This Data Handling Policy describes how HeyNaj Flow processes, stores, transmits, secures and supports the handling of customer-controlled data in the Service. Where a customer uses HeyNaj Flow to process information about website visitors, this policy also states the general processing commitments and division of responsibility between the customer and HeyNaj Flow. Read it with our Terms of Service and Privacy Policy.
1. Parties and Status
HeyNaj Flow is an independently operated software platform maintained by Renzhu Rhy Tayko (the “Operator”) under that name in the Philippines. This does not assert that the platform is separately incorporated or holds a particular business registration. Contact: heynajflow@gmail.com.
The Customer is the business, professional, agency or other website operator using HeyNaj Flow with authority over its website, business data and visitor relationships. A visitor is a person interacting with the Customer's website or assistant. A separate written and signed data-processing agreement, if any, may contain additional or controlling terms in accordance with that agreement.
2. Controller and Processor Responsibilities
The Customer generally determines the purposes and essential means for processing visitor inquiries, customer Knowledge and contact details and ordinarily acts as the personal information controller (PIC) or equivalent under applicable law. HeyNaj Flow generally supplies technical processing functions for that purpose and may act as personal information processor (PIP) to that extent. HeyNaj Flow may act as an independent controller for its own accounts, support, installation management, security, legal obligations and community recognition.
Actual legal roles depend on facts and law—not labels alone. The Customer must establish a lawful basis, supply notices, obtain legally required permissions, respond to visitors' rights, maintain accurate business and consent practices, and decide how to follow up. HeyNaj Flow must fulfill the applicable duties of a processor/controller for functions it actually performs. Neither party may transfer criminal or statutory responsibility for its own unlawful conduct to the other merely through these terms.
3. Subject Matter, Purpose, Duration, and People
Subject matter: provision of an AI-assisted customer website widget, saved inquiry and business Knowledge workspace, voice/text interaction, recaps, optional contact capture, source Page URL, customer-configured messaging, installation and support functions.
Purposes: deliver and secure the Service on the Customer's documented settings; respond with approved Knowledge; capture and manage inquiries; provide notifications and customer review; diagnose faults; operate authorized integrations; satisfy legal obligations and protect the Service against abuse.
Duration: while the Customer's active installation and relevant records are maintained, followed by permitted deletion/retention necessary for lawful instructions, operations, security, legal holds and statutory requirements. No universal fixed retention period is established by this document.
People: Customer owners/admins and representatives; visitors to the Customer's widget; persons whose information the Customer submits in approved Knowledge, instructions or communications; and selected recipients of enabled notifications.
Types of personal data: name and contact details where supplied; conversation and transcript content; voice-derived text; follow-up preferences; Page URL; timestamps; inquiry/session identifiers; summaries and categorizations; Internal Notes; business profile data; support material; and relevant technical/security and delivery information. Customers must not introduce sensitive categories without appropriate legal basis and safeguards.
4. Deployment and Data Location
Normal self-service installations use a customer-specific Cloudflare Worker and D1 database in a Cloudflare account controlled by the Customer. This is the primary customer-workspace processing and storage location for inquiries, Knowledge and associated settings/operational records.
A separate HeyNaj Flow Control service manages platform authentication, account/installation records, workspace pairing, setup, authorized configuration access, OAuth or other integration coordination and platform administration. Customer ownership of infrastructure does not mean Control or third parties never handle data. AI, voice, email, browser speech, Web Push, infrastructure and payment providers may process information required by the specific enabled function. Geographic processing can extend outside the Philippines.
Customer deployments may be on different software versions, and a Control update does not necessarily update every customer Worker. Product behavior described as current reflects the accepted universal target, subject to the actual installed version and customer configuration.
5. Processing Only for Authorized Purposes
When operating as a processor, HeyNaj Flow will process Customer Data according to documented lawful Customer instructions conveyed by the Service configuration, applicable policies, and specific authorized support actions, except where applicable law requires or permits another action. Customer instructions cannot compel illegal conduct, unauthorized disclosures, bypass of security safeguards, or conduct contrary to mandatory provider rules. We may refuse or suspend instructions that reasonably appear unlawful or seriously harmful, investigate credible abuse and notify the Customer when appropriate and lawful.
