Privacy Policy

1. Information We Collect

2. How We Use Information

We use collected information solely to:

• Provide and operate WhatsApp automation services
• Send merchant-configured customer notifications via WhatsApp
• Improve app functionality, reliability, and user experience
• Troubleshoot technical issues and provide customer support
• Prevent fraud, abuse, or unauthorized access
• Comply with applicable legal obligations
• Fulfil Shopify Partner Program requirements
• Analyse aggregated usage trends to improve our services

3. Data Sharing & Disclosure

We do not sell, rent, or trade merchant or customer information to third parties. Information may only be shared in the following limited circumstances:

• With trusted infrastructure and cloud service providers strictly required for app operation (subject to confidentiality obligations)
• When required by applicable law, court order, or legal process
• To protect the rights, property, or safety of WaAutoflow, our merchants, or the public
• During a merger, acquisition, or business transfer - with advance notice to merchants
• With Shopify, as required by the Shopify Partner Program and API Terms of Service

4. Shopify Data Practices & API Compliance

WaAutoflow complies fully with Shopify's Partner Program Policies and API Terms of Service:

• We only request Shopify API scopes strictly necessary for app functionality
• We do not use Shopify customer or merchant data for any purpose beyond operating the app
• We do not share Shopify API data with third parties except as required to operate the service
• We honour all data deletion requests received through Shopify's mandatory webhook events: customers/redact, shop/redact, and customers/data_request
• Merchant and customer data is processed in accordance with Shopify's Data Processing Addendum (DPA)
• We maintain records of all Shopify data access in compliance with audit requirements

5. WhatsApp & Meta Platform Compliance

WaAutoflow's use of WhatsApp functionality complies with Meta's Platform Terms and WhatsApp Business Policies:

• Messaging is limited to merchant-configured business communications only
• WaAutoflow does not engage in bulk unsolicited messaging (spam)
• Merchants are responsible for ensuring customer consent before sending WhatsApp messages
• All automation flows must comply with WhatsApp's Acceptable Use Policy
• WaAutoflow does not facilitate messaging that violates Meta's Community Standards
• Session data and linked-device tokens are stored securely and not shared with third parties

6. Data Retention

We retain data only for as long as necessary to provide services, maintain operational records, comply with legal obligations, and resolve disputes.

7. Data Security

We implement commercially reasonable technical and organisational safeguards to protect your data:

• Encrypted HTTPS/TLS transmission for all data in transit
• Secure cloud infrastructure with restricted access controls
• Authentication and authorisation controls for all data access
• Regular security reviews and vulnerability assessments
• Monitoring for unauthorised access and suspicious activity
• Employee access limited to the minimum necessary for job functions

8. Security Breach Notification

In the event of a data breach that poses a risk to merchant or customer rights and freedoms, WaAutoflow will:

• Notify affected merchants without undue delay and within 72 hours of becoming aware
• Provide information about the nature of the breach and data affected
• Describe the likely consequences of the breach
• Outline measures taken or proposed to address and mitigate the breach
• Report to relevant supervisory authorities as required by applicable law (e.g., GDPR Article 33)

9. Merchant Responsibilities

Merchants using WaAutoflow are responsible for ensuring their use of the app complies with applicable laws and platform policies:

• Obtaining valid customer consent before sending WhatsApp messages where legally required
• Complying with local, national, and international privacy and marketing regulations (GDPR, CCPA, PDPA, etc.)
• Ensuring all messages comply with WhatsApp's Acceptable Use Policy and Shopify's policies
• Maintaining the confidentiality of account credentials
• Promptly notifying WaAutoflow of any suspected unauthorised account access
• Providing customers with clear information about WhatsApp communications
• Honouring customer opt-out or unsubscribe requests promptly

10. GDPR & EEA Privacy Rights

For users in the European Economic Area (EEA), United Kingdom, or jurisdictions with equivalent protections, WaAutoflow acts as a data processor on behalf of merchants (who are data controllers). You may have the following rights:

• Right of access - request a copy of personal data we hold
• Right to rectification - request correction of inaccurate data
• Right to erasure - request deletion of your personal data
• Right to restrict processing - request that we limit how we use your data
• Right to object to processing
• Right to data portability - receive your data in a structured, machine-readable format
• Right to withdraw consent at any time (where processing is based on consent)

11. CCPA - California Consumer Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected and how it is used
• Right to delete personal information (subject to certain exceptions)
• Right to opt out of the sale of personal information - WaAutoflow does not sell personal information
• Right to non-discrimination for exercising CCPA rights

12. India - Digital Personal Data Protection (DPDP) Act

For users in India, WaAutoflow processes personal data in accordance with the Digital Personal Data Protection Act, 2023:

• We process personal data only for lawful purposes and with appropriate consent where required
• Data principals (individuals) may request access, correction, or erasure of their personal data
• We maintain security safeguards appropriate to the sensitivity of data processed
• We notify relevant authorities and affected individuals of data breaches as required by applicable rules

13. Cookies & Tracking Technologies

WaAutoflow's Shopify app itself does not use cookies for tracking. Our marketing website (waautomate.net) may use:

• Essential cookies required for website functionality
• Analytics cookies to understand website usage (anonymised)
• No third-party advertising or retargeting cookies

14. Third-Party Services

WaAutoflow may use third-party services to operate and improve our platform. These providers are bound by confidentiality obligations and are not permitted to use data for their own purposes:

• Cloud hosting and infrastructure providers
• Error monitoring and logging services
• Customer support tools
• Payment processing (handled by Shopify - not directly by WaAutoflow)

15. Children's Privacy

WaAutoflow is designed for business use by adults (18+) and is not directed at children. We do not knowingly collect personal information from individuals under 18 years of age. If you believe we have inadvertently collected such information, please contact us immediately at hello.waflows@gmail.com and we will promptly delete it.

16. International Data Transfers

WaAutoflow may process and store data on servers located outside your country of residence. When we transfer personal data internationally, we ensure appropriate safeguards are in place, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by relevant data protection authorities
• Other legally approved transfer mechanisms

17. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our services, legal requirements, or industry best practices. When we make material changes, we will:

• Update the 'Last Updated' date at the top of this policy
• Notify merchants via in-app notification or email where appropriate
• Provide at least 30 days' notice before material changes take effect (where feasible)

18. Contact Information

For privacy-related questions, requests, or concerns, please contact us: