Last updated: September 1, 2026
Who is responsible? CHICK 1, SLU, trading as FlitFlow, is responsible for personal data used for account administration, billing, security, support, legal compliance and operation of the Service. When FlitFlow processes Instagram interactions and Customer Content to run Customer-configured automations, FlitFlow generally acts on the Customer's instructions under the FlitFlow Data Processing Agreement.
What do we process? Depending on how FlitFlow is used, this includes Customer account and billing information; connected Instagram professional-account information; access tokens; publication metadata; comments, direct messages and Story interactions; automation settings; uploaded images; delivery records; follower-verification results; Saved Links; and link-click events.
Why? To connect Instagram accounts, run Customer-configured automations, deliver requested responses, prevent duplicate or abusive sends, operate subscriptions, secure and support the Service, satisfy legal obligations and improve reliability.
Who receives it? Meta and providers used for hosting, databases, private media storage, queues, payments, support, monitoring and scheduled operations. FlitFlow does not sell personal data.
Your rights: You may exercise applicable access, correction, deletion, restriction, objection and portability rights through Help & Requests or legal@flitflow.app. You may also complain to the Spanish Data Protection Agency or another competent supervisory authority.
The controller for FlitFlow's own processing purposes is:
CHICK 1, SLU, trading as FlitFlow
Valverde 31, 1C, 28004,
Madrid, Spain
Registry: Registro Mercantil de Madrid
Tax identification number: B88395652
Contact and Support form: Help & Requests
“FlitFlow”, “we”, “us” and “our” refer to this entity. “Customer” means the person or organization operating a FlitFlow account. “Instagram user” means a person who comments on, messages or otherwise interacts with an Instagram account connected by a Customer.
FlitFlow is an independent service and is not owned, sponsored or endorsed by Meta Platforms, Inc. or its affiliates (“Meta”).
FlitFlow acts as a controller when it determines why and how personal data is used for account administration, subscriptions and billing, security and abuse prevention, support, service communications, legal compliance and appropriately aggregated service analysis.
For Customer Content and Instagram interactions processed to execute a Customer's configured automations, the Customer generally determines the purpose and essential instructions. In that context, the Customer is normally the controller and FlitFlow acts as its processor under the FlitFlow Data Processing Agreement (“DPA”).
Customers are responsible for providing any notices and establishing any legal basis required for their campaigns and communications. An Instagram user seeking to exercise rights relating to a particular Customer's automation should normally contact that Customer first. The user may also contact FlitFlow, and we will assist or direct the request as appropriate.
FlitFlow does not require or store a Customer's Instagram or Meta password.
FlitFlow's application database does not store the visitor's IP address or raw browser User-Agent in a click-event record. Infrastructure providers may process ordinary request information, including IP address, User-Agent and timestamps, in security or access logs. FlitFlow does not place a tracking cookie for link-click attribution or monitor activity on the destination website. The destination website may conduct its own processing under its own privacy notice.
We obtain data directly from Customers; from Meta through Customer-granted permissions, webhooks and APIs; automatically when the Service or tracked links are used; from our service providers; and from authorized Customer administrators.
Where EU or EEA data-protection law applies, FlitFlow relies on the following legal bases for processing for which it acts as controller:
| Purpose | Legal basis |
|---|---|
| Create and administer accounts, connect Instagram, provide features and manage plans and billing | Performance of a contract or requested pre-contract steps; legitimate interests where the Customer is an organization |
| Execute Customer-configured Instagram automations | Contract and legitimate interests for FlitFlow's controller processing; the Customer determines the basis for processing for which FlitFlow acts as processor |
| Prevent duplicates, apply cooldowns and capacity controls, and recover delivery safely | Contract; legitimate interests in reliable and non-abusive operation |
| Secure the Service and investigate fraud, spam, misuse and unauthorized access | Legitimate interests in protecting Customers, Instagram users, FlitFlow and connected platforms; legal obligation where applicable |
| Provide support and service communications | Contract; legitimate interests in administering and supporting the Service |
| Process payments, invoices, taxes, cancellations and disputes | Contract; legal obligation; legitimate interests in accounting and claims management |
| Process Meta deauthorization and deletion notifications | Contract; legitimate interests; legal obligation where applicable |
| Improve reliability and understand service performance | Legitimate interests in maintaining and improving the Service, using minimization and aggregation where practicable |
| Send optional marketing communications | Consent where required; otherwise legitimate interests where permitted, with an unsubscribe option |
Where we rely on legitimate interests, we assess necessity and the effects on individuals' rights and freedoms. You may request information about the relevant assessment through Help & Requests.
FlitFlow does not sell Instagram data, use it for unrelated advertising profiles, or permit its use for surveillance or sensitive profiling.