Providing the Service does not mean HeyNaj Flow sponsors, represents, approves, verifies or participates in the Customer's independent business, offers, website content or actions. The Customer is responsible for the legality and accuracy of its products, uploaded Knowledge, visitor notices, collection practices, advertising and follow-up messages. This allocation does not excuse HeyNaj Flow's own negligent or unlawful conduct or mandatory legal duties.
6. Data Categories and Specific Flows
- Visitor interaction: A typed or spoken request results in a session/inquiry record and may create a persistent transcript, recap, category and timestamps.
- Contact: Name, email or phone can be supplied through Required/Soft forms or voluntarily in text/voice and may be associated with the same inquiry. Lead Capture Off does not prevent conversation retention or volunteered contact extraction.
- Knowledge: Customer-approved files, notes and approved Question Review answers are stored in the Customer workspace and eligible material is selected for AI responses.
- Page URL: Embedded sessions generally store source HTTP(S) origin plus pathname at session creation, without query or fragment; attribution can be unknown.
- AI processing: Relevant excerpts of conversation, public business profile, instructions and approved Knowledge are sent to the Customer-selected AI provider for requested generation.
- Notifications: Customer-configured email or Web Push may transmit bounded inquiry information to delivery providers/recipients; a saved email is a delivery-time snapshot and is not updated after sending.
- Support/security: Appropriately authorized operational records may be accessed to diagnose faults, address abuse or comply with valid law.
7. Business Documents and PDF Text Extraction
Accepted new Business Documents are TXT, MD, DOCX and PDF up to 2 MiB each; legacy `.doc` is not newly accepted but previously stored records may remain. The authenticated dashboard extracts selectable text from PDFs in the user's browser using a local Web Worker; the Customer Worker checks ownership, upload type, size and extracted-text bounds, then stores permitted original bytes and searchable text. There is no external PDF-extraction service, AI extraction call or OCR. Image-only/scanned PDFs are not searchable unless selectable text exists. Current PDF processing constraints include 100 pages, 30 seconds and 100,000 extracted characters; reading order may be imperfect.
Uploaded content may subsequently be included as relevant Knowledge in queries to the configured AI provider. A successful index means the text is eligible for retrieval, not that the AI answer is always complete. Customer is responsible for possessing the rights and legal basis to upload and use documents, including any personal information about third parties.
8. AI, Voice, and Automated Categorization
Current modes include Text Only, browser/device Standard Voice (Free) and supported-provider Premium Live Voice. Standard Voice uses browser/device speech functions; recognized speech is submitted through the conversational pathway. Premium can stream relevant audio, transcript and context to OpenAI Realtime or Google Gemini Live when selected and supported by the Customer's provider account.
The Service may produce AI-generated answers and Conversation recaps, preserve explicit visitor contact-channel preferences, and use rules to identify high-intent/priority inquiries or notification eligibility. These are business workflow aids, not authoritative findings about an individual's identity, creditworthiness or other legally significant status. The Customer is responsible for reviewing consequential output.
We do not independently repurpose Customer Data to train a generalized public-facing AI model. This statement is separate from the Customer's selected provider's own data-use agreement and settings. Data handling by providers must be evaluated under the actual provider terms and role.
9. Inquiry Storage, Visibility, and Internal Notes
A real visitor inquiry may remain stored when the visitor leaves, even without contact information. The dashboard currently displays the latest 100 active inquiries as a working set; older records are not automatically deleted simply because they are absent from the visible list. Customer export of loaded/selected records may not include every older record or a complete transcript. Inquiry delete controls are distinct from display filters.
Private Internal Notes are stored for authorized Customer administration and are not automatically used as visitor-visible Knowledge or replies. Original conversation evidence is not silently rewritten when a validated contact field is corrected. The Customer controls lawful access and follow-up by its authorized representatives.
