In short
- We store what you need to run your pages: your account, your workspace, the content you plan, encrypted access tokens for the Pages and channels you connect, and the comments and messages people leave on those Pages.
- AI replies are generated by model providers through OpenRouter. They receive only the comment or message text, the post it belongs to and your own knowledge base — never tokens, emails or payment data. We do not train models on your data.
- We do not sell data, show ads or use ad trackers. One session cookie, nothing else.
- You can delete everything yourself at any time — a connected account, a page, a workspace or your whole account — and each removes the related data at once.
1. Who we are
Flowmind Social (“the service”, “we”, “us”) is operated by Flowmind Digital, Bagerhat, Khulna, Bangladesh, and is available at https://smm.flowmind.digital. For questions about this policy or your data write to [email protected].
For your account, workspace and billing data we decide how and why it is processed (we are the “controller”). For the comments, messages and audience data of the Pages and channels you connect, you decide what is connected and how the assistant may act; we process that data on your instructions to provide the service (we act as your “processor”, and you remain responsible to your audience under the platforms’ rules).
2. What the service does
Flowmind Social is a workspace for businesses, creators and agencies that run several Facebook Pages, YouTube channels and X accounts. In it you plan content on a calendar, upload media, publish or schedule posts, read and answer the comments and Messenger conversations on your Pages (yourself or with an AI assistant that follows your rules and your knowledge base), see follower and engagement statistics, and work with a team in roles. Outside AI tools such as ChatGPT and Claude can be connected to a workspace with an API key you create.
3. Data we collect
3.1 Account
Your name, email address, a hash of your password (we never store the password itself), your time zone, email-verification and password-reset tokens while they are valid, and a record of sign-ins (time, IP address, browser) kept for security.
3.2 Workspace and team
The workspace name and settings, the members and their roles, invitations (the invited email address), notification preferences and — if you set them up — your Telegram bot token and chat id (stored encrypted), and your own OpenRouter API key on plans that allow it (stored encrypted).
3.3 Content you create
Posts, titles, descriptions, tags, schedules, the photos and videos you upload, your knowledge base, reply rules, voices and instructions for the assistant, notes you leave on conversations and the answers you give to queued questions.
3.4 Connected accounts
For each Facebook Page: its id, name, picture and a Page access token. For each YouTube channel: its id, name and the OAuth tokens Google issues. For each X account: the API keys and tokens you paste. All tokens and keys are encrypted at rest (AES-256-GCM) and are used only to act on that page as described in sections 4–6.
3.5 Comments, messages and audience data from your Pages
So that you can answer people from one place, we read and store, for the Pages and channels you connected: comments on your posts (the text, the writer’s name and platform id, time, and the post they belong to), Messenger conversations with your Page (messages, the sender’s name and page-scoped id, reactions, timestamps), who reacted to your posts where Meta grants that data, and the lists we derive from these for you — people who comment most, questions nobody could answer, feedback and name requests. We also store the replies sent (by you, your team or the assistant), the assistant’s drafts and its reasoning notes, and aggregated statistics (reach, views, followers, comment counts).
3.6 Billing
Your plan, billing cycle and payment history. For cards, Stripe’s customer and subscription ids — card numbers never reach our servers. For bKash / Nagad, the transaction id and the sending number you enter.
3.7 Usage and logs
An activity log per workspace (who did what, when, from which IP), AI usage records (which feature, model, token counts and cost — not the text), API-key usage counts, and short-lived server logs (request path, time, IP, status) used for security and debugging.
4. Facebook permissions and why we ask for each
When you connect a Facebook Page we ask Meta for the following permissions. We request only what the features below need, we use the data only for those features, and we never post to your personal profile or read your personal timeline, friends or messages.
| Permission | What we use it for |
|---|---|
pages_show_list | List the Pages you manage so you can choose which ones to connect. |
business_management | Include Pages owned by your Business portfolio in that list. We do not change your business settings. |
pages_read_engagement | Read your Page’s own posts, their comment and reaction totals and follower counts for the dashboard and the comment desk. |
pages_manage_posts | Publish and schedule the posts, photos, videos and Reels you create in the planner, to the Pages you chose. |
pages_read_user_content | Read the comments on your Page’s posts — the text and the writer’s name and id — so the desk can show them, group them by person and answer them; and see who reacted to a post. |
pages_manage_engagement | Reply to, like and hide comments as your Page when you, a teammate, a rule you set, or an AI agent you authorised decides to. |
read_insights | Show your Page and post insights — reach, views, follower growth by day — on your dashboard. |
pages_messaging | Receive the messages people send your Page and answer them from the Messenger assistant. Replies are sent only within Meta’s 24-hour messaging window and only in response to the person’s own message. |
pages_manage_metadata | Subscribe your Page to our webhook so new comments and messages reach your inbox in real time. |
Where Meta grants it, we also show the name and profile picture of a person who commented on or messaged your Page next to their message, so your team knows who they are answering. This is shown only to members of your workspace.
