This page consolidates our Privacy Policy, GDPR Rights Notice, CCPA Privacy Notice (California residents), Third-Party Services Disclosure, and API & Integrations Disclosure.

---

---

1. About This Policy

This Privacy Policy explains how Ecom Flip Limited, operating WOWFLO.AI, collects, uses, stores, and shares your personal data when you use our platform at wowflo.ai.

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable privacy laws in other jurisdictions where our users are located.

Please read this policy carefully. It is important. If you have questions, contact us at info@wowflo.ai.

---

2. Who We Are

Data Controller:
Ecom Flip Limited
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company Number: 13097690
Business Phone: +44 7468 885940
Email: info@wowflo.ai
Website: https://wowflo.ai

As the data controller, Ecom Flip Limited determines the purposes and means of processing your personal data.

We do not currently have a designated Data Protection Officer (DPO). Privacy and data protection inquiries should be directed to info@wowflo.ai.

---

3. Data We Collect

We collect the following categories of personal data:

3.1 Account Data

• Name and email address (when you sign in via a one-time email verification code or Google Sign-In)
• Profile picture (from Google, if you choose Google Sign-In and Google provides it)
• Account preferences and settings
• Login timestamps and IP address

3.2 Usage Data

• Features used and frequency of use
• Content created, saved, and published
• Scheduled posts and publishing history
• Error logs and performance data

3.3 Voice Data (Biometric — see Section 4)

• Voice recordings you provide for voice cloning features
• Voice profile data generated by ElevenLabs from your recordings

3.4 Facial/Image Data (Biometric — see Section 4)

• If you use avatar creation features, you submit facial images or video directly to HeyGen via your own HeyGen account
• WOWFLO.AI does not collect or store your facial or biometric image data. This data is processed by HeyGen on their platform under their own privacy policy, not ours
• See Section 8 for full details of the HeyGen integration model

3.5 Social Media Data

• Instagram account identifier and profile data
• Access tokens issued by Meta for publishing permissions
• Content you choose to publish via the Platform
• Publishing history and scheduling data

3.6 Payment Data

• Subscription status and billing history
• Payment method type (e.g., Visa, Mastercard — but not full card number)
• Billing address
• VAT/tax identification number (enterprise customers)
• Note: full payment card details are processed and stored exclusively by Stripe and are never transmitted to or stored by WOWFLO.AI

3.7 Communications Data

• Emails and messages you send to us
• Support requests and correspondence
• Marketing preferences

3.8 Technical Data

• IP address and approximate location (country/city level)
• Browser type and version
• Operating system
• Device identifiers
• Cookie-consent preferences, consent timestamps, and a pseudonymous browser/account key used to maintain the consent record
• Referral source

3.9 Analytics Data

• Pages viewed and time spent
• Click and interaction data
• Conversion events (collected via Google Analytics — see Section 12)

---

4. Special Category Data (Biometric Data)

This section is important. Please read it carefully.

Under UK GDPR Article 9, biometric data used for the purpose of uniquely identifying a natural person is classified as "special category personal data" and is subject to stricter rules.

WOWFLO.AI's features include:

• Voice cloning (via ElevenLabs): processing voice recordings to create a synthetic voice profile constitutes biometric data processing
• Avatar generation (via HeyGen): processing facial images/video to create a digital avatar may constitute biometric data processing

Legal basis: We process special category biometric data only on the basis of your explicit, freely given, specific, and informed consent, obtained through a dedicated consent screen presented before you access these features for the first time.

You may withdraw your consent at any time by contacting info@wowflo.ai. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Withdrawing biometric data consent will not affect your access to non-biometric Platform features.

HeyGen: When you use avatar features, you are redirected to HeyGen's own website. Biometric data processed on HeyGen's platform is subject to HeyGen's Privacy Policy. You will be required to provide consent to HeyGen directly.

ElevenLabs: Voice recordings you submit for voice cloning are transmitted to ElevenLabs for processing. ElevenLabs' Privacy Policy governs their processing of this data. You are required to provide consent through our Platform before this transmission occurs.

Illinois BIPA Notice (US Users): If you are located in the State of Illinois, the Illinois Biometric Information Privacy Act (BIPA) may apply to you. By using biometric features, you acknowledge that WOWFLO.AI is collecting and transmitting biometric information as described in this section. Biometric data collected is retained only as long as necessary for the purpose for which it was collected and is not sold or disclosed for profit.

