazon SES, United States, Ohio region): sending of platform emails and of those businesses send with the platform sender or their own domain, and bounce and complaint notices, without open or click tracking.
• Google, Microsoft and Apple, when the business connects its calendars: each appointment is written there with the service and the customer's name, without phone or email, and busy times are read.
• Browser notification services (Google, Apple, Mozilla and Microsoft), which only receive notices with the business's name and a fixed text, without customer data.
• Paddle.com, as Merchant of Record: processes payments in US dollars (USD) and euros (EUR) under its own privacy policy.
• Bold: processes payments in Colombian pesos (COP) from customers in Colombia.
• Technical providers without access to customer data: Bitwarden (secrets management), GitHub (code and release distribution), Better Stack (availability and backup monitoring), Tailscale (administrative access to servers) and Let's Encrypt (certificates).

Payments. Lania Flow does not store card details.

Services contracted by the business. If the business connects its own email provider, its own OpenAI or Anthropic key, its calendars or its payment providers to collect appointment payments (Stripe, PayPal, Wompi or Bold), or sends its form responses to another system through webhooks, that data goes to the services the business chooses, under their terms. The customer pays on the payment provider's page: Lania Flow does not see their card details.

Connection with Meta. The connection with WhatsApp, Instagram and Facebook Messenger is made through the “Lania Flow” app, registered on the Meta platform within the verified business portfolio of Comercializadora Muto SAS, Lania Flow's technology partner. Comercializadora Muto only manages the app's settings: it does not receive messages, access tokens or notices from Meta, which travel directly between Meta and the Lania Flow central server.

Meta platform data. Data received through WhatsApp, Instagram and Messenger is only used to provide the service to the business: receiving and replying to messages, managing appointments and, if the business turns it on, generating replies with the AI assistant. It is kept separate for each business, we do not sell it or use it for our own or third-party advertising, and we delete it on request, as explained in Data deletion.

WhatsApp, Instagram, Facebook and Messenger are trademarks of Meta. Lania Flow is an independent product and is not affiliated with, sponsored or endorsed by Meta.

8. International transfers

The platform's servers and backups are in the United States, and most of the providers above process data outside Colombia. For that reason, data is transmitted or transferred to other countries, in accordance with Law 1581 of 2012, to providers that are contractually bound to process it only to provide their service and to protect it.

The data of businesses established in the European Union and the European Economic Area, and their backups, are stored in the European Union. They leave the European Economic Area in transit through the central server in Boston, and some providers, such as artificial intelligence, email and Meta, process them outside it. For the data of people in the European Economic Area and of businesses established there, we only transfer it outside the European Economic Area with the safeguards of Chapter V of the GDPR, such as the European Commission's adequacy decisions or its standard contractual clauses.

When Lania Flow acts as processor, the business authorizes that location and must disclose it to its customers in its own privacy notice.

9. Retention

We keep data while the relationship with the business continues or while it is needed for the purposes described. These are the specific periods:

• Conversation content: the period agreed with each business, between 3 and 60 months from the last message of the conversation; 60 months by default. When it ends, the message text and its files are deleted. The contact record and its appointments are kept while the business uses the service or until their deletion is requested.
• Attachments: 13 months from when they were received or sent, or less if the business's conversation period is shorter. The message text is kept.
• Messages in transit through the central server: the notices Meta sends are kept for 7 days and, if they cannot be delivered to the business's installation, for up to 30 days. For each email sent, only a record without content or addresses (a non-reversible hash of the recipient and its domain) is kept for 90 days. Content sent to the AI provider is not stored.
• Sign-in requests on this website: a non-reversible fingerprint of the email and the time of the request, for one day, to limit sending.
• Acceptance records: the IP address and browser from which the customer accepted on the web are deleted after 6 months; the rest of the record is kept like terms acceptances.
• Copy of a customer's data: the ZIP file prepared by the business is deleted after 7 days, and its download link is valid for 7 days and 3 downloads.
• Deletion hashes: after deleting a customer's data, we keep a non-reversible hash of their phone and email for 13 months, so they are not added again when contacts are imported or a backup is restored.
• Usage and audit logs: 13 months for AI usage logs (without content), audit logs, spending limit notices, support access logs and exceptional technical access logs (these two counted from the end of the access), and for requests received through Meta, counted from when they are closed. Terms acceptances are kept while the contact exists and, after their last decision, for the same period as the business's conversations.
• Server technical logs: database connections, without their content, and administrative logins, about 90 days.
• Business contact details: while the business is a customer and, afterwards, for as long as the law requires.
• Backups: made daily and encrypted before leaving the server. Daily backups are kept for 35 days and the first of each month for 95 days. For 30 and 90 days respectively, nobody can delete or modify them, as protection against attacks. They are kept on the server itself for 3 days.

