Privacy Policy (Meta App) - WhatsApp Connect

This Privacy Policy applies to the WhatsApp Connect app ("the App", "we", "us") as registered on the Meta App Dashboard and its use of the Meta WhatsApp Business Platform, including the WhatsApp Business Cloud API and related Graph API endpoints ("Meta Platform"). It describes what data we access through the Meta Platform, how that data is used, stored, shared, and deleted, in accordance with the Meta Platform Terms and Developer Policies.

This policy is specific to our use of Meta APIs. For our broader privacy practices as a Shopify app, including Shopify merchant and store data, see our general WhatsApp Connect Privacy Policy.

1. What the App Does

WhatsApp Connect is a Shopify application that lets an e-commerce merchant connect their own WhatsApp Business Account (WABA) to their Shopify store, so they can send and receive WhatsApp messages with their customers. The merchant authorizes the App by entering credentials for their own Meta App/WABA (phone number ID, WABA ID, and a Cloud API access token). The App then uses those credentials to call the Meta Platform on the merchant's behalf.

2. Data We Access via the Meta Platform

Through the Meta Platform, the App accesses and processes:

WhatsApp Business Account Data: Phone number ID, WhatsApp Business Account (WABA) ID, verified display phone number, and the merchant's approved message template list
Message Data: The content of inbound and outbound WhatsApp messages, sender/recipient phone numbers (in E.164 format), WhatsApp message IDs, message timestamps, and delivery/read status webhooks sent by Meta
Contact Profile Data: The WhatsApp display name a customer has set on their own profile, when included in an inbound message webhook

We do not use Meta/Facebook Login, and we do not access a customer's or merchant's personal Facebook or Instagram profile, friends list, posts, or any other Meta consumer-product data. All data above is scoped to the WhatsApp Business Platform only.

3. How We Use Platform Data

Data obtained through the Meta Platform ("Platform Data") is used exclusively to operate the App's core function: exchanging WhatsApp messages between the merchant and their own customers. Specifically, we use Platform Data to:

Display a shared inbox of WhatsApp conversations to the merchant
Send automated order, shipping, cash-on-delivery, and cart-recovery notifications the merchant configures
Send merchant-initiated campaign broadcasts using WhatsApp-approved message templates
Reflect accurate delivery/read status back to the merchant
Diagnose and fix delivery failures or integration issues

We do not:

Sell, license, or rent Platform Data to any third party
Use Platform Data to build advertising audiences or for any advertising purpose
Share Platform Data with data brokers
Use Platform Data for any purpose beyond providing the App's messaging functionality to the merchant who authorized the connection

4. Data Isolation and Access

Each merchant's Platform Data (credentials, conversations, and messages) is isolated to that merchant's Shopify store and is not visible or accessible to any other merchant using the App. Access to Platform Data is limited to the systems and personnel required to operate and support the App. WhatsApp access tokens and the Meta App Secret are encrypted at rest, and inbound webhook payloads from Meta are verified using the merchant's App Secret (HMAC SHA-256 signature) before being processed or stored.

5. Sharing of Platform Data

Platform Data is shared only:

With Meta: As inherently required to send and receive WhatsApp messages via the Cloud API
With Infrastructure Providers: Hosting and database providers that store the data on our behalf, under contractual confidentiality obligations, and who do not use the data for their own purposes
As Required by Law: If compelled by legal process or to comply with applicable regulation

We do not otherwise disclose Platform Data to any third party.

6. Data Retention and Deletion

We retain WhatsApp connection credentials and message/conversation history for as long as the merchant's WhatsApp Business Account remains connected to the App, so that message history and delivery status remain available to the merchant.

Data Deletion Requests: A merchant may disconnect their WhatsApp Business Account at any time from within the App, which removes the stored connection credentials. A merchant, or a customer whose data was processed by the App, may also request deletion of associated conversation, message, or contact data by contacting us at the email address below. We will act on verified deletion requests within a reasonable time.

7. Security

We apply reasonable technical and organizational safeguards to Platform Data, including encryption of access tokens and App Secrets at rest, and signature verification of all inbound Meta webhook requests. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Children's Data

The App is intended for use by business merchants and is not directed at children. We do not knowingly process WhatsApp data belonging to children through the App.

9. Changes to This Policy

We may update this policy to reflect changes in our practices, the Meta Platform Terms, or applicable law. Material changes will be reflected by updating the "Last Updated" date above.

10. Contact Us

For questions about this policy, or to make a data access or deletion request related to the Meta Platform, contact:

Privacy Policy — WhatsApp Connect (Meta App)