---

5. How We Use Your Data

We use your personal data for the following purposes:

---

6. Legal Bases for Processing (UK GDPR)

Under UK GDPR, we must have a lawful basis for processing personal data:

Performance of a Contract (Article 6(1)(b)): Most of our core processing is necessary to provide the Platform to you. When you sign up and use the service, we need your data to perform our contractual obligations.

Legitimate Interests (Article 6(1)(f)): We process certain data where we have a legitimate interest that is not overridden by your rights — including security, fraud prevention, and improving our service. We have conducted legitimate interests assessments for each such use.

Consent (Article 6(1)(a)): We rely on your consent for marketing communications, non-essential cookies, and, in particular, for the processing of special category (biometric) data.

Legal Obligation (Article 6(1)(c)): We may process data where required by law, including for tax, fraud prevention, or regulatory compliance purposes.

Explicit Consent for Special Category Data (Article 9(2)(a)): We process biometric data only on the basis of your explicit consent.

---

7. Third-Party AI Providers

When you use AI-powered features, your data is transmitted to the following third-party processors:

Anthropic, Inc. (Claude)
Role: Script and content generation
Data shared: Text inputs and prompts you provide
Location: United States
Privacy Policy: https://www.anthropic.com/privacy
Note: Anthropic may process data under its API terms. We recommend reviewing Anthropic's data use policies regarding API inputs.

ElevenLabs, Inc.
Role: AI voice synthesis and voice cloning
Data shared: Voice recordings (biometric data), text for synthesis
Location: United States
Privacy Policy: https://elevenlabs.io/privacy
Note: Voice data constitutes biometric data. Transmission occurs only after explicit consent.

HeyGen, Inc.
Role: AI avatar and video generation
Data shared: You connect your own HeyGen account to WOWFLO.AI by entering your personal HeyGen API key. API calls are made using your own key — WOWFLO.AI does not use a shared API key on your behalf.
Location: United States
Privacy Policy: https://www.heygen.com/privacy
⚠️ AI Training Notice: HeyGen's Terms of Service (Section 3) grant HeyGen a licence to use content you create on their platform — including avatars and videos — to train and improve their AI models. This applies to all paid HeyGen plan users. By connecting your HeyGen account and creating content through it, you accept HeyGen's data use terms directly. WOWFLO.AI has no control over HeyGen's use of your content for training purposes.

---

8. HeyGen and Biometric Processing

HeyGen avatar features work as follows: you connect your personal HeyGen account to WOWFLO.AI by entering your own HeyGen API key in your account settings. WOWFLO.AI then makes API calls on your behalf using your key — there is no shared WOWFLO.AI API key. This means:

• You hold a direct contractual relationship with HeyGen under their own Terms of Service
• You accept HeyGen's Terms of Service and Privacy Policy when you create your HeyGen account
• Your facial/biometric data submitted to HeyGen is governed by HeyGen's privacy policy
• Ecom Flip Limited does not store your facial data on our servers
• Your HeyGen API key is stored encrypted in our systems and used solely to execute the API calls you instruct us to make

HeyGen AI Training. HeyGen's Terms of Service grant HeyGen a broad licence to use content you create on their platform to train and improve their AI models. Specifically, HeyGen's Terms state that you grant HeyGen a licence to use Your Content "to train or otherwise improve or modify our artificial intelligence and machine learning models." This is HeyGen's own policy and applies independently of WOWFLO.AI. We disclose this so you can make an informed decision before connecting your HeyGen account. If you have concerns about AI training use of your content, review HeyGen's current privacy policy at https://www.heygen.com/privacy and their data settings where available.

---

9. ElevenLabs and Voice Data

Voice recordings you submit for voice cloning are:

• Transmitted to ElevenLabs via their API
• Processed by ElevenLabs to create a synthetic voice model
• Stored by ElevenLabs as a "voice" in your ElevenLabs profile (subject to their terms)
• Used to generate voiceovers for your content

We transmit voice data to ElevenLabs only:

• After obtaining your explicit consent
• For the specific purpose of generating your voiceover content
• In accordance with ElevenLabs' API terms

ElevenLabs' data use, retention, and deletion practices are governed by their privacy policy. We encourage you to review it at https://elevenlabs.io/privacy.

---

10. Instagram and Meta Data

Instagram Permissions We Request. WOWFLO.AI requests the following Instagram Graph API permissions, and only these:

• instagram_basic — to read your Instagram account username and profile information, so we can display your connected account within the Platform.
• instagram_content_publish — to publish media (photos, videos, Reels) to your Instagram feed and stories on your behalf, when you instruct us to do so.
• pages_read_engagement — to read engagement data for content published via the Platform, where analytics features are enabled.

