Wtflo

Privacy Policy

Last updated: November 12, 2026

This policy explains what personal information Wtflo collects when you visit our website, fill in a form or use the Wtflo CRM, why we collect it, and the choices you have. We keep it short and plain.

1. Who we are

Wtflo ("Wtflo", "we", "us") provides a customer relationship management (CRM) service for marketing agencies. For information you give us through this website (for example the demo or free-trial form), we are the data controller. For lead data that agencies store in the CRM, the agency is the controller and we process it on their behalf.

2. What we collect

Information you give us

  • Website forms: your name, work email, phone or WhatsApp number, company, team size, what you are interested in, and any message you write.
  • Free trial and account: your name, email address and password (stored only as a secure hash), and workspace settings such as name, timezone and currency.
  • Billing: subscription details. Card and bank details are handled by our payment provider (Razorpay); we do not store them.

Information collected automatically

  • The page you sent a form from and campaign tags in the link (such as utm_source or utm_campaign), so we know which ad or page brought you.
  • Technical data such as IP address, browser type and device, used for security, rate limiting and preventing spam.

Data agencies bring into the CRM

Agencies using Wtflo may store their own leads' information, including Meta (Facebook and Instagram) lead form answers, booking form answers, notes and calendar availability. That data belongs to the agency.

3. How we use it

  • To reply to your enquiry, arrange a demo and help you get started.
  • To create and run your account and provide the CRM features you turn on.
  • To send service emails, such as verification, security alerts, new-lead notifications and billing receipts.
  • To understand which pages and campaigns work, in aggregate, and improve our website and product.
  • To protect the service, prevent abuse and meet legal obligations.

We do not sell personal information. We do not use agencies' lead data for our own marketing.

We process personal information with your consent (for example when you tick the box on our contact form), to perform our contract with you (running your account), for our legitimate interests (securing and improving the service), and where the law requires it. This includes processing in line with India's Digital Personal Data Protection Act, 2023, and, where it applies, the GDPR.

5. Meta and Google data

Data received through Meta and Google APIs is used only to provide the features the agency enables, and is handled in line with the Meta Platform Terms and the Google API Services User Data Policy, including its Limited Use requirements. To request deletion of data received from Meta, see our data deletion page or email us.

6. Who we share it with

We share personal information only with service providers that help us run Wtflo, under contracts that protect it:

  • Cloud hosting and database providers that store the data.
  • Email delivery providers that send service emails.
  • Our payment provider (Razorpay) for subscriptions.
  • Meta and Google, only when an agency connects those accounts and only as needed for the features it uses.

We may also disclose information if required by law or to protect the rights and safety of our users and the public.

7. Cookies and browser storage

This marketing website does not use advertising cookies. It keeps the campaign tags from your first visit in your browser's session storage until you close the tab, so a form you submit later is credited to the right campaign. The Wtflo CRM app uses a secure, essential cookie to keep you signed in.

8. How long we keep it

Enquiries from our website are kept for up to 24 months after our last contact with you, unless you become a customer. Account data is kept while your account is active and deleted within 30 days of a verified deletion request, except where we must keep records (such as invoices) by law.

9. Security

Connections are encrypted with TLS. Passwords are stored as secure hashes and access tokens for connected services are encrypted at rest. Access to an agency's data is limited to members of that agency's workspace and a small number of our staff who need it to provide support.

10. Your rights

You can ask to access, correct or delete your personal information, withdraw consent, or object to how we use it. Email us at hello@wtflo.com and we will respond within 30 days. If you are a lead of one of our agency customers, please contact that agency first; we will help them with your request.

11. Children

Wtflo is a business service and is not intended for anyone under 18. We do not knowingly collect information from children.

12. Changes to this policy

We may update this policy as our service changes. We will change the date at the top and, for significant changes, tell customers by email or in the app.

13. Contact us

Questions or requests about privacy: hello@wtflo.com. See also our Terms of Service.