Your use of Facebook features through the service is also subject to Meta’s Privacy Policy and Platform Terms. You can remove our access at any time from Facebook under Settings & privacy → Settings → Business integrations, or by disconnecting the Page in the service.
5. Google / YouTube scopes and why we ask for each
When you connect a YouTube channel we ask Google for these OAuth scopes:
| Scope | What we use it for |
|---|---|
https://www.googleapis.com/auth/youtube.upload | Upload the videos you schedule in the planner, with the title, description, tags, thumbnail, privacy setting and publish time you set. |
https://www.googleapis.com/auth/youtube.force-ssl | Read your channel’s name and id; update a video’s details after upload; read the comments on your own videos and post replies to them as your channel when you or your rules decide to. |
https://www.googleapis.com/auth/yt-analytics.readonly | Show your channel’s views, watch time and subscriber numbers on your dashboard. |
Limited Use. Flowmind Social’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice this means: we use Google user data only to provide and improve the features you see in the service; we do not use it for advertising; we do not sell it; no person at Flowmind Digital reads it except with your permission, to fix a problem you reported, for security, or where the law requires; and we transfer it only as needed to provide those features (for example, the text of a YouTube comment is sent to a model provider to draft a reply — see section 7), for security, or to comply with the law. We do not use any data obtained through Google APIs, including YouTube data, to develop, improve or train generalised AI or machine-learning models.
By connecting a channel you also agree to the YouTube Terms of Service; Google’s handling of your data is described in the Google Privacy Policy. YouTube data is refreshed regularly while the channel stays connected and deleted when you disconnect it. You can revoke our access at any time at myaccount.google.com/permissions.
6. X accounts
X does not currently offer a shared sign-in for this kind of tool, so you create API keys in your own X developer account and paste them into the service. We store them encrypted and use them only to publish the posts you plan to that account. Delete the account in the service and the keys are erased; you can also revoke them at X.
7. How AI processing works
Replies, drafts and classifications are produced by large language models. We do not run the models ourselves: each request goes to OpenRouter, which forwards it to a model provider such as Google (Gemini) or Anthropic (Claude), chosen per request for quality and cost.
What is sent: the text of the comment or message being answered (and, for a conversation, the recent messages in it), the text of the post it belongs to, the relevant passages from your knowledge base, your reply rules, voice and instructions, and — when the assistant is checking its own draft — the draft. Nothing else: no access tokens, no email addresses, no payment data, no account identifiers. The request carries our product name so the provider can attribute traffic, not your workspace.
What is not done: we do not train or fine-tune any model on your data, and we do not allow sub-processors to do so on our behalf. OpenRouter and the model providers process each request to produce the reply under their own terms (OpenRouter, Google, Anthropic). If you bring your own OpenRouter key on Pro or Agency, requests are made through your OpenRouter account instead and are governed by your agreement with them.
What we keep: the draft or reply, its classification and a short reasoning note alongside the comment or message it belongs to (so you can see why the assistant did what it did), plus usage records (model, token counts, cost) without the text.
8. How we use data
- To provide the service: publish your posts, show and answer comments and messages, run the assistant you configured, show statistics, run your team and plan.
- To keep accounts secure: verify emails, throttle sign-in attempts, record the activity log, detect abuse.
- To bill you and to approve manual payments.
- To send you service email: verification, password resets, invitations, billing notices and the notifications you turned on. We do not send marketing email without your consent.
- To support you when you write to us.
- To comply with the law and the platforms’ rules.
Where the GDPR or similar laws apply, we rely on performance of our contract with you (providing the service), our legitimate interests (security, preventing abuse, improving the service using aggregate information), your consent (optional features such as Telegram notifications) and legal obligations.
9. Sub-processors
These companies process data for us. We share only what each needs.
| Sub-processor | Purpose | Data |
|---|---|---|
| OpenRouter, Inc. and the model providers it routes to (currently including Google and Anthropic) | Generating replies, drafts, classifications and fact checks | Comment / message text, post text, your knowledge base and instructions (section 7) |
| Resend, Inc. | Sending transactional email | Recipient name and email address, the content of the email |
| Stripe, Inc. | Card payments and subscriptions | Email, plan, amounts; card details are entered on Stripe’s pages and never reach us |
| Cloudflare, Inc. | DNS, TLS and protection of requests to the service | IP address and request metadata in transit |
| Our hosting provider | Running the server and storing the database, uploads and backups | All service data, encrypted in transit; tokens and keys additionally encrypted at rest |
| Telegram (optional, only if you configure it) | Delivering the workspace’s notifications to your own bot and chat | Notification text, which may include a comment, message or draft |
Meta Platforms and Google are not our sub-processors: they are the platforms you connected, and they receive the posts and replies you (or your rules) send through the service exactly as if you had used their own apps.