A Customer configures the keyword, eligible Instagram location, response, links, images, follower-verification setting and activation state. When Meta sends an eligible interaction, FlitFlow may automatically verify and match the event; apply duplicate, cooldown, capacity and platform-eligibility checks; optionally run follower verification; send the configured response; and record delivery state.
These operations may determine whether and when a response is sent, delayed, suppressed or retried. FlitFlow does not use this automation to make decisions that produce legal or similarly significant effects about Instagram users within the meaning of Article 22 GDPR.
We disclose personal data only as necessary for the purposes described above, including to:
Service providers are subject to appropriate contractual and confidentiality obligations.
FlitFlow does not sell or rent personal data.
Meta and some service providers may process personal data outside Spain, the European Economic Area or the country where the individual is located.
Where required, we rely on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Information about applicable safeguards may be requested through Help & Requests.
We retain personal data only for as long as reasonably necessary to provide and secure the Service, prevent duplicate or abusive activity, provide support, comply with legal obligations, and establish, exercise or defend legal claims.
Data may be retained longer where required by law or necessary for fraud prevention, security, dispute resolution or legal claims.
A Customer may disconnect an Instagram account in FlitFlow. Disconnecting stops the account's automations and FlitFlow's collection of new data through that connection, and clears the Instagram credentials and token information FlitFlow stores locally. FlitFlow keeps the Customer's reusable setup, such as automations, Saved Links and drafts, so the Customer can reconnect later; reconnecting requires fresh Instagram authorization. Previously collected records are retained as described in Section 8 unless the Customer requests deletion under Section 9.2.
Disconnecting in FlitFlow does not remove FlitFlow's permission in Instagram, cancel a subscription or delete the FlitFlow account.
A Customer may request deletion of its FlitFlow account through the Contact and Support form at Help & Requests. We may take reasonable steps to verify the requester's identity and authority.
Following verification, we will delete or anonymize remaining account and configuration data, except for information we must or are permitted to retain for billing, tax, security, fraud-prevention, dispute or legal-claims purposes.
Deleting a FlitFlow account is separate from an individual's exercise of data-protection rights under Section 11.
Meta may notify FlitFlow through separate deauthorization and data-deletion callbacks. They have different triggers, but FlitFlow handles them the same way for the affected Instagram connection. After verifying the callback and the affected identity, FlitFlow stops automation activity and deletes the connected account record, local credentials, Instagram identifiers, account-associated media, interaction and delivery records, and account-specific automation data. Unlike disconnecting in FlitFlow, this deletion cannot be undone: if the Customer connects the account again, it starts fresh.
Security, support and legal-compliance records that FlitFlow keeps are disassociated from the deleted connected account. This behavior may change if Meta requirements or FlitFlow's account model changes; this Notice will be updated before any materially different processing begins.
Meta data-deletion requests receive a confirmation code that can be used to check status at:
https://flitflow.app/data-deletion-status/<confirmation_code>
The status page displays only whether the request is pending, completed, or could not be completed. If a request could not be completed, contact us through Help & Requests.
FlitFlow uses technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss and destruction. These include access controls, encryption in transit, protected credentials and tokens, private storage, request verification, and controls intended to prevent duplicate or unauthorized processing.
No system is completely secure. Customers are responsible for protecting their own credentials and should promptly report suspected unauthorized access through Help & Requests.
Depending on applicable law, you may have the right to:
To exercise a right, use Help & Requests or legal@flitflow.app. We may request information reasonably necessary to verify identity and authority.
In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD) (https://www.aepd.es).
Where FlitFlow acts only as processor, we may refer the request to the relevant Customer and assist it as required by the DPA.
FlitFlow accounts are intended for persons aged 18 or older. Instagram interactions processed on behalf of Customers may nevertheless involve younger users. Customers are responsible for complying with applicable age, consent, privacy and marketing requirements when configuring and operating their automations.
If you believe a child's personal data has been processed unlawfully through FlitFlow, contact us through Help & Requests.
FlitFlow uses cookies and similar technologies necessary to authenticate Customers, maintain sessions and protect the Service. These technologies do not require consent where they are strictly necessary to provide the Service requested by the user.
When someone opens a tracked Saved Link, FlitFlow records limited information so that the Customer can measure link usage. FlitFlow does not store the visitor's IP address or raw User-Agent in the click-event record, does not place a tracking cookie for this purpose and does not monitor activity on the destination website. Hosting or security providers may process ordinary request information in their access or security logs as described in Sections 3.4, 3.5 and 6.
We may update this Notice when the Service, providers or legal requirements change. We will publish the revised version with a new “Last updated” date. Where a change materially affects individuals, we will provide additional notice or request consent where required.
Questions, requests and complaints concerning this Notice or FlitFlow's processing of personal data may be submitted through:
CHICK 1, SLU, trading as FlitFlow
Valverde 31, 1C, 28004, Madrid, Spain
Contact and Support form: Help & Requests
Email: legal@flitflow.app