Privacy Policy
PapayaFlow
Table of Contents
1. Introduction
Welcome to PapayaFlow ("PapayaFlow," "we," "us," or "our").
PapayaFlow provides a software-as-a-service (SaaS) platform that enables businesses, organizations, and individuals to create, configure, deploy, and manage chatbots, automated conversations, and AI-powered workflows.
We respect your privacy and are committed to protecting the personal information you share with us.
This Privacy Policy explains how we collect, use, store, process, disclose, and protect personal information when you access or use our website, application, products, and related services (collectively, the "Services").
This Privacy Policy applies to:
- Visitors to our website.
- Individuals who register for a PapayaFlow account.
- Customers who create or manage chatbots through our platform.
- Individuals who interact with chatbots powered by PapayaFlow, to the extent PapayaFlow processes their information.
- Individuals who communicate with our support or business teams.
By using our Services, you acknowledge this Privacy Policy. Where consent is required by applicable law, we will request it separately.
If you have questions about this Privacy Policy, contact us at info@papayaflow.com.
2. Owner and Data Controller
PapayaFlow is a technology business operating from India.
PapayaFlow determines the purposes and means of processing personal information associated with its own accounts, website, subscriptions, and business operations.
When customers use PapayaFlow to build chatbots and collect information from their own end users, the customer generally determines the purposes of that processing, while PapayaFlow acts as a service provider or data processor on the customer's behalf, subject to applicable law and contractual arrangements.
3. Information We Collect
We may collect the following categories of personal information depending on how you interact with our Services.
3.1 Account and Registration Information
When you create an account or use our Services, we may collect:
- Full name.
- Email address.
- Phone number.
- Business or organization name.
- Account credentials or authentication identifiers.
- Profile information.
- Account preferences and settings.
3.2 Billing and Payment Information
When you purchase a subscription or paid service, we may collect:
- Billing name and address.
- Payment transaction details.
- Subscription plan information.
- Invoice and purchase history.
- Tax-related information where required.
Payments may be processed by third-party payment providers. We do not necessarily receive or store complete payment card information.
3.3 Chatbot and Automation Data
When customers create or operate chatbots using PapayaFlow, the platform may process:
- Chatbot names and configurations.
- Chatbot instructions and conversation flows.
- Automated messages and responses.
- Conversation histories.
- Contact information submitted through chatbots.
- Customer-uploaded documents and knowledge-base content.
- Files, images, and other submitted content.
- Leads and customer information.
- Workflow and integration settings.
- Information exchanged with connected third-party services.
The categories of information processed depend on how customers configure their chatbots and automations.
3.4 Information from Connected Third-Party Platforms
Customers may choose to connect external platforms, applications, or communication channels to PapayaFlow. Depending on the integrations available and authorized, we may process:
- Account identifiers.
- Authentication tokens.
- Connected page or business identifiers.
- Messages and conversation metadata.
- Contact or subscriber information.
- Integration configuration information.
We access and process this information only as necessary to provide authorized functionality, subject to the applicable third-party platform's terms and permissions.
3.5 Automatically Collected Information
When you visit our website or use our application, certain information may be collected automatically, including:
- IP address.
- Browser type and version.
- Device type and operating system.
- Access dates and times.
- Pages visited.
- Application usage information.
- Error reports and diagnostic logs.
- Session information.
- Cookies and similar technologies.
3.6 Communications and Support Information
If you contact us, we may collect your name, email address, message content, attachments, and other information you voluntarily provide.
4. How We Use Personal Information
We may use personal information for the following purposes:
We will not use personal information for purposes incompatible with those described in this Policy without an appropriate legal basis or additional notice where required.
5. Customer Data and Chatbot End Users
PapayaFlow enables customers to create and operate chatbots that interact with their own customers, website visitors, and other individuals ("End Users").
The PapayaFlow customer is generally responsible for determining what information their chatbot collects, the purpose for collecting that information, and the applicable legal basis.
Customers are responsible for:
- Providing appropriate privacy notices to their End Users.
- Obtaining necessary consent or other lawful authorization.
- Configuring their chatbots to collect only appropriate information.
- Responding to End User privacy requests.
- Complying with applicable data protection, consumer protection, and communication laws.
- Ensuring they have the right to upload or process information through PapayaFlow.
PapayaFlow processes customer-controlled information to deliver the services requested by the customer, subject to our agreements, applicable law, and necessary operational or security requirements.
