1. Introduction
CampaignFlow helps you plan a campaign as a body of work, generate captions and slide copy with a large language model, render slide images, schedule posts, publish them through each platform's official API, and report what published and how it performed.
This policy describes what data CampaignFlow holds, why it holds it, who it is shared with, how long it is kept, and what you can do about it. It covers the CampaignFlow web application at campaignflow.in and the background services that publish on your behalf. It should be read alongside our Terms of Service.
2. Data We Collect
Everything below is either something you typed, something you uploaded, something a platform returned to us, or a record of an action CampaignFlow took for you.
2.1 Account data
Your email address, your full name, and your password. The password is stored as a bcrypt one-way hash — it is never stored in plaintext and cannot be read back by us.
2.2 Brand brief data
All of this is provided by you, and all of it is used to steer drafting and Campaign Guard:
- Brand name, website, and an uploaded logo
- Category and a one-liner describing the brand
- Tone of voice and campaign goals
- Timezone, used to decide when a scheduled post actually goes out
- Target audiences and content pillars
- A CTA ladder, and a “don't say” list of phrases the drafts must avoid
- Brand rules Campaign Guard checks drafts against
2.3 Campaign and post content
Campaigns, posts, per-slide copy, captions, and first comments. We also keep post revisions — the full edit history of a post — along with reviewer feedback and approval decisions, so a campaign can be audited after the fact.
2.4 Media
Images and video you upload, the slide images CampaignFlow renders from your copy, and transcoded video renditions produced to meet each platform's upload requirements. Media is stored in Microsoft Azure Blob Storage.
2.5 Connected accounts and permissions
When you connect a social account, CampaignFlow stores the OAuth access and refresh tokens that platform issues. Those tokens are Fernet-encrypted at rest and decrypted only in memory, at the moment we call the platform's API.
These are the permissions we request, by platform:
| Platform | Permissions requested |
|---|---|
| Instagram (Instagram API with Instagram Login) | instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments |
| Facebook Pages | pages_show_list, pages_manage_posts, pages_read_engagement, pages_read_user_content, pages_manage_engagement |
openid, profile, w_member_social, r_organization_social, w_organization_social | |
| YouTube (Google) | youtube.upload, youtube.readonly, youtube.force-ssl |
| Google Drive (optional) | drive.readonly |
Google Drive is optional and exists only so you can import a file you already have. drive.readonly is used solely to read the files you pick in the import dialog — CampaignFlow does not browse, index or copy the rest of your Drive, and you can use every other part of the product without connecting Drive at all.
2.6 Publishing history
What was scheduled, what published, when it published, the post id the platform returned, and any error the platform returned instead. This is retained as your own record of what actually shipped.
2.7 Public performance data
For Instagram accounts you have connected or linked, we read public engagement metrics — likes, comments, reach and views — along with profile snapshots and media records. For YouTube channels you track, we read public channel snapshots. This is public data, and we collect it to show you what is and isn't working.
2.8 Notification channels
The Slack, Discord and Telegram webhook URLs and the email addresses you configure for alerts. Webhook URLs and notification configuration are encrypted at rest. We also keep a delivery log of what notifications were sent and whether they arrived.
2.9 Data we do not collect
- Direct messages on any connected platform
- Personal data about your followers
- Payment card details
- Precise location
- The private analytics of accounts you have not connected
3. AI and Automated Content Generation
Captions and slide copy are generated by sending your brand brief and your prompt to a large language model provider — Anthropic, OpenAI or Google Gemini, depending on configuration — routed through LiteLLM. We log each call's model, token counts and cost so usage can be accounted for. We do not use customer content to train models.
3.1 Vira, the in-app assistant
Vira answers questions about CampaignFlow and about your own campaigns, schedule and results, and can propose an action that only happens after you confirm it.
- What is processed: the messages you send Vira, the screen you were on when you sent them, and the parts of your workspace (campaigns, posts, schedule, results) that Vira looks up to answer.
- Your conversations are processed by the AI model provider described above, solely to write the reply.
- Conversations are stored for 90 days by default so you can return to them. You can delete one, or all of them, at any time from Vira's history, and deletion is permanent.
- Our administrators see only scrubbed, grouped question text (lower-cased, with emails, links and long numbers removed) and usage counts. They never see your transcripts.
- We do not use your conversations or other content to train our own models.
Vira is an AI assistant and can make mistakes. Check important details before you act on them.
4. How We Use Your Data
| Purpose | Legal basis |
|---|---|
| Creating and authenticating your account | Performance of the contract you entered into with us |
| Drafting captions and slide copy, and checking them against your brand rules | Performance of the contract; your instruction to generate the draft |
| Rendering slide images and transcoding video for each platform | Performance of the contract |
| Publishing scheduled posts to the accounts you connected | Your consent, given when you connected the account and scheduled the post |
| Reading public engagement metrics for connected or tracked accounts | Your consent; our legitimate interest in reporting on what you published |
| Sending notifications to the channels you configured | Your consent, given when you configured the channel |
| Keeping a record of what published and any errors returned | Performance of the contract; our legitimate interest in operating a reliable service |
| Securing the service, investigating abuse, and meeting legal obligations | Legal obligation; our legitimate interest in keeping the service secure |
We do not sell your data and we do not share it for advertising.
5. Data Sharing and Disclosure
5.1 Connected platforms
When you publish, we send the post — its media, caption and first comment — to the platform you selected, through that platform's official API. What happens to it after that is governed by that platform's own terms and privacy policy. We send nothing to a platform you have not connected.
5.2 LLM provider
Your brand brief and your prompt are sent to the configured LLM provider (Anthropic, OpenAI or Google Gemini) for the sole purpose of generating the copy you asked for, as described in section 3.
5.3 Infrastructure processors
- Microsoft Azure — hosting, the PostgreSQL database, and Blob Storage for media
- Azure Communication Services — transactional email, such as approval links and account notices
- The configured LLM provider — caption and slide copy generation
All of these act as processors under contract, on our instructions only, and never as independent users of your data.
5.4 Legal disclosure
We may disclose data where we are required to by law, by a court, or by a lawful request from a competent authority, and where it is necessary to investigate or prevent fraud, abuse, or a threat to the security of the service.
5.5 Business transfer
If the business is sold, merged, or otherwise transferred, your data may transfer with it. It would remain subject to this policy, and we would tell you before it changed.
6. Data Retention
| Data type | Retention |
|---|---|
| Account, brand brief, campaigns and posts | Until account deletion |
| Connected account credentials | Until the account is disconnected, or until account deletion |
| Uploaded media originals | Until you delete them, or until account deletion; never removed by the automatic sweep |
| Rendered slide images | Deleted automatically once every delivery on the post is finished |
| Transcoded video renditions | 7 days after last use |
| Publishing and delivery history | Until account deletion |
| Approval links | Until they expire, or until the post is deleted |
| Vira conversations | 90 days by default; you can delete any or all of them at any time |
7. Data Security
- Passwords are hashed with bcrypt, a one-way function — we cannot recover your password, only verify it.
- Publish tokens and notification configurations are Fernet-encrypted at rest and decrypted only in memory at the moment they are used.
- All traffic between your browser and CampaignFlow is carried over HTTPS/TLS.
- Access tokens are short-lived JWTs. Refresh tokens are stored only as a SHA-256 hash, so a database dump cannot be replayed as a login.
- The OAuth
statevalue is single-use and recorded in the database, so a leaked callback URL cannot be replayed to attach an account.
No method of transmission or storage is 100% secure, and we do not claim otherwise. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law, without undue delay.
8. Your Rights as a Data Principal
Under the Digital Personal Data Protection Act, 2023 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, you have the right to:
- Access the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Have your data erased
- Withdraw consent you previously gave
- Have a grievance heard and resolved by our Grievance Officer
There are three ways to withdraw consent for a connected account:
- Disconnect the account in CampaignFlow, from the Accounts page. This revokes and removes the stored credential immediately.
- Remove the app in Meta's own settings, for Instagram and Facebook.
- Revoke access at myaccount.google.com/permissions, for YouTube and Google Drive.
The step-by-step click paths are on the Unlinking & Data Deletion page.
9. Deleting Your Data
Disconnecting a social account revokes and deletes its stored credential. Deleting your account removes your brand brief, campaigns, posts, media and connected-account credentials on the retention schedule in section 6. If Meta notifies us that you removed CampaignFlow from your Facebook or Instagram account, we delete the associated data on our end as well.
The full procedure, including what to do if you can no longer sign in, is on the Unlinking & Data Deletion page.
10. Children's Privacy
CampaignFlow is not directed at anyone under 18, and we do not knowingly collect data from them. If we discover that an account belongs to someone under 18, we delete it and its data.
11. Grievance Officer
If you have a complaint about how your data has been handled, write to our Grievance Officer:
| Field | Details |
|---|---|
| Name | Shresth Srivastava |
| Registered Office | Lucknow, Uttar Pradesh, India |
| [email protected] | |
| Response time | Acknowledged within 48 hours, resolved within 30 days |
12. Changes to This Policy
Any change to this policy is posted on this page, with the effective date updated at the top. If a change materially affects how your data is handled, we will give you notice in-app before it takes effect.
13. Governing Law
This policy is governed by the laws of India, including the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023. Users are “Data Principals” under that Act.
14. Contact
Questions about this policy, a data request, or anything else: [email protected]. Our Terms of Service cover the rest of the agreement between us.