We do not request permission to read your direct messages, access your follower list beyond what is needed to display your account, or manage your Instagram account settings.

How we use these permissions. Each permission is used solely to provide the Instagram publishing and scheduling functionality described in our Terms of Service. We do not use these permissions for any other purpose.

OAuth Access Tokens. When you connect your Instagram account, Meta issues us an OAuth 2.0 access token representing your authorisation. This token grants us only the specific permissions you approved. You can revoke this token and disconnect WOWFLO.AI from your Instagram account at any time via Instagram Settings → Security → Apps and Websites.

When you connect your Instagram account:

• We receive an access token from Meta that authorises us to publish on your behalf
• We read your basic profile information to display your connected account
• We transmit your content to Instagram's API to publish or schedule posts

Access Token Storage: Instagram access tokens are stored in encrypted form on our AWS infrastructure. Tokens are used solely for the purpose of publishing content on your behalf as instructed by you.

Token Deletion: We delete your access token immediately upon: (a) your disconnection of your Instagram account; or (b) deletion of your WOWFLO.AI account.

Data Returned by Meta: We do not store insights, follower data, or other Instagram data beyond what is necessary to operate the publishing feature.

Meta's Processing: Your use of Instagram is governed by Meta's Privacy Policy: https://privacycenter.instagram.com/policy. We are a data controller for our use of your Instagram data; Meta is a separate, independent data controller.

---

11. Stripe and Payment Data

Payment processing is handled exclusively by Stripe, Inc. When you make a payment:

• You enter your payment details directly into Stripe's secure payment interface
• We never see, process, or store your full payment card details
• We receive from Stripe only the payment status and last 4 digits of your card for display purposes
• Stripe processes your payment data as an independent data controller under its own Privacy Policy: https://stripe.com/gb/privacy

---

12. Analytics and Tracking

We use Google Analytics to understand how users interact with our Platform. Google Analytics uses cookies and similar tracking technologies to collect anonymised or pseudonymised usage data.

The information collected by Google Analytics includes page views, session duration, user journeys, and device information. This data is used to improve the Platform.

We will obtain your consent for Google Analytics cookies via our cookie banner before any tracking begins. You can opt out at any time through our Cookie Settings.

For more information, see our Cookie Policy.

---

13. Sharing Your Data

We do not sell your personal data.

We share your data only in the following circumstances:

Service Providers (Data Processors): We engage trusted third-party service providers who process data on our behalf, including AWS (cloud hosting), Stripe (payments), Anthropic, ElevenLabs, and analytics providers. All processors are bound by data processing agreements and may only process data on our instructions.

Third-Party Platforms (Independent Controllers): When you use integrations with HeyGen or Meta/Instagram, those companies process your data as independent data controllers under their own privacy policies.

Legal Requirements: We may disclose data to comply with a legal obligation, court order, or regulatory request from a competent authority.

Business Transfer: In the event of a merger, acquisition, or sale of our business, personal data may be transferred as part of the transaction. We will notify you before your data is subject to a materially different privacy policy.

With Your Consent: We may share data for other purposes with your explicit consent.

---

14. International Data Transfers

Ecom Flip Limited is based in the United Kingdom. Our primary cloud infrastructure is hosted on Amazon Web Services (AWS) in the United Kingdom (eu-west-2, London region).

Some of our third-party service providers are located outside the UK/EEA, including in the United States:

• Anthropic (US): Data transferred under UK International Data Transfer Agreement (IDTA) or equivalent approved safeguards. We rely on Anthropic's standard contractual commitments for API customers.
• ElevenLabs (US): Data transferred under UK IDTA or equivalent approved safeguards.
• HeyGen (US): You interact with HeyGen directly using your own API key; your relationship with HeyGen is governed by their own policies and privacy programme.

Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs), Standard Contractual Clauses (SCCs), or reliance on adequacy decisions.

CIS Countries: If you are located in a country that has its own data localisation requirements, please be aware that our primary data storage is in the United Kingdom. Users from countries with strict data localisation laws should review their local requirements before using the Platform.

---

15. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

After the applicable retention period, data is permanently deleted or anonymised. We recommend downloading your content before deleting your account.

---

16. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15): You can request a copy of all personal data we hold about you.

Right to Rectification (Article 16): You can request correction of inaccurate or incomplete personal data.

Right to Erasure (Article 17): You can request deletion of your personal data in certain circumstances (the "right to be forgotten").

Right to Restriction of Processing (Article 18): You can request that we limit how we use your data in certain circumstances.

Right to Data Portability (Article 20): You can request your personal data in a structured, machine-readable format.