If you interact with a chatbot powered by PapayaFlow and wish to exercise rights concerning information collected by that chatbot, you should generally contact the business operating the chatbot. You may also contact info@papayaflow.com, and we will provide appropriate assistance within our legal and technical responsibilities.
6. Artificial Intelligence and Automated Processing
PapayaFlow may enable customers to use artificial intelligence technologies to generate chatbot responses, analyze messages, process uploaded knowledge, or perform automated workflows.
When these capabilities are enabled, relevant information may be transmitted to third-party AI model providers or other service providers necessary to complete the requested functionality.
Such information may include:
- User prompts and instructions.
- Conversation messages.
- Relevant chatbot configuration.
- Uploaded knowledge-base content.
- Context necessary to generate an AI response.
Third-party AI providers may process this information according to their contractual arrangements, applicable terms, and privacy policies.
Customers should avoid submitting sensitive personal information unless they have a lawful basis, appropriate safeguards, and a legitimate need to do so.
Any use of customer content for AI model training must be governed by the applicable service arrangements, provider terms, and disclosures. PapayaFlow does not represent that information is excluded from third-party AI training unless that exclusion is confirmed for the relevant integration.
9. Data Storage and Security
PapayaFlow uses or intends to use appropriate technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction.
These safeguards may include, as appropriate:
- Encryption during transmission.
- Access controls and authentication.
- Restricted administrative access.
- Security monitoring.
- Infrastructure protection.
- Backup and recovery procedures.
- Software updates and vulnerability management.
- Controls for third-party service access.
No internet-based service or electronic storage system can guarantee absolute security. Users are responsible for protecting their own account credentials and notifying us of suspected unauthorized access.
If we become aware of a personal data breach, we will investigate and provide notifications as required by applicable law.
10. Data Retention
We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy or to comply with applicable legal obligations.
Retention periods may depend on:
- Whether an account remains active.
- Subscription and contractual obligations.
- Customer-controlled retention settings.
- Applicable financial and tax requirements.
- Security and fraud prevention requirements.
- Legal disputes or regulatory obligations.
- Technical backup and deletion processes.
When information is no longer required, we will delete, anonymize, or otherwise securely dispose of it in accordance with applicable law and our retention procedures.
Customers may request account or data deletion by contacting info@papayaflow.com. Certain information may be retained where legally required or necessary for permitted purposes.
11. International Data Transfers
PapayaFlow operates from India but may use service providers or infrastructure located in other countries. As a result, personal information may be stored or processed outside the country in which it was originally collected.
Where applicable, we will implement appropriate safeguards and comply with legal restrictions governing international transfers of personal information. For individuals covered by the GDPR or other international privacy laws, additional transfer requirements may apply.
12. Legal Basis for Processing Personal Information
Where applicable data protection law requires a legal basis, PapayaFlow may process personal information based on:
- Consent: When you have provided valid consent for a specific processing activity.
- Contractual Necessity: When processing is necessary to provide requested services or fulfill contractual obligations.
- Legal Obligations: When processing is required to comply with applicable law.
- Legitimate Interests: Where permitted by applicable law, for activities such as platform security, fraud prevention, and service improvement, provided relevant individual rights are appropriately considered.
Different legal bases may apply depending on the user's jurisdiction and the nature of the processing. These bases are not interchangeable across all jurisdictions.
13. Your Privacy Rights
Depending on your location and applicable law, you may have rights to:
- Request access to personal information held about you.
- Request correction or updating of inaccurate information.
- Request deletion of eligible personal information.
- Withdraw consent where processing is based on consent.
- Object to certain processing activities.
- Request restrictions on certain uses of personal information.
- Request a portable copy of eligible information.
- Submit privacy-related complaints.
- Exercise other rights provided by applicable law.
To submit a privacy request, contact: info@papayaflow.com
We may need to verify your identity before processing a request. We will respond in accordance with applicable legal requirements and may decline or limit requests where permitted or required by law.
14. Privacy Rights Under Indian Law
PapayaFlow is based in India and is subject to applicable Indian data protection and information technology laws.
These include relevant provisions of the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and other applicable laws, as they become enforceable.
Where applicable, individuals may exercise statutory rights concerning access to information about personal data processing, correction, completion, updating, erasure, grievance redressal, and nomination.
PapayaFlow will handle such requests in accordance with the applicable provisions and implementation timelines of Indian law.
