The short version
Who we are
Flow Connect (also called WooFlow Connect) is a WordPress and WooCommerce plugin made by DuoPlus, based in Lahore, Pakistan. In this policy, "we", "us" and "our" mean DuoPlus. We run the website at wooflowconnect.com, the customer dashboard, and the license server that the Pro plugin talks to.
This policy covers those three things, and explains what the plugin itself does with data. You can reach us at support@wooflowconnect.com or through the contact form.
Your store's customers (who is responsible for what)
If you use Flow Connect on a WooCommerce store, there are two groups of people in this policy:
- You, the store owner. You are our customer. We hold your account, license and billing data and we are responsible for it.
- Your shoppers. The plugin runs on your website. When a shopper buys, the plugin reads their order details on your site and passes them to the services you connect (see "What the plugin does on your store"). We do not receive, store or see your shoppers' names, emails, orders or carts. You are responsible for them, as you are for the rest of your store's data, so please keep your own store privacy policy up to date.
What we collect and why
| Data | What exactly | Why we need it |
|---|---|---|
| Account | Your email address and your password. The password is stored only as a salted one-way hash, never in readable form. If you turn on two-step verification we also store your authenticator secret (encrypted) and hashes of your recovery codes. | To create your account, log you in and keep it secure. |
| License and store | Your license key (stored as a hash, plus its last few characters), your store's web address, an internal store ID, the plugin version and the time of the last license check. | To check that your plan is active, lock the key to one store, and show you which store it is linked to. |
| Plan and billing | Your plan status, trial and renewal dates, and a record of each payment (date, amount, currency, status). We do not see or store your card number. | To run your trial and subscription, and to keep accounting records. |
| Account activity | A log of account events such as sign-up, key creation, store linking, plan changes, downloads, and failed two-step attempts. | To keep accounts secure, investigate problems and help you with support. |
| Technical data | Your IP address, kept temporarily (about a day) to limit repeated login or license attempts and to stop abuse. Our hosting provider also keeps normal web server logs. | Security and abuse prevention. |
| Emails | The emails we send you and whether they were delivered. | To deliver the account emails described below and retry failed sends. |
| Contact messages | The name, email, topic and message you type into the contact form, and our reply. | To answer you. |
We do not ask for, and do not collect, payment card details, your phone number, or your address.
Emails we send
We send only account emails from no-reply@wooflowconnect.com: welcome, license key created or replaced, trial and billing notices, payment problems, refund confirmations, password reset and change notices, two-step verification changes, and a notice when your key is activated on a store. We do not send marketing or newsletter emails. If you want to send us a message, use the contact form, as the no-reply address cannot receive replies.
What the plugin does on your store
Connection to our server (Pro only)
The free edition does not contact our servers. The Pro edition contacts our license server when you activate it and then every few days in the background. Each request contains only your license key, your internal store ID, your store's web address, the plugin version and a random one-time value. It returns a signed license that lets Pro run for up to 72 hours. No customer, order or product data is sent.
Services you connect
Flow Connect only sends data to the services you switch on and set up yourself under Connections. Depending on what you enable, these can include:
- GoHighLevel, Mailchimp and Klaviyo (contacts, tags, subscriptions, events).
- A Google Sheet in your own Google account, through an Apps Script that you deploy.
- Meta's WhatsApp Cloud API and Twilio (messages to customers).
- Any webhook address you enter, such as Zapier, Make, n8n or your own server.
- Your own SMTP provider, for internal email alerts to your team.
The data sent can include a shopper's name, email, phone number, country and city, order details (order number, total, products, coupons, dates), their order history totals, whether they gave marketing consent, and for abandoned carts the cart contents and a recovery link. Exactly what is sent depends on the flows you build.
Your keys and tokens for these services stay in your own WordPress database. They are not sent to us, and they are left out of logs and exports.
Marketing consent checkbox
The plugin can add an optional checkbox to your checkout. The answer is saved on the order and on the customer's account on your site. Marketing actions to Mailchimp, Klaviyo, WhatsApp and SMS only run for customers who ticked it.
Abandoned carts (Pro)
When this module is on, the plugin saves a cart in your own database once it has an email address. For guests, a small script on your checkout page reads the email as soon as it is typed into the billing email box, before checkout is finished. The saved record includes the email, name, phone, country, cart contents and total. It is deleted after the number of days you choose (30 by default) and when you uninstall the plugin, unless you chose to keep data. You should mention this in your store's privacy policy.