Deleted data may remain in encrypted backups until they expire, at most 95 days. Backups are only ever restored to recover the service and, if one is restored, we reapply the deletions made since its date.

When the service ends, the business has 30 days to request an export of its data in readable formats, such as CSV or JSON. Within the following 30 days, its data is deleted or anonymized, unless the law requires it to be kept.

10. Security

We apply these technical and organizational measures:

• Separation of each business's data in the application and in the database (PostgreSQL row-level security).
• Role-based access control for each business's team, with optional two-factor authentication, and mandatory two-factor authentication for platform administration.
• Passwords stored in a non-reversible form; integration credentials, Meta access and sessions encrypted; verification codes and links stored as hashes.
• Encrypted connections (HTTPS) and signed communications between the central server and the installations.
• Attachments scanned with antivirus software before being stored, when the feature is turned on.
• Backups encrypted with a key that is not on the servers, and protected against deletion.
• Administrative access to servers only with a key and over a private network, logging of connections and secrets kept in a secrets manager.
• Audit logs of administrative actions and of support and technical access.
• A written incident response procedure, with notice to affected businesses within 72 hours and to Meta when its data is affected.

Server disks and the database are not fully encrypted: encryption is applied to credentials, sessions and backups.

11. Access by the Lania Flow team

From the platform, the Lania Flow support team only sees a business's data if the business authorizes it in its settings: by area, read-only and for up to 7 days, and it can be revoked at any time. Each access is logged, the business is notified when support enters and can review the log.

Those who manage the infrastructure have, by the nature of their role, technical ability to access the servers and backups. They only use it to operate, maintain, protect or recover the service, or because the law requires it. Without the business's authorization, we only access the content of its data to contain a security incident, restore the service or comply with an order from a competent authority; that access is logged and we notify the business within 72 hours, unless the law prevents it.

12. Data subject rights

As a data subject, you have the right to know, update and correct your data; request proof of the authorization you gave; be informed about how it is used; revoke the authorization or request deletion when there is no legal or contractual duty to keep it; access it free of charge; and file complaints with the Superintendence of Industry and Commerce (SIC).

If you are a customer of a business, the fastest way is to ask the business, which is the controller of your data. In addition, depending on what each business turns on:

• You can ask for a copy of your data or for it to be deleted from WhatsApp, Instagram or Messenger (with the “Copy of my data” and “Delete my data” menu options, or by asking the assistant, which records the request) or from “My data” in the business's portal, after identifying yourself. In the portal you can also request rectification, objection or restriction of processing.
• A business administrator handles each request. Before handing anything over, they check your identity, and they give you the copy in a ZIP file with your data in a readable format and in a reusable one (JSON), through a temporary link.
• You can stop receiving promotional messages by replying “BAJA” or “STOP”.
• The business's team can correct your contact details.

The deadlines to reply depend on the law of the business's country.

If you are in the European Economic Area, you also have the right to data portability, to object to processing, to request its restriction and not to be subject to decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We reply within one month, extendable by two more months when necessary, and you can lodge a complaint with the data protection authority of your country.