10. Email and Web Push Delivery
Customer email connections may use Google/Gmail/Google Workspace sender authorization or available supported provider adapters (including Microsoft, Resend, Mailgun and Postmark, subject to availability). Inquiry sending is not an inbox-reading function. Separate provider credentials and permissions may be required and provider charges/quotas remain the Customer's responsibility.
An eligible email may contain inquiry metadata, contact fields, source Page URL, recap/summary snapshot and dashboard link. A qualifying anonymous inquiry may alert even if Lead Capture is Off. A later contact update may produce a separate appropriately identified event. Email delivery is subject to deduplication/retry safeguards but cannot be guaranteed exactly once or instantly by external delivery networks.
Web Push requires saved device/browser subscription, permission and eligible settings; push payloads normally use abbreviated generic text rather than full transcripts. Delivery depends on browser/OS and push infrastructure. Published settings presently support Important inquiries only/All inquiries and Email only/Push only/Email and push, not a global None setting. Manual Important/star does not equal automatic high-intent classification.
11. Connected Services and Recipient Categories
Depending on customer selection, relevant service providers may include Cloudflare (runtime/database/network), Google (Gemini, authentication or permitted sending), OpenAI (AI/realtime), supported sender services (such as Microsoft/Resend/Mailgun/Postmark), browser/device speech services and Web Push infrastructure. Optional coffee transactions may be completed through PayPal, Wise, GCash or GoTyme. Not every provider is used for every installation or receives every category of data.
A provider engaged by the Customer directly using its own account may be a Customer-selected independent provider or Customer's processor, rather than a subprocessor appointed solely by HeyNaj Flow. This distinction does not remove obligations HeyNaj Flow actually owes for its own processing. Customers should examine provider terms, permissions and data location choices and avoid connecting accounts they do not have authority to use.
This general category list is not a verified exhaustive contractual list.
12. Authorized Personnel, Confidentiality, and Security
We will use risk-appropriate technical and organizational controls for the processing within our responsibility, including supported authentication/authorization, separation of customer workspace resources, restricted administrative access, public configuration allowlisting, protection of supported stored integration credentials, and controls around authorized deployment operations.
People authorized to access Customer Data for support, maintenance, security, compliance or lawful obligations must use it only for their authorized purpose and be subject to appropriate confidentiality requirements. Sensitive access should be limited, documented as appropriate and revoked when no longer required. We do not disclose private Admin contact fields, sender credentials or Internal Notes as public widget Knowledge merely because they are configured.
We do not claim end-to-end encryption, absolute prevention of breaches, zero vendor retention, universal residency, independently audited certification, or a recovery capability not verified for the applicable installation. Customers control security of their websites, Cloudflare accounts, integrations, provider tokens, own staff devices and locally exported data.
13. Abuse, Fraud, and Unlawful Instructions
Customers must not use the Service to facilitate phishing, fraud, identity theft, unauthorized surveillance, unlawful messaging, exploitation, illegal commerce or collection/disclosure of personal information without lawful authority. Customers must not instruct the assistant to impersonate officials, collect passwords or one-time codes for deception, fabricate professional authorization, or hide illegal activity.
We may review credible abuse reports, preserve evidence where lawful, suspend or restrict the relevant service access, deny unlawful instructions and cooperate with lawful requests by courts, regulators or law enforcement. We do not have a general promise to pre-screen every visitor message, and a technical account is not an endorsement of the Customer. We also will not deliberately conceal incidents or falsify records.
Contractual allocation of customer responsibility and indemnification under the Terms may apply to qualifying third-party civil claims. No provision promises immunity from investigation, prosecution, statutory penalties or the Operator's own misconduct.
14. Incident Response and Breach Notification
We will assess suspected security incidents within our sphere of control, take reasonable containment steps and maintain incident records as appropriate. When we become aware of a personal data breach affecting Customer Data for which we are the processor, we will communicate relevant available information to the Customer without undue delay, as required by applicable law and the facts available, and cooperate reasonably in assessment, containment and legally required notifications.
