Privacy Policy

Last Updated: February 2026

This Privacy Policy describes how NeuraFlow ("Platform," "we," "us," or "our"), a product of Brain Station 23 Ltd, collects, uses, and protects information when businesses and their customers interact through our platform.

Data Controller

1. Information We Collect

When businesses use NeuraFlow to manage WhatsApp communications, we process:

• Incoming messages from the business's customers (message content, sender phone number, timestamp)
• Business configuration data (response workflows, data source connections, business profiles)
• WhatsApp Business Account information (WABA ID, phone number ID, business profile details)
• Usage analytics (message volumes, response times, platform feature usage)

2. How We Use Information

We use collected information exclusively to:

• Deliver the business's configured responses to customer inquiries
• Maintain, operate, and improve the platform
• Provide analytics and reporting to businesses about their customer communications
• Ensure compliance with WhatsApp's Business Messaging Policy
• Detect and prevent abuse, fraud, and security incidents

We do NOT use WhatsApp conversation data to:

• Train machine learning or artificial intelligence models
• Build user profiles for advertising purposes
• Share with third parties for purposes unrelated to service delivery
• Provide general-purpose conversational services
• Sell or rent to any third party

3. Data Sharing

We may share information with:

• Meta Platforms, Inc. — as required by WhatsApp Business Platform terms, to facilitate message delivery
• The business that the customer is communicating with — businesses receive their own customer communication data through the platform
• Service providers — third-party infrastructure providers (hosting, monitoring) under strict data processing agreements
• Legal authorities — when required by applicable law, regulation, or legal process

We do not share customer conversation content with any party other than the business the customer is communicating with and Meta (for message delivery).

4. Data Retention

Data is retained for the duration necessary to deliver the business messaging service. Businesses may configure retention preferences and request deletion of their data at any time by contacting neuraflow@brainstation-23.com.

Specific retention periods are determined by each business's configuration and applicable regulatory requirements.

5. Data Security

We implement industry-standard security measures including:

• Encryption in transit (TLS 1.2+)
• Encrypted credential storage (AES-256-CBC)
• Role-Based Access Control (RBAC)
• Tenant-level data isolation
• Request logging and security event monitoring
• Infrastructure hosted on secure cloud providers

6. Your Rights

Depending on your location, you may have the following rights:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your personal data
• Portability — request your data in a portable format
• Objection — object to certain processing activities

To exercise these rights, contact neuraflow@brainstation-23.com.

For customers of businesses using NeuraFlow: your primary relationship is with the business you are communicating with. Please contact that business directly for data requests related to your conversations. If the business is unable to fulfill your request, contact us at neuraflow@brainstation-23.com.

7. International Data Transfers

Brain Station 23 Ltd is based in Bangladesh. Data may be processed in locations where our infrastructure providers operate. We ensure appropriate safeguards are in place for international data transfers in compliance with applicable data protection laws including GDPR and local regulations.

8. Children's Privacy

Our platform is designed for business-to-customer communication. We do not knowingly collect personal information from children under the age of 16. Businesses using our platform are responsible for ensuring their communications comply with applicable laws regarding minors.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify businesses of material changes via email or platform notification. Continued use of the platform after changes constitutes acceptance of the updated policy.

10. Contact Us

For questions about this Privacy Policy or our data practices:

Website: https://neuraflow.bot