Logs on your store
The activity log and dev log are stored in your own WordPress database and show what actions ran. You can limit their size, and mask customer emails in them, under Settings.
Who we share data with
We do not sell your data and we do not share it for advertising. We use a small number of service providers to run Flow Connect, and they only get what they need:
| Provider | What for | What they receive |
|---|---|---|
| Hostinger | Web hosting, our database and sending account emails. | All account data described above, as our hosting provider, and the emails we send. |
| Polar | Taking payments and managing subscriptions. Polar acts as the seller of record and handles tax on our behalf. | Your email, the details you enter at checkout and your payment details, under Polar's own privacy policy. We receive back your subscription status and payment records. |
| Discord | Notifying our team of messages you send through the contact form. | The name, email, topic and message you type into the contact form. |
| Google Fonts | Showing the Inter typeface on our website, dashboard and guide. | Your browser requests the font file from Google, so Google sees your IP address and browser details. |
We may also disclose information if the law requires it, to enforce our terms, or to protect the safety and security of our users or service. If we are involved in a sale or merger of the business, your data may be transferred to the new owner, who must honour this policy.
Cookies
We use one essential cookie. When you log in to the dashboard, a session cookie keeps you logged in until you log out or it expires. It is needed for the service to work, so it does not need a consent banner.
The marketing website and this guide do not use analytics, advertising or tracking cookies. Embedded third-party services such as Google Fonts can receive your IP address as described above.
Our legal reasons for using data
If the General Data Protection Regulation or a similar law applies to you, we rely on these grounds:
- Contract: to provide your account, license, plan and downloads.
- Legitimate interests: to keep the service secure, prevent abuse and fraud, and fix problems.
- Legal obligation: to keep payment and accounting records.
- Consent: where we ask for it, which you can withdraw at any time.
How long we keep data
- Account, keys and store links: for as long as your account exists.
- Login sessions: until they expire or you log out. Logging out ends your sessions.
- Password reset links: valid for 1 hour, then removed.
- IP address attempt records: about a day.
- Email delivery records: about 60 days.
- Payment records and security logs: kept for as long as needed for accounting, tax and security. When you delete your account they are no longer linked to a login or your email address.
- Contact messages: about 12 months after you send them, then deleted. We also send you one automatic email to confirm we received your message.
When you delete your account we remove your email, password hash, two-step secret, license keys, store links, sessions and notes. Copies in routine backups are overwritten as backups rotate.
How we protect data
- All traffic to our site and server uses HTTPS.
- Passwords are stored as salted hashes. License keys are stored as hashes. Two-step verification secrets are stored encrypted.
- Our license answers are digitally signed, so a store cannot fake them.
- Logins and license checks are rate limited, and you can turn on two-step verification for your account.
- Access to our systems is limited to the people who need it.
No online service is perfectly secure, so we cannot guarantee absolute security. If we ever learn of a breach that affects your data, we will tell you and the authorities as the law requires.
Your rights and choices
Depending on where you live (for example the EU, the UK, or California), you may have the right to:
- ask what data we hold about you and get a copy;
- correct data that is wrong;
- have your data deleted;
- object to or limit certain uses, and withdraw consent you gave;
- receive your data in a portable format;
- complain to your local data protection authority.
To use any of these, email support@wooflowconnect.com (or use the contact form) from the email address on your account, so we can confirm it is you. We usually reply within a few days and always within 30 days. You can change your password and manage two-step verification yourself on the dashboard, and cancel your plan there at any time. We do not make decisions about you using automated profiling.
If you are a shopper on a store that uses Flow Connect and want to see or delete your data, please contact that store directly, as it is the one that holds and controls it.
International transfers
We are based in Pakistan, and our hosting provider and the services we use can process data in other countries. Your data may therefore be processed outside the country where you live. Where the law requires safeguards for such transfers, we rely on the protections our providers offer.
Children
Flow Connect is built for people who run online stores. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us data, tell us and we will delete it.
Changes to this policy
We may update this policy as the product changes. The date at the top shows the latest version. If we make a significant change, we will tell account holders by email or on the dashboard before it takes effect.
Contact us
Questions about this policy or your data? Email support@wooflowconnect.com, or use the contact form and choose "Something else". We read every message.
DuoPlus, Lahore, Pakistan.
For store owners: text for your own privacy policy
If you use Flow Connect, your store sends customer data to the tools you connect, so your own privacy policy should say so. You can adapt this paragraph: