Privacy Policy - WhatsApp Connect

This Privacy Policy describes how WhatsApp Connect (the "App") collects, uses, and discloses information when a merchant installs or uses the App in connection with their Shopify-supported store (the "Merchant Store") and their own WhatsApp Business Account, connected via the Meta WhatsApp Business Platform ("Meta Platform").

Please read this policy carefully to understand how we handle information. By installing and using the App, the merchant agrees to the practices described in this Privacy Policy.

1. Information We Collect

A. Merchant Data

When a merchant installs the App, we automatically access certain information from their Shopify account. This includes:

Shop Details: Shop domain, shop name, shop owner name, email, locale, and subscription plan details
Access Tokens: API credentials required to communicate with Shopify services on the merchant's behalf

B. WhatsApp Business Platform Data

To connect the App to a merchant's own WhatsApp Business Account, the merchant enters credentials issued by their Meta Business account. We store:

Connection Credentials: WhatsApp phone number ID, WhatsApp Business Account (WABA) ID, the associated display phone number, Cloud API access token, and Meta App Secret
Webhook Verification Token: A token generated by the App and configured in the merchant's Meta App so inbound WhatsApp events can be securely verified
Message Templates: The list of message templates approved on the merchant's WABA, synced for use in campaigns and automations

Access tokens and App Secrets are encrypted at rest and are never displayed back to the merchant in full once saved. Inbound webhook requests are verified against the merchant's Meta App Secret (HMAC SHA-256 signature check) before any data is processed. For details on how data obtained via the Meta WhatsApp Business Platform is used, see our Meta Platform Data Policy.

C. Customer & Contact Data

To provide WhatsApp messaging (shared inbox, order and shipping notifications, cart-recovery messages, and campaign broadcasts), the App processes data about the merchant's customers:

Contact Information: Customer WhatsApp phone number (in E.164 format) and, where provided by WhatsApp, the customer's WhatsApp profile display name
Message Content: The text of inbound and outbound WhatsApp messages, associated message IDs, and delivery status (sent, delivered, read, or failed). Non-text message types received from a customer (e.g., images, audio, documents) are logged by type only — the App does not download or store the underlying media file
Checkout & Order Data: For abandoned-checkout recovery and order/shipping notifications, we process the customer's phone number, name, checkout or order value, currency, and a summary of items, sourced from the relevant Shopify webhook
Campaign Data: For merchant-initiated broadcasts, the recipient list (phone numbers and names) and per-recipient send status

2. How We Use Your Information

We use the information we collect to:

Send and receive WhatsApp messages on the merchant's behalf via the merchant's own WhatsApp Business Account
Provide a shared inbox so the merchant's team can view and reply to customer conversations
Send automated order confirmations, shipping updates, cash-on-delivery confirmations, and cart-recovery messages
Deliver merchant-initiated campaign broadcasts using approved WhatsApp message templates
Sync available message templates from the merchant's WABA
Provide customer support and troubleshoot technical or delivery issues
Comply with applicable legal requirements

3. Sharing and Disclosure of Information

We do not sell, rent, or trade merchant or customer information. We only share data with third parties in the following limited circumstances:

Meta / WhatsApp: Messages, templates, and delivery status are necessarily transmitted to and from Meta's WhatsApp Business Platform as part of sending and receiving WhatsApp messages
Service Providers: We may share data with trusted third-party service providers (such as hosting and database providers) who perform services on our behalf. These partners are contractually bound to protect the data and are not permitted to use it for any other purpose
Compliance with Laws: We may disclose information if required to do so by law, regulation, or legal process
Acquisition or Merger: In the event of a sale, merger, or asset transfer, merchant data may be transferred to the acquiring entity, subject to the same privacy commitments

4. GDPR, CCPA & Shopify Compliance

We are committed to respecting data privacy rights and implement Shopify's mandatory privacy webhooks:

Customer Data Request: If a customer requests their data from the merchant, we assist the merchant in retrieving any related conversation or message records
Customer Redact: If a customer requests deletion of their data, we delete matching conversation, message, and checkout-recovery records upon request
Shop Redact: Upon app uninstallation and merchant request, we delete the merchant's WhatsApp connection credentials, conversations, messages, campaigns, and related records

To request deletion of WhatsApp conversation data outside of these automated webhooks, a merchant or their customer may contact us directly using the details in Section 8.

5. Data Security

WhatsApp access tokens and Meta App Secrets are encrypted at rest. Inbound WhatsApp webhook requests are verified using the merchant's Meta App Secret before any data is processed, to help ensure requests genuinely originate from Meta. We implement other reasonable technical and organizational measures to safeguard data against unauthorized access, disclosure, alteration, or destruction. However, no security system is completely impenetrable.

6. Data Retention

We retain WhatsApp connection credentials, conversation history, and message data for as long as the merchant keeps their WhatsApp Business Account connected to the App, so that the shared inbox and message history remain available to the merchant. If a merchant disconnects their WhatsApp Business Account or uninstalls the App, we delete the associated connection credentials, and will delete conversation, message, and customer contact data upon request as described in Section 4.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify merchants of material changes by updating the "Last Updated" date at the top of this policy or via email/in-app notification.

8. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us at:

Privacy Policy for WhatsApp Connect