To exercise your rights with Lania Flow, write to info@laniaflow.com with your name, the data or channel concerned (for example, your WhatsApp number) and your request. We answer inquiries within ten (10) business days and claims within fifteen (15) business days, extendable as provided by law. If the request concerns data we process on behalf of a business, we forward it to that business within 2 business days and let you know.

13. Data deletion

If you wrote to a business that uses Lania Flow on WhatsApp, Instagram, Facebook Messenger or its website and want your data deleted:

1. Ask the business directly, or write to us at info@laniaflow.com with the subject “Data deletion”.
2. Tell us the business you talked to and the phone number or Instagram username you used or, if it was on Messenger, your Facebook profile name or the page you talked to.
3. We forward the request to the business within 2 business days, and the business handles it within 30 days at most: your data for that business is deleted or anonymized, except what the law requires to be kept. We will confirm the result. Your past appointments are kept without your personal data. If any data remains in an encrypted backup, it is deleted when the backup expires, within 95 days at most.

Anything already on Meta's servers (WhatsApp, Instagram or Messenger) is beyond our reach and is governed by Meta's terms.

From Facebook or Instagram. If you remove the “Lania Flow” app from your Facebook or Instagram settings, or request deletion of your data there, Meta notifies us. We disconnect the Facebook page or Instagram account you connected and delete its access; WhatsApp connections are reviewed and disconnected manually. If you requested deletion, the business receives a deletion request to handle within 30 days at most, and you receive a confirmation code (LF-…) to check the status of the request.

If you are a business. You can disconnect each channel from Integrations in the dashboard: when you do, the platform unsubscribes the “Lania Flow” app from that Meta account and deletes its access. To also revoke the permission in Meta, remove the app from your Facebook or Instagram settings or from your Meta business portfolio. To close your account, write to us from the account email: you will have 30 days to request an export of your data and we will delete it within the following 30 days.

To stop receiving promotional messages from a business on WhatsApp, reply “BAJA” or “STOP”, or tap the opt-out button in the message. You will receive a confirmation and can subscribe again by replying “ALTA”. Opting out does not stop reminders or surveys for appointments you already booked, nor replies to messages you send.

14. Cookies and local storage

This website does not use its own cookies, advertising or analytics or tracking tools. It only stores in your browser's local storage the currency you choose and, while you complete the sign-up, the reference of your request, which is deleted when you close the tab. On the sign-up and sign-in, Cloudflare's anti-abuse service (Turnstile) processes technical data from your browser and your IP address only to check that you are not an automated program.

The platform only uses strictly necessary technical storage:

• Session and form protection cookies to sign in and keep the session secure, which expire after 2 hours of inactivity, and the “Remember me” cookie, for 7 days, only if you tick that box.
• In the business's booking portal, a session cookie specific to the portal.
• In the chat on the business's website, the chat session is stored in the browser's local storage, without cookies, and expires after 30 days of inactivity.
• Interface preferences (such as the collapsed sidebar or the offline page language) and the installable app files, without customer data.
• On the password recovery page, Cloudflare's anti-abuse service (Turnstile), which processes technical data of your browser and your IP address only to check that you are not an automated program.

The platform does not use third-party advertising or analytics cookies.

15. Minors

This website and the platform are aimed at businesses. We do not intentionally collect data from minors on our own behalf. When a business serves minors, it is responsible for having the authorization of their representatives.

16. Changes to this policy

We may update this policy. We will publish the current version here with its update date and, if the change is significant, we will notify customer businesses by email at least 15 days in advance.

17. Effective date

This version of the policy is effective from its publication on this page, on October 29, 2026. Databases will remain in force while the purposes that justify the processing or the relationship with the business continue, and afterwards for the retention periods required by law.

This policy is published in Spanish and English. In case of differences, the Spanish version prevails.

18. Contact

For any privacy question: info@laniaflow.com.