PRIVACY POLICY.
LAST UPDATED: August 20, 2026
1. OVERVIEW & SCOPE
WhatFlow ("we", "our", "us") provides WhatsApp marketing, customer support, and order automation tools for Shopify merchants. This Privacy Policy describes how we collect, process, and protect information when you install and use our Shopify application, connect your Meta WhatsApp Business Account (WABA), and communicate with your store customers.
2. INFORMATION WE COLLECT
Merchant Information: When you install WhatFlow on Shopify, we receive your store domain, shop owner name, email address, country, currency, and installed apps via standard Shopify OAuth scopes.
Customer & Order Data: To deliver automated WhatsApp notifications (e.g. order confirmations, shipping updates, abandoned checkout recovery), WhatFlow processes customer phone numbers, first names, order items, and checkout URLs strictly on behalf of the merchant as a Data Processor.
Meta Cloud API Credentials: When you connect your WhatsApp Business Account via Meta Embedded Signup, we store your WABA ID, Phone Number ID, and encrypted system access tokens required to transmit messages via Meta’s official Graph API.
3. HOW WE USE DATA
- Sending transactional and marketing WhatsApp messages initiated by merchant store events.
- Providing real-time delivery status (sent, delivered, read, failed) and analytics.
- Automating two-way conversational replies via WhatFlow Auto-Replier or AI Assistant.
- Calculating WhatsApp Cloud API consumption and billing without storing unnecessary customer personal data.
4. DATA RETENTION & SECURITY
We never sell, rent, or monetize merchant or customer data. All API tokens and credentials are encrypted at rest using industry-standard AES-256 encryption. Message payloads sent to WhatsApp Cloud API are transmitted over TLS 1.3 encrypted connections directly to Meta’s enterprise infrastructure.
5. GDPR & MERCHANT RIGHTS (DATA PROCESSOR AGREEMENT)
In accordance with GDPR and CCPA regulations, merchants are the Data Controllers and WhatFlow acts as the Data Processor. Upon app uninstallation or merchant data erasure request via Shopify mandatory GDPR webhooks (customers/redact, shop/redact), we automatically delete associated store data within 48 hours.
6. CONTACT & DATA INQUIRIES
If you have any questions regarding this Privacy Policy or wish to exercise data subject rights, please contact our Data Protection team at: