Privacy Policy
This page describes what RealtiFlow stores, why it stores it, how long it keeps it, and which other companies see it. It was written by reading the code that runs the service, so it describes what the software actually does rather than what a privacy template usually says.
1. Who we are
RealtiFlow is a service that turns messages posted in WhatsApp real-estate groups into a searchable property list. The service is operated under the name RealtiFlow. To contact the operator, write to realtiflow.app@gmail.com.
2. What you give us when you create an account
- Your email address, and the display name on your account.
- If you sign in with Google, Google confirms your identity to us. We receive your email address and the basic profile Google releases for sign-in. We do not receive your Google password.
- Your password is never stored by us. Sign-in is handled by Google Firebase Authentication; we only verify the signed token Firebase issues when you use the application.
- The plan you are on, and the WhatsApp groups you choose to add.
3. What we read from WhatsApp, and only from the groups you add
The service is connected to WhatsApp through a self-hosted gateway (Evolution API). When you add a group in Settings and it is active, messages posted in that group are sent to us. Messages from groups you have not added are not processed by RealtiFlow.
For each message we process, we keep:
- the message text, up to 8,000 characters;
- the sender's phone number as it appears in the message, and the sender's WhatsApp display name;
- the group name and group identifier, and the time of the message;
- the media reference (the file link or identifier WhatsApp provides) when a listing has one — see section 5;
- the details RealtiFlow extracts from the text: country, city, area, rooms, size, price and currency, property type, contact details mentioned in the text, a short summary, and machine translations of that summary.
Because those groups are about property, the messages we process can contain personal data about the people who posted them — typically a name, a phone number and sometimes a price or an address. We treat that data as personal data.
4. How long we keep it
| What | How long |
|---|---|
| Raw WhatsApp messages in the gateway's message log | 90 days, then deleted by a job that runs every night at 02:00 |
| Deduplication fingerprints (to avoid storing the same property twice) | The fingerprints are erased after 48 hours; the listing itself stays |
| Automation run records (what the workflow processed, to debug it) | 48 hours, then pruned automatically |
| Listings in your property database | Until you ask us to delete them — see section 10 |
| Nightly backups | The copy on our server keeps the last few days; the off-site copy is kept for every day — see the note below |
A note about backups, in plain words. Every night we take a complete copy of our databases, and an off-site copy of it goes to Google Drive. The copies on our own server rotate: after a few days the oldest are replaced. The off-site copies do not rotate — one is kept for every day, and we do not delete the old ones. That copy includes the raw WhatsApp messages. So a message that the live system deleted after 90 days can still exist inside an older backup, and it stays there.
5. Photos, videos and files
We do not download or store the photos, videos, voice notes or documents posted in the groups. For a listing that has one, we keep the media reference WhatsApp provides (a link or a file identifier) so the listing can point back to it. That reference can stop working, because WhatsApp's own links expire.
6. Who else sees your data
We use a small number of service providers, and we send them only what each one needs:
- Our own server and database. The application, the database and the WhatsApp gateway all run on one server that we rent and administer.
- Ollama Cloud (ollama.com) — the AI model that reads a message and extracts the property fields, and produces the translations (model:
gemma4:31b-cloud). It receives the message text and our instruction prompt. It does not receive your account details. - Google — Firebase Authentication for sign-in, and Google Drive for the off-site backup copy described above. The daily digest and account notices are sent to you by email from our own mailbox (
realtiflow.app@gmail.com). - WhatsApp / Meta — the messages originate there, and the WhatsApp connection itself necessarily passes through their service.
We do not sell personal data, we do not share it for advertising, and we do not run advertising or analytics trackers on this website.
7. Cookies and what your browser stores
We do not set any cookies. The login session is kept in your browser's own storage by Firebase Authentication, so you stay signed in; your theme and language choices are also kept in your browser. Clearing your browser's site data signs you out.
8. If you contact us through the website
The quote form asks for your email address, the plan you are interested in and your message. We store that, together with your browser's user-agent string and a salted hash of your IP address (a one-way hash, not the address itself), so we can answer you and stop automated spam. We do not use any of this for anything else.
IP addresses. When you visit realtiflow.app or use the service, our server sees your IP address. We use it to protect the service against abuse and attacks, to help diagnose connection problems, and — when you send a quote request — to see roughly which country the enquiry came from (legal basis: our legitimate interest in the security and operation of the service). The country lookup happens on our own server, using a copy of a public geolocation database that we keep up to date; your IP address is not sent to any other company for this.
9. Error records and failed extractions
When a request fails with a server error, we store the method, the path, the HTTP status and the error message, tied to the account it happened on, so we can see what you actually hit. We keep the 50 most recent records per account and delete anything older. No WhatsApp message text is written into that record.
When the AI cannot extract a listing from a message even after retrying, we keep an error record so that a permanent failure is never silent. It holds a hash of the message text, the group identifier, the reason the model gave, the contact number as it appeared in the message, and the first 200 characters of the message text — nothing more of the message. These records are not purged automatically. They stay until you ask us to delete them — write to the address in section 13 with the group and roughly when the message was posted, and we will remove them.
10. Your rights, and how to use them
You can ask us to show you the personal data we hold about you, to correct it, or to delete it. Your listings you do not have to ask us for: open Settings, use the Export Excel button under My data, and you download all of them yourself, immediately, without writing to us. To delete your account and the listings stored under it, write to realtiflow.app@gmail.com; we will do it within 30 days of your request.
If you are a person whose message was posted in a group our customer monitors and you want it removed, write to the same address and tell us the group and roughly when it was posted.
11. Security
Access to your listings requires a signed-in account. Server-to-server calls between our own components require a shared secret. The site is served over HTTPS. No system is perfect; if we ever become aware of a breach that affects your data, we will tell you.
12. Changes to this policy
If what the service stores or who it shares with changes, this page changes with it, and the date at the top changes too. Material changes will be announced in the application or by email.
13. Contact
Questions about this policy, or about your data: realtiflow.app@gmail.com. See also our Terms of Service.