Where required by applicable law, individuals may also pursue complaints before the relevant regulatory authority after following the prescribed grievance process.
15. Rights of Users in the European Economic Area and United Kingdom
If you are located in the European Economic Area (EEA) or United Kingdom and the relevant data protection laws apply to our processing, you may have additional rights under the GDPR or UK GDPR.
- Access to your personal information.
- Rectification of inaccurate information.
- Erasure in eligible circumstances.
- Restriction of processing.
- Data portability.
- Objection to certain processing.
- Withdrawal of consent.
- Protection against certain solely automated decisions.
- The right to lodge a complaint with an appropriate supervisory authority.
Where legally required, PapayaFlow will provide additional information about international transfers, responsible representatives, and the applicable processing arrangements. Requests may be sent to info@papayaflow.com.
16. Privacy Rights of California Residents
California residents may have additional rights under applicable California privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act, where those laws apply to PapayaFlow.
- The right to know what personal information is collected.
- The right to access eligible personal information.
- The right to request deletion.
- The right to correct inaccurate information.
- The right to opt out of certain sales or sharing of personal information.
- The right to limit certain uses of sensitive personal information.
- The right not to be unlawfully discriminated against for exercising privacy rights.
PapayaFlow does not intend to sell personal information. If our actual data practices constitute a sale or sharing under applicable law, we will provide the required notices and choices. California residents may contact info@papayaflow.com to submit requests.
17. Children's Privacy
PapayaFlow is intended primarily for businesses and individuals who are legally permitted to use our Services. Our Services are not directed toward children under the age of 18.
We do not knowingly collect personal information directly from children through our own account registration processes without required authorization.
Customers using PapayaFlow to interact with children must comply with applicable laws regarding children's data, including parental consent requirements where relevant.
If you believe a child has provided personal information improperly through our Services, contact info@papayaflow.com. We will review the request and take appropriate action.
18. Third-Party Websites and Services
Our Services may contain links to third-party websites or enable connections to external applications. These third-party services operate under their own privacy policies and terms.
PapayaFlow does not control their independent information processing activities. We recommend reviewing the privacy policies of external services before connecting accounts or sharing personal information.
19. Marketing Communications
PapayaFlow may send newsletters, product announcements, promotional messages, and other marketing communications where permitted by law.
You may opt out of optional marketing emails using the unsubscribe link provided in the message or by contacting info@papayaflow.com.
Even after unsubscribing from marketing communications, you may continue to receive necessary service-related communications, such as account security alerts, payment confirmations, and important platform notices.
20. Data Breaches and Incident Response
PapayaFlow will take appropriate steps to investigate suspected or confirmed security incidents involving personal information.
Depending on the nature of an incident, these steps may include:
- Identifying affected systems and information.
- Containing unauthorized access.
- Assessing the impact.
- Implementing corrective measures.
- Notifying affected parties or authorities where required by applicable law.
We will meet applicable statutory incident reporting and notification obligations.
21. Account Deletion and Data Requests
Users may request deletion of their PapayaFlow account or eligible personal information by sending an email to info@papayaflow.com.
Please include sufficient information to identify the relevant account. After verifying the request, we will process eligible deletion requests in accordance with applicable law and our operational procedures.
Account deletion may result in the loss of access to associated chatbots, configurations, automation workflows, and other account data. Certain records may remain in restricted storage where retention is required or permitted by law, including relevant financial, security, or compliance records.
22. Changes to This Privacy Policy
PapayaFlow may update this Privacy Policy to reflect changes in:
- Applicable laws and regulations.
- Our products and services.
- Data processing practices.
- Security procedures.
- Third-party integrations.
- Business operations.
When changes are made, we will update the "Last Updated" date. Where required by law, we will provide additional notice or obtain consent before implementing material changes. We encourage users to review this Privacy Policy periodically.
23. Governing Law
This Privacy Policy is intended to be interpreted in accordance with applicable laws of India, without limiting mandatory rights individuals may have under the data protection laws of other applicable jurisdictions.
Any contractual dispute-resolution provisions applicable to PapayaFlow's Services may be addressed separately in the Terms of Service.
24. Contact Information
If you have questions, concerns, complaints, or requests regarding this Privacy Policy or our data processing practices, please contact:
We will review privacy-related inquiries and respond as required by applicable law.
© 2026 PapayaFlow. All rights reserved.