Right to Object (Article 21): You can object to processing based on legitimate interests, including profiling.

Right to Withdraw Consent: Where processing is based on consent (including biometric data), you can withdraw consent at any time.

Rights Related to Automated Decision-Making: You have rights regarding automated decision-making and profiling.

How to Exercise Your Rights: Submit your request to info@wowflo.ai. We will respond within 30 days. In complex cases, we may extend this by a further 2 months (with notice).

We may ask you to verify your identity before processing your request.

---

17. Children's Privacy

The Platform is not directed at persons under the age of 18. We do not knowingly collect personal data from children under 18. If you become aware that a child under 18 has provided us with personal data, please contact info@wowflo.ai and we will take steps to delete that data.

---

18. Data Security

We take the security of your personal data seriously. Our security measures include:

• Encryption of data in transit (TLS/SSL)
• Encryption of data at rest on AWS infrastructure
• Encrypted storage of Instagram access tokens and API keys
• Access controls and authentication requirements for staff access to data
• Regular security reviews and updates

Despite these measures, no internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security but will notify you and the ICO of any data breach within 72 hours where required by law.

See our Security & Data Protection Statement for more details.

---

19. Cookies

We use cookies and similar technologies on the Platform. We obtain your consent before setting any non-essential cookies.

See our Cookie Policy for full details of the cookies we use and how to manage them.

---

20. Marketing Communications

If you have opted in to marketing communications, we may send you emails about new features, promotions, and updates.

You can opt out of marketing emails at any time by:

• Clicking "Unsubscribe" in any marketing email
• Updating your preferences in your account settings
• Emailing info@wowflo.ai

Opting out of marketing communications will not affect transactional emails related to your account or subscription.

---

21. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email and by posting an updated version on our website. The effective date at the top of this policy will reflect when it was last updated. Where changes are significant, we will seek fresh consent where required.

---

22. Contact and Complaints

For privacy inquiries or to exercise your rights:
Email: info@wowflo.ai
Post: Ecom Flip Limited, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, UK

Supervisory Authority: If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Phone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint

If you are in the European Economic Area, you may also lodge a complaint with your local data protection authority.

---

---

Your Data Protection Rights (GDPR Rights Notice)

Applicable to users in the United Kingdom, European Economic Area, and Switzerland.

Applicable to: Users in the European Economic Area (EEA), United Kingdom, and Switzerland

---

Your Data Protection Rights Under UK GDPR and EU GDPR

Ecom Flip Limited, operating WOWFLO.AI, is committed to respecting your data protection rights. This notice explains your rights under the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR, Regulation 2016/679), and applicable national data protection law.

---

1. Right of Access (Article 15)

What it means: You have the right to request a copy of all personal data we hold about you, and information about how we use it.

What we provide:

• Confirmation of whether we process your personal data
• A copy of the personal data we hold
• Information about the purposes of processing, categories of data, recipients, retention periods, and your rights
• Information about automated decision-making (if applicable)

How to exercise: Email info@wowflo.ai with subject "Subject Access Request" and proof of identity.

Timescale: Response within 30 calendar days (extendable by a further 2 months for complex requests, with notice).

---

2. Right to Rectification (Article 16)

What it means: You have the right to request correction of inaccurate personal data and completion of incomplete data.

How to exercise: Email info@wowflo.ai or update your details in account settings.

Timescale: Response within 30 calendar days.

---

3. Right to Erasure ("Right to Be Forgotten") (Article 17)

What it means: You have the right to request deletion of your personal data where:

• The data is no longer necessary for the purpose for which it was collected
• You withdraw consent (where processing was based on consent)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Deletion is required by law

Limitations: We may decline erasure where we are required to retain data for legal obligations (e.g., tax records), legal claims, or other legitimate grounds under Article 17(3).

How to exercise: Email info@wowflo.ai with subject "Erasure Request – GDPR Article 17". See also our User Data Deletion Policy.

Timescale: Response within 30 calendar days.

---

4. Right to Restriction of Processing (Article 18)

What it means: You have the right to request that we restrict how we use your data in specific circumstances:

• You contest the accuracy of the data (while we verify)
• Processing is unlawful but you prefer restriction over deletion
• We no longer need the data but you need it for legal claims
• You have objected to processing (while we assess the grounds)

Effect: We will store the data but not otherwise process it until the restriction is lifted.

How to exercise: Email info@wowflo.ai with subject "Restriction Request – GDPR Article 18".

---

5. Right to Data Portability (Article 20)

What it means: You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another service provider, where:

• Processing is based on consent or performance of a contract; AND
• Processing is carried out by automated means

What we can provide: Account data and generated content in a standard format (JSON or CSV).

