Who operates this app
Casey Harvey trading as Flowstyletattoo operates Flowstyletattoo AI Review Test, including its Instagram connection, Flowstyletattoo AI Review Test-IG. Contact casey.fst@gmail.com about privacy, access, correction, deletion or a complaint.
What the test does
If enabled for the approved isolated test, the app will test delivery of messages sent by the owner to their own Instagram test account, @flowstyletattoo_ai_test. It will accept at most five distinct self-message events during a two-hour window. It is not available for customer enquiries. Messenger and production business accounts remain inactive.
The test does not generate automatic replies, use an AI service to process messages, or transfer messages to customer-management or marketing systems.
Information received and retained
When the owner connects the test account, setup checks its Instagram account identifier and username. Access credentials are restricted to the setup and services that need them and are not included in diagnostic records.
Instagram notifications can contain message text, attachment information, account identifiers and timestamps. The service briefly handles an incoming notification to verify it and confirm that it belongs to the permitted test. Message text and attachment information are not saved in the diagnostic database, and attachments are not downloaded. Test messages must use invented text containing no customer, health or other sensitive information.
For accepted self-message events, the service stores account and message identifiers, a recipient identifier supplied by Instagram, event and receipt times, self-message flags and derived identifiers used to recognise duplicate deliveries. It also stores the test account username, test status, timing and event count.
Who handles the information
The owner and authorised service administrators may access information needed to run and support the test. Cloudflare hosts the receiving service and diagnostic database. Meta operates Instagram and delivers notifications. Google provides the contact email service. These providers may process information outside Australia.
The database has an Oceania location hint, but Cloudflare states that this is not a residency guarantee. Australian-only processing is not promised.
Test information is used for connection testing, security, fault investigation and responding to privacy requests. It is not sold or used for advertising or AI training by this app.
How long information is kept
If the test is enabled, diagnostic event metadata will be deleted seven days after receipt during scheduled cleanup. Test control records containing the username, identifiers and counts will be deleted seven days after the test ends.
Deleting active rows does not immediately erase Cloudflare’s separate database recovery history. The current Workers Free plan keeps D1 recovery history for up to seven days. A minimal deletion record remains until eight days after confirmed deletion so deletion can be reapplied after a restore. An unresolved deletion intent does not expire merely because time passes.
The deletion record contains the request ID, exact target identifiers, state and timing—not the username, message content, attachments or credentials. Records involved in an active recovery remain protected until recovery review is complete. A restored service remains blocked from intake while deletion records are checked and reapplied.
Cloudflare Workers Free custom logs may remain for three days. URL-bearing invocation logs will be disabled and verified before the test is enabled because callback verification uses a query token. Copies held in Instagram are managed separately by Meta.
Access, correction, deletion and complaints
Email casey.fst@gmail.com with the subject “AI Review Test privacy request”. Explain what you would like us to do and provide your Instagram username and approximate test date if relevant. Never send a password, access token, app secret or sensitive message.
We will acknowledge a request within seven days, target resolution within 30 days and explain any delay. Routine correspondence, including relevant sent or reply copies, will be deleted 30 days after resolution, subject to provider trash and recovery handling. An identified legal requirement or unresolved complaint may require longer retention; the reason and a review date will be documented. Immediate erasure from provider recovery systems is not promised.
For a complaint, describe your concern using the same address. You can also seek guidance from the Office of the Australian Information Commissioner.
Changes to this notice
This notice will be updated before materially expanding information handling, including enabling customer messages, Messenger, AI processing or other connected services.