Under applicable Philippine rules, certain notifiable breaches require notification by the responsible personal information controller to the National Privacy Commission and affected individuals within 72 hours of knowledge/reasonable belief, subject to the rules and permitted exceptions. Each party remains responsible for obligations applicable to it, including cases where HeyNaj Flow is independently the controller. We will not contract away mandatory duties, conceal a notifiable breach or claim that notification is unnecessary merely because the Service is free.
Where possible, relevant notices/assistance may describe affected categories, incident nature, mitigation, timing, available investigation findings and appropriate contact information. Security-sensitive evidence may be disclosed only to authorized persons and as law permits.
15. Data Subject Requests and Regulatory Inquiries
The Customer is generally the primary contact for requests about the Customer's visitor data. We will reasonably assist the Customer in responding to properly validated access, correction, deletion, blocking, portability or objection requests where law requires and the relevant data/function is within our ability to control. We may require sufficient verification before disclosing a transcript or account information. When acting independently as controller, HeyNaj Flow will address requests within its own responsibility.
For legally valid court, regulator and law-enforcement requests, we may preserve or disclose information only within the applicable legal authority and documented process. We may seek clarification or challenge overbroad or invalid demands where lawful. A Customer may not instruct us to destroy evidence subject to a valid preservation duty or conceal unlawful processing.
16. Retention, Return and Deletion
Customer records may remain in the customer-owned D1 and associated resources until a supported deletion action, authorized account/workspace lifecycle process or other lawful instruction takes effect, subject to backups, technical limits and legitimate legal retention obligations. The latest-100 display constraint is not a retention limit. We do not represent that disconnecting an integration deletes existing inquiries, or that deleting local data recalls delivered email, provider records or backups held outside our control.
Where required and feasible, we will provide reasonable means for Customer access, export, deletion or authorized termination handling, subject to available product functionality, security, law and directly controlled infrastructure. Current loaded-row CSV is not a complete database archive or full transcript export. We will not promise an unavailable one-click deletion of every external copy.
If the Customer retains control of Cloudflare resources after termination, the Customer must also manage its own remaining resources and stored data.
17. International Transfers and Location
Enabled infrastructure and providers may transfer or process information across jurisdictions. The customer-owned Cloudflare account is not a guarantee that every AI, voice, notification, authentication or support operation stays within the Philippines or one Cloudflare region. Each party will implement appropriate safeguards when law requires and will accurately communicate its actual selected provider configurations.
18. Assistance, Audit Requests, and Cooperation
Taking account of available information, confidentiality, security and the nature of processing, we will provide reasonable assistance with legally applicable security questions, controller compliance inquiries, privacy impact assessments, incident handling and data subject requests. Requests for invasive tests, production database access, proprietary code, unrelated customers' information or confidential provider records are subject to written authorization, availability, legal limits and appropriate safeguards. Nothing here grants unlimited audit rights or permits access to another customer's workspace.
19. Customer Responsibility, Indemnification, and Non-Waivable Duties
The Customer must independently comply with applicable data protection, consumer, marketing, anti-fraud, content and other laws governing its business and visitor relationships. The Customer is responsible for selecting a lawful basis; displaying notices; gaining required consents; limiting content uploaded into Knowledge; sending lawful messages; responding to legal demands concerning its own conduct; and supervising authorized account users.
The Terms of Service include provisions concerning customer-caused losses, qualifying third-party claims, defense cooperation and limits of liability. Those provisions apply only to the extent enforceable under applicable law. They do not eliminate HeyNaj Flow's own duty to protect data under its control or transfer to a Customer liability attributable to HeyNaj Flow's unlawful acts, gross negligence where non-waivable, willful misconduct or mandatory statutory obligations. A Customer's breach of these terms does not by itself prove a crime; enforcement must be evidence-based and lawful.
20. Changes, Priority, and Contact
This policy may be updated as our processing, vendors, functionality or governing law changes. The effective/updated date shows the published version. Where required by law or an applicable signed agreement, changes affecting processing terms will be communicated and agreed through the necessary process. A separately executed DPA may prevail as stated in that agreement; otherwise the Terms, Privacy Policy and this Data Handling Policy should be read consistently without undermining mandatory rights.
Contact: heynajflow@gmail.com