How to exercise: Email info@wowflo.ai with subject "Data Portability Request – GDPR Article 20".

Timescale: Response within 30 calendar days.

---

6. Right to Object (Article 21)

What it means: You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Direct marketing: If you object to your data being used for direct marketing, we will stop immediately.

Legitimate interests: If you object to processing based on our legitimate interests, we will stop unless we can demonstrate compelling legitimate grounds that override your interests.

How to exercise: Email info@wowflo.ai with subject "Objection to Processing – GDPR Article 21".

---

7. Right to Withdraw Consent (Article 7(3))

What it means: Where we process your data based on your consent (including for biometric data processing, marketing emails, and non-essential cookies), you may withdraw that consent at any time.

Effect: Withdrawal does not affect the lawfulness of processing before withdrawal.

Biometric data (voice/avatar): Withdrawing consent for biometric processing will prevent you from using voice cloning and avatar features but will not affect your access to other Platform features.

How to exercise:

• Marketing consent: Click "Unsubscribe" in any marketing email or email info@wowflo.ai
• Cookie consent: Click "Cookie Settings" in our website footer
• Biometric consent: Email info@wowflo.ai with subject "Withdraw Biometric Consent"

---

8. Rights Related to Automated Decision-Making and Profiling (Article 22)

What it means: You have the right not to be subject to decisions based solely on automated processing (including profiling) that significantly affect you.

Our position: WOWFLO.AI does not currently make significant automated decisions about you that produce legal or similarly significant effects. If this changes, we will update this notice.

---

9. How to Submit a Rights Request

Email: info@wowflo.ai
Subject line: Please use the relevant subject line as specified above
Include: Your full name, account email address, and a description of your request
Identity verification: We may ask you to verify your identity before processing your request to protect against unauthorised access to your data

Response time: We will acknowledge your request within 5 working days and respond fully within 30 calendar days. For complex or numerous requests, we may extend by a further 2 months — we will notify you if this applies.

Free of charge: Exercising your rights is free of charge. If requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline — and we will explain why.

---

10. Supervisory Authority

If you are dissatisfied with our handling of your rights request, you have the right to lodge a complaint with a supervisory authority:

United Kingdom:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint
Online complaint form: https://ico.org.uk/make-a-complaint/

European Union (if you are in the EEA):
You may lodge a complaint with the data protection authority in your EU country of residence or place of work. A list of EU data protection authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

You also have the right to an effective judicial remedy against us or against a supervisory authority.

---

11. Legal Basis Summary

---

Contact

Data Controller:
Ecom Flip Limited
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company Number: 13097690
Email: info@wowflo.ai

---

---

California Residents — CCPA/CPRA Privacy Notice

Applicable to residents of the State of California, United States.

Applicable to: Residents of the State of California, United States

---

Notice Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

This notice supplements our Privacy Policy and applies solely to visitors, users, and others who reside in the State of California ("consumers"). It is provided in accordance with the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA).

---

1. Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information from California consumers:

---

2. Purposes for Which Personal Information Is Used

We use your personal information for the following business or commercial purposes:

• Providing, maintaining, and improving WOWFLO.AI
• Processing payments and managing subscriptions
• Authenticating users and preventing fraud
• Communicating with you about your account
• Sending marketing communications (with your consent)
• Analytics and service improvement
• Complying with legal obligations

---

3. Categories of Personal Information Disclosed for a Business Purpose

In the past 12 months, we have disclosed the following categories of personal information to third parties for business purposes:

---

4. Sale or Sharing of Personal Information

We do not sell your personal information. We do not sell the personal information of California consumers, including minors under 16 years of age, for monetary or other valuable consideration.

We do not share personal information for cross-context behavioural advertising unless you have opted in or as otherwise permitted by applicable law.

If you wish to opt out of any future sharing for cross-context behavioural advertising (e.g., when we enable Meta Pixel), you may do so via our Cookie Settings or by emailing info@wowflo.ai with the subject "Do Not Share My Personal Information."

---

5. Your California Privacy Rights

As a California resident, you have the following rights under CCPA/CPRA:

Right to Know (§ 1798.100)

You have the right to request that we disclose:

• The categories of personal information collected
• The sources from which we collected it
• Our business or commercial purpose for collecting it
• The categories of third parties with whom we share it
• The specific pieces of personal information we hold about you

Right to Delete (§ 1798.105)

You have the right to request deletion of personal information we have collected from you, subject to exceptions.

