Privacy Policy

Flolyt is operated by Flolyt Technologies Ltd, located at Femi Coker Drive, Lekki, Lagos, Nigeria. This Privacy Policy explains how Flolyt handles personal data in connection with our website, accounts, billing, customer support, and SaaS platform.

Flolyt is a multi-tenant SaaS platform that helps business customers connect their own data sources and messaging channels to run customer engagement campaigns. When we process personal data about our customers' end-customers through the platform, we act as a data processor on behalf of the business customer, who is the data controller. When we process our own account, billing, website, and business contact data, we act as a data controller.

Account and billing data for tenant users. We collect information needed to create and manage tenant accounts, provide support, communicate with users, and process billing. This may include names, work email addresses, company details, role or team information, authentication details, invoices, plan information, payment status, and related account activity.

End-customer data connected by tenants or flowing through campaigns. Tenants may connect data sources and messaging channels that contain end-customer information. Depending on what the tenant connects and configures, this may include contact identifiers such as phone numbers, email addresses, customer IDs, or messaging IDs; engagement events such as message sends, deliveries, reads, clicks, replies, purchases, churn signals, subscription events, or support interactions; and customer attributes such as segments, lifecycle stage, preferences, plan, location, or other fields selected by the tenant.

Tenants control what data they connect to Flolyt and are responsible for having the right notices, permissions, and legal bases for the end-customer data they ask Flolyt to process.

When a tenant connects a data source, Flolyt uses a zero-copy model. We do not bulk-copy or warehouse the tenant's raw datasets as a default operating model.

Instead, Flolyt reads only what is needed to derive the signals required to power campaigns, customer engagement workflows, audience selection, personalization, reporting, and analytics. We design this approach around data minimization: use less data, keep less data, and store only what is needed to provide the service.

Where personally identifiable information (PII) is stored by Flolyt, it is encrypted at rest. We also apply access controls and purpose limits so tenant data is used only to provide and improve the services requested by that tenant.

Flolyt integrates with the WhatsApp Business Platform provided by Meta and may also integrate with SMS and email providers selected or configured for campaign delivery. We process messages, templates, recipient identifiers, delivery status, read receipts, replies, opt-out events, and related metadata to send campaigns and report campaign status on the tenant's behalf.

Use of WhatsApp through Flolyt is subject to Meta's WhatsApp Business terms, policies, and platform rules. Flolyt honors applicable messaging requirements, including opt-out requests such as STOP where supported by the channel, consent and preference settings configured by the tenant, and messaging window rules for WhatsApp conversations.

Data obtained through Meta APIs is used solely to provide the messaging service requested by the tenant. Flolyt does not sell data obtained through Meta APIs.

We use personal data to provide, operate, secure, and improve Flolyt. This includes account administration, campaign orchestration, audience selection, signal generation, analytics, reporting, support, troubleshooting, fraud prevention, abuse monitoring, system security, billing, and legal compliance.

For account, billing, and website data where Flolyt is the controller, our legal bases may include performing a contract with you or your organization, pursuing legitimate business interests such as service security and improvement, complying with legal obligations, and consent where required.

For end-customer data processed inside the platform, the tenant determines the lawful basis and purposes of processing. Flolyt processes that data under the tenant's instructions and applicable data processing terms.

Flolyt protects personal data using technical and organizational measures designed for a SaaS environment. PII stored by Flolyt is encrypted at rest, and data is encrypted in transit using TLS. We use access controls, role-based permissions, tenant isolation, logging, and security processes to reduce unauthorized access.

We retain tenant account data and end-customer data for as long as needed to provide the service, meet legal obligations, resolve disputes, maintain security, and support the tenant relationship. For processor data, retention is tied to the tenant relationship and the tenant's instructions.

When a tenant requests deletion, or when the tenant relationship terminates, we delete or return end-customer data in line with our agreement with the tenant, unless retention is required by law or needed for legitimate security, audit, or dispute-resolution purposes.

We share personal data only as needed to provide and operate Flolyt, comply with law, protect rights and security, or complete business transactions subject to appropriate safeguards.

Our sub-processor categories may include cloud hosting and infrastructure providers, messaging providers such as Meta/WhatsApp and other SMS or email providers, payment processors, analytics or monitoring tools, customer support tools, and professional advisers where necessary.

Flolyt does not sell personal data. We also do not use tenant end-customer data for another tenant's campaigns.

Depending on where you are located, you may have rights to access, correct, erase, restrict, export, or object to the processing of your personal data. You may also have the right to withdraw consent where processing is based on consent.

If you are a tenant user and want to exercise rights over account or billing data that Flolyt controls, contact us at privacy@flolyt.com.

If you are an end-customer of a business using Flolyt, please contact that business directly. Because Flolyt acts as the processor for tenant end-customer data, we will route or support end-customer requests through the tenant unless applicable law requires otherwise.

Flolyt's privacy practices are designed and implemented in line with the EU General Data Protection Regulation, the UK General Data Protection Regulation, and Nigeria's data protection framework, including the Nigeria Data Protection Regulation and Nigeria Data Protection Act.

These practices include data minimization, purpose limitation, transparency, security, retention controls, and support for data-subject rights. Where personal data is transferred internationally, we use appropriate safeguards required by applicable law.

For privacy questions, requests, or concerns, contact Flolyt at privacy@flolyt.com.

Legal entity: Flolyt Technologies Ltd.

Registered address: Femi Coker Drive, Lekki, Lagos, Nigeria.