10. Sharing
We do not sell personal data and we do not share it with advertisers or data brokers. We share data only with the sub-processors above, with the platforms on your instructions, with your own teammates according to their roles, with an AI client you connected through an API key (within that key’s scope), where the law requires it, or to protect the service and its users from abuse. If Flowmind Digital is ever acquired or merged, your data would pass to the successor under this policy and you would be told first.
11. Retention
| Data | Kept |
|---|---|
| Account data | While your account exists; deleted when you delete the account. |
| Page, channel and X tokens / keys | Until you disconnect the account, delete the page, the workspace or your account — whichever comes first. Deleted immediately. |
| Comments, messages, drafts, people and feedback lists | While the page stays connected. Deleted together with the page, the workspace or your account. |
| Posts and uploaded media | Until you delete the item, the page, the workspace or your account. |
| Knowledge base, rules, voices | Until you delete them, the page or the workspace. |
| Activity log | While the workspace exists. |
| AI usage and payment records | Usage counts and payment history are kept for billing and accounting purposes for as long as the law requires; they contain no comment or message text. |
| Server logs | Rotated within 30 days. |
| Backups | Encrypted backups are rotated within 30 days; data you delete leaves the backups on that schedule. |
| Deletion-request records (section 14) | The confirmation code and status are kept so we can demonstrate the request was honoured. |
12. Security
Everything travels over HTTPS. Tokens, API keys and other secrets are encrypted at rest with AES-256-GCM using a key that is kept on the server outside the database and never sent to a browser. Passwords are hashed with scrypt; sign-in attempts are throttled; sessions use HttpOnly, SameSite cookies. Access inside a workspace is governed by roles, and API keys for AI clients are hashed, scoped to read or act and to specific pages, rate-limited and revocable. Every action is recorded in the activity log. Details are on the security page. If we learn of a breach that affects your data we will notify the affected workspace owners by email without undue delay and within 72 hours of confirming it.
13. Your rights
You can see and change your account and workspace data in the app at any time. You may also ask us to give you a copy of the personal data we hold about you, to correct it, to delete it, to restrict or object to its processing, or to receive it in a portable format, and you may withdraw a consent you gave. Write to [email protected] from the email address on your account; we answer within 30 days. If you are in the EU, UK or another place with a data-protection authority, you may also complain to that authority.
If you are not our customer but your comment or message appears in a customer’s workspace, your request is best addressed to that Page’s owner, who controls what is kept there; you can also write to us and we will pass it on or act on it directly where we can.
14. Deleting your data
You never need to ask us to delete your data — you can do it yourself, and each of the following removes the related data immediately:
- Disconnect a social account (Content → Pages & accounts → Disconnect): the access token or keys are erased at once.
- Delete a page: its posts, media, comments, messages, drafts, knowledge base, people and feedback lists go with it.
- Delete a workspace (owner only, Settings → Delete workspace): every page in it, its team, API keys, activity log and settings.
- Delete your account (Account → Delete account, confirmed with your password): your profile, your sessions and every workspace you own. Workspaces owned by other people keep running without you.
You can also email [email protected] and we will do it for you within 30 days. Payment records that the law requires us to keep are retained in anonymised form.
Facebook users. If you remove Flowmind Social from your Facebook settings or use Facebook’s “Send request” to delete your data, Facebook calls our data-deletion endpoint. You receive a confirmation code and a link to https://smm.flowmind.digital/data-deletion, where you can check whether the request has been received or completed. See the data-deletion page for the full procedure, including how to remove our access on Facebook and Google.
15. Cookies
The service sets one cookie, fm_session (__Host-fm_session over HTTPS), which keeps you signed in for up to 30 days. It is HttpOnly, SameSite and essential — the service does not work without it. We do not use analytics or advertising cookies, tracking pixels or third-party trackers of any kind. Stripe sets its own cookies on its checkout pages under its own policy.
16. Children
The service is for businesses and is not directed at children. You must be at least 18 years old (or the age of majority where you live) to create an account. We do not knowingly collect personal data from children; if you believe a child has given us data, write to us and we will delete it.
17. International transfers
Flowmind Digital is based in Bangladesh. Our servers and the sub-processors listed above may be located in other countries, including the United States and the European Union, and your data may be transferred to and processed in those countries. Where data-protection law requires it, we rely on the sub-processor’s standard contractual clauses or an equivalent safeguard.
18. Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we use your data — for example a new category of data or a new sub-processor that sees content — we will tell workspace owners by email or a notice in the app at least 14 days before it takes effect.
19. Contact
Flowmind Digital
Bagerhat, Khulna, Bangladesh
[email protected] · Contact page