Right to Correct (§ 1798.106)

You have the right to request correction of inaccurate personal information we hold about you.

Right to Opt Out of Sale/Sharing (§ 1798.120)

You have the right to opt out of the sale or sharing of your personal information for cross-context behavioural advertising.

Right to Limit Use of Sensitive Personal Information (§ 1798.121)

You have the right to direct us to limit our use of your sensitive personal information (including biometric data) to what is necessary to perform the services.

Right to Non-Discrimination (§ 1798.125)

We will not discriminate against you for exercising your CCPA/CPRA rights. We will not:

• Deny you goods or services
• Charge you a different price
• Provide a different quality of service
• Suggest that you will receive a different price or quality

---

6. How to Submit a California Privacy Rights Request

Email: info@wowflo.ai
Subject line: "California Privacy Rights Request"
Include: Your full name, account email address, and description of your request

Verification: We will verify your identity before processing your request to protect against unauthorised requests. We may ask for your account email address and other identifying information.

Authorised Agent: You may submit a request through an authorised agent. We will require proof of the agent's authority and may verify your identity directly.

Response time: We will acknowledge within 10 business days and respond fully within 45 calendar days. We may extend by a further 45 days where necessary, with notice.

Frequency: You may submit a Right to Know or Right to Delete request no more than twice in a 12-month period.

---

7. Biometric Information Notice (CCPA + Illinois BIPA Context)

We collect biometric information in the form of voice recordings when you use our voice cloning feature. This data is:

• Collected only with your explicit consent
• Used solely to generate synthetic voiceovers for your content
• Transmitted to ElevenLabs for processing
• Not sold or disclosed for profit
• Retained only as long as necessary

You may withdraw consent for biometric data collection at any time by contacting info@wowflo.ai.

---

8. "Shine the Light" Disclosure (California Civil Code § 1798.83)

California residents may request, once per year, information about personal information shared with third parties for those third parties' direct marketing purposes. We do not share your personal information with third parties for their direct marketing purposes.

---

9. Contact for California Privacy Requests

Ecom Flip Limited
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: info@wowflo.ai
Subject: "California Privacy Rights Request"

We provide this notice as part of our commitment to California privacy standards, irrespective of current revenue thresholds.

---

---

Third-Party Services Disclosure

A full list of third-party services used by WOWFLO.AI and how they interact with your data.

---

Overview

WOWFLO.AI integrates with and relies upon a number of third-party services to deliver its functionality. This disclosure provides transparency about which third-party services we use, their role in the Platform, and how they interact with your data.

Using WOWFLO.AI means you may interact with or have data processed by the services described below. We encourage you to review the terms and privacy policies of each provider.

---

Core Infrastructure

Amazon Web Services (AWS)

Role: Cloud hosting and data storage
What it processes: All Platform data, including user account data, generated content, and encrypted access tokens
Data location: eu-west-2 (London, United Kingdom)
Privacy Policy: https://aws.amazon.com/privacy/
DPA: AWS Data Processing Agreement in place

---

Payment Processing

Stripe, Inc.

Role: Payment processing, subscription management, and billing
What it processes: Payment card details, billing address, subscription status, invoicing
Important: WOWFLO.AI does not store your payment card details. All payment data is handled exclusively by Stripe.
Stripe's compliance: PCI-DSS Level 1 certified
Privacy Policy: https://stripe.com/gb/privacy
Terms: https://stripe.com/gb/legal
DPA: Stripe Data Processing Agreement in place

---

AI Content Generation

Anthropic, Inc. (Claude)

Role: AI-powered script and content generation
What WOWFLO.AI sends to Anthropic: Text prompts you provide; your content topics and preferences
What Anthropic does NOT receive: Your payment details, Instagram credentials, or biometric data
Does Anthropic train on your data? Anthropic's API terms provide that by default, API inputs are not used to train models. See Anthropic's privacy policy for current details.
Privacy Policy: https://www.anthropic.com/privacy
Terms: https://www.anthropic.com/legal/consumer-terms

ElevenLabs, Inc.

Role: AI voice synthesis and voice cloning
What WOWFLO.AI sends to ElevenLabs: Voice recordings (biometric data — your explicit consent is required before transmission); text for voice synthesis
Important: Voice recordings constitute biometric personal data. Transmission occurs ONLY after you provide explicit consent via our dedicated consent screen.
Data location: United States (data transfer safeguards in place)
Privacy Policy: https://elevenlabs.io/privacy
Terms: https://elevenlabs.io/terms

HeyGen, Inc.

Role: AI avatar generation and synthetic video creation
How it works: You are redirected from WOWFLO.AI to HeyGen's own website to use avatar features. HeyGen is an independent service; you contract directly with HeyGen.
Important: Your HeyGen account is separate from WOWFLO.AI. Facial/biometric data you submit to HeyGen is processed under HeyGen's terms, not ours.
WOWFLO.AI's relationship with HeyGen: WOWFLO.AI is not a reseller, agent, or affiliate of HeyGen. We provide navigation and integration; HeyGen provides the avatar service directly to you.
Privacy Policy: https://www.heygen.com/privacy
Terms: https://www.heygen.com/terms

---

Social Media Integration

Meta Platforms / Instagram

Role: Instagram content publishing integration
What WOWFLO.AI accesses: Instagram account identifier, access token for publishing, published content data
What WOWFLO.AI publishes: Content you schedule or instruct us to publish to your Instagram account
Access Token: Stored encrypted; deleted immediately on account disconnection or deletion
Instagram API compliance: We use the Instagram Graph API in accordance with Meta's Platform Terms
Meta Privacy Policy: https://privacycenter.instagram.com/policy
Meta Platform Terms: https://developers.facebook.com/terms

---

Authentication

Google LLC

Role: Optional user authentication when you choose Google Sign-In
What it processes: Your Google account email and basic profile information used for sign-in
What WOWFLO.AI stores: Your email address, display name, and profile picture URL returned by Google, where available
Privacy Policy: https://policies.google.com/privacy
Terms: https://policies.google.com/terms

---

Analytics

Google Analytics (Google LLC)

Role: Website usage analytics
What it collects: Anonymised/pseudonymised usage data — pages visited, session duration, user journey, device type
Consent: Analytics cookies are only placed after you consent via our cookie banner
Opt-out: https://tools.google.com/dlpage/gaoptout
Privacy Policy: https://policies.google.com/privacy

---

Advertising and Marketing Services

Meta Pixel

Role: Advertising measurement and retargeting (planned)
Status: Not yet implemented; will only be activated after obtaining cookie consent
Privacy Policy: https://www.facebook.com/privacy/policy

Email Communications and Marketing Delivery

Role: Transactional and marketing email delivery
Current delivery infrastructure: SendGrid
Status: Account-level marketing opt-in and unsubscribe handling are implemented. Marketing emails are sent only to users who have explicitly opted in.
What it processes: Your email address and marketing preferences
Consent: Email marketing only to users who have explicitly opted in

---

Changes to Third-Party Services

We may add, remove, or change third-party service providers over time. Where changes materially affect data processing or your rights, we will notify you via email or update this disclosure with the effective date.

---

Contact

For questions about third-party services:
Email: info@wowflo.ai
Post: Ecom Flip Limited, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, UK

---

---

API & Integrations Disclosure

Technical details about the API integrations that power WOWFLO.AI.

---

Overview

This disclosure explains the API integrations that power WOWFLO.AI, what data flows through each integration, and your rights and responsibilities when using integrated services.

---

1. Instagram Graph API (Meta Platforms)

Purpose: Enables WOWFLO.AI to publish and schedule content to your Instagram account on your behalf.

How it works:

1. You connect your Instagram account by granting WOWFLO.AI permission via Meta's OAuth flow
2. Meta issues an access token that authorises WOWFLO.AI to perform specific actions
3. WOWFLO.AI uses this token to publish or schedule content when you instruct it to do so

Permissions we request:

• instagram_basic — to read your Instagram account information
• instagram_content_publish — to publish media to your Instagram feed and stories
• pages_read_engagement — to read engagement data (if analytics features are enabled)

What we do NOT request:

• We do not request permission to read your Instagram messages (DMs)
• We do not request permission to read your followers list beyond what is necessary
• We do not request permission to manage your Instagram account settings

Data retained from Instagram:

• Your Instagram user ID and username
• Your encrypted access token
• Publishing history (content published via the Platform, timestamps)

Revoking access:

• Via WOWFLO.AI account settings → Integrations → Disconnect Instagram
• Via Instagram settings → Security → Apps and Websites → Remove WOWFLO.AI

Meta App Review: WOWFLO.AI's use of the Instagram Graph API is subject to Meta App Review. Our application has been reviewed and approved by Meta to use the permissions listed above.

Compliance: Our use of the Instagram Graph API complies with Meta's Platform Terms: https://developers.facebook.com/terms

---

2. Anthropic API (Claude)

Purpose: Powers AI script and content generation features in WOWFLO.AI.

How it works:

1. You enter a prompt, topic, or content brief
2. WOWFLO.AI transmits your input to Anthropic's API
3. Claude generates a script or content output
4. WOWFLO.AI displays the output to you

Data transmitted to Anthropic:

• Your text prompts and content inputs
• Contextual parameters (content type, tone preferences)

Data NOT transmitted to Anthropic:

• Your email or account data
• Payment information
• Instagram credentials
• Biometric data

Anthropic's data use: Anthropic does not use API inputs to train models by default. See Anthropic's privacy policy for full details: https://www.anthropic.com/privacy

Compliance: Our use of Anthropic's API complies with Anthropic's API Terms: https://www.anthropic.com/legal/consumer-terms

---

3. ElevenLabs API

Purpose: Powers AI voice synthesis and voice cloning features.

How it works:

1. You submit a text for synthesis, or a voice recording for cloning
2. WOWFLO.AI transmits this to ElevenLabs' API
3. ElevenLabs generates audio output or creates a voice model
4. The audio is returned to WOWFLO.AI and made available to you

⚠️ Biometric Data: Voice recordings submitted for voice cloning are biometric personal data. Transmission to ElevenLabs occurs ONLY after you provide explicit, informed consent through our dedicated consent screen.

Data transmitted to ElevenLabs:

• Text for synthesis
• Voice recordings (biometric — consent required)
• Voice model settings

Your rights regarding ElevenLabs data:

• You can manage and delete your voice models through your ElevenLabs account at https://elevenlabs.io/settings
• Contact info@wowflo.ai if you need assistance with ElevenLabs data deletion

Compliance: Our use of ElevenLabs' API complies with ElevenLabs' API Terms: https://elevenlabs.io/terms

---

4. HeyGen (Redirect Integration)

Purpose: Enables access to AI avatar generation and synthetic video features.

Important distinction: Unlike our other integrations, HeyGen is not a standard API integration. Rather:

• You are redirected from WOWFLO.AI to HeyGen's own website
• You register and pay for HeyGen services directly on HeyGen's platform
• Your HeyGen account is separate and independent from your WOWFLO.AI account
• WOWFLO.AI acts as a content hub that allows you to use HeyGen-generated content in your workflow

Data flow:

• WOWFLO.AI does not transmit your personal or biometric data to HeyGen on your behalf
• You submit data (including facial images/video) directly to HeyGen
• HeyGen processes your data under their own terms and privacy policy

Why this model?

• Users maintain direct control over their HeyGen account and data
• HeyGen's terms and privacy policy govern your use of their service
• This ensures clarity about who is responsible for biometric data processing

HeyGen's Terms: https://www.heygen.com/terms
HeyGen's Privacy Policy: https://www.heygen.com/privacy

---

5. Stripe API

Purpose: Payment processing, subscription management, and billing.

How it works:

• WOWFLO.AI uses Stripe's client-side libraries (Stripe.js) to collect payment information directly in your browser
• Card details are sent directly from your browser to Stripe — they never pass through WOWFLO.AI's servers
• Stripe returns a payment token, which WOWFLO.AI uses to manage subscriptions

Data transmitted to Stripe:

• Payment card details (via Stripe.js, directly from your browser)
• Billing name and address
• Email address (for receipt delivery)
• Subscription and billing parameters

WOWFLO.AI stores from Stripe:

• Stripe customer ID
• Subscription status
• Payment method type and last 4 digits (for display only)
• Billing history

Compliance: Stripe is PCI-DSS Level 1 certified. Our integration complies with Stripe's API terms: https://stripe.com/gb/legal

---

6. Google Sign-In API (Optional)

Purpose: Optional user authentication when you choose Google Sign-In.

How it works:

1. You click "Sign in with Google"
2. Google authenticates your identity
3. Google returns basic profile information (name, email, profile picture) to WOWFLO.AI
4. WOWFLO.AI creates or accesses your account using this information

Data received from Google:

• Your email address
• Your display name
• Your profile picture URL

WOWFLO.AI also supports sign-in via a one-time verification code sent to your email address. That email-based sign-in flow does not require Google account access.

We do not:

• Access your Gmail
• Access your Google Drive
• Access any Google service beyond your basic profile

Compliance: Our use of Google OAuth complies with Google's API Terms: https://developers.google.com/terms

---

Your Rights Across All Integrations

For any integration, you have the right to:

• Revoke access at any time
• Request deletion of data held by WOWFLO.AI
• Contact each provider directly to request deletion of data they hold

See our User Data Deletion Policy for detailed instructions.

---

Contact

For questions about integrations and API data use:
Email: info@wowflo.ai
Post: Ecom Flip Limited, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, UK