Privacy Policy

1. Who we are and when this policy applies

WappAI is operated by Manifester Technologies (“WappAI,” “we,” “us,” or “our”). This policy applies to the WappAI Shopify application and the services it provides.

For a merchant’s account, billing, configuration, and service-usage information, WappAI determines why and how that information is processed. For personal information belonging to a merchant’s customers or WhatsApp contacts, WappAI generally acts as a service provider or processor on the merchant’s instructions. The merchant remains responsible for its own privacy notices, lawful basis, customer communications, and use of WappAI.

2. Information we collect

Information received from Shopify

• Store identity and profile information, including the myshopify.com domain, store name, owner or contact details, business address, timezone, country, and Shopify plan.
• App installation, authorization, access-scope, session, subscription, billing, and uninstall information.
• Product information needed to answer product, price, and availability questions.
• Order information needed to provide order-status or tracking assistance. When enabled and approved by Shopify, this can include an order number, fulfillment and tracking details, and customer-provided email address, phone number, or shipping postal code used only to verify that the requester may access the order.

Information provided by merchants

• Business details, working hours, FAQs, automation settings, notification preferences, WhatsApp connection details, support requests, and other configuration entered in the app.
• Merchant and staff actions in the shared inbox, including messages, notes, labels, handoffs, and AI suggestions that are accepted, rejected, or edited.

WhatsApp and customer interaction information

• WhatsApp identifiers and phone numbers, contact or display names when available, message text, message direction, timestamps, delivery status, and conversation state.
• Information a customer voluntarily includes in a message, such as a product question, order number, email address, phone number, or postal code.

Technical and service information

• Operational logs, request identifiers, error details, security events, usage counts, feature activity, subscription status, and diagnostic information.
• Essential session and security technologies required to authenticate merchants, prevent abuse, and keep the embedded Shopify app functioning. We do not use the public privacy-policy page for targeted advertising.

3. How we use information

We use information only as reasonably necessary to:

• provide, operate, maintain, secure, and troubleshoot WappAI;
• connect the merchant’s Shopify store and WhatsApp account;
• display conversations and enable merchant or AI-assisted replies;
• answer product questions and perform verified order-status lookups;
• apply merchant-configured automation, schedules, handoffs, and notifications;
• manage plans, trials, billing, usage allowances, and service communications;
• monitor reliability, prevent fraud or misuse, and enforce our agreements;
• respond to support, legal, security, and privacy requests; and
• comply with applicable law and Shopify platform requirements.

Depending on the context and applicable law, our legal basis may be performance of a contract, the merchant’s instructions, legitimate interests in operating and securing the service, consent, or compliance with a legal obligation.

We do not sell personal information. We do not use merchant or customer personal information for independent advertising, and we do not share it for cross-context behavioral advertising.

4. AI-assisted processing

When a merchant enables AI features, relevant conversation text, recent conversation context, merchant-provided business information and FAQs, and necessary product or verified order results may be processed by Google’s Gemini service to classify a request and generate a proposed or automatic response. WappAI applies safety rules and merchant-configured controls before sending an automatic reply.

AI output can be inaccurate. Customers should not rely on an AI response as legal, financial, medical, or other professional advice. WappAI is designed to hand conversations to a human when confidence, safety, permissions, or available data are insufficient.

Credentials, Shopify access tokens, internal signatures, and WhatsApp API secrets are not intentionally included in AI prompts. Sensitive order-verification values are redacted from AI tool audit records.

5. How we share information

We disclose information only as needed to provide the service, follow a merchant’s instructions, protect WappAI and its users, complete a business transaction, or comply with law. Recipients can include:

• Shopify, for authentication, Admin API access, app billing, webhooks, and app-platform operations;
• WhatsApp and the merchant’s WhatsApp service connection, for receiving and delivering messages;
• Google Gemini, when AI functionality is enabled, for processing the limited content described above;
• Hosting, database, email, realtime-notification, security, monitoring, and backup providers that process information on our behalf;
• professional advisers, authorities, or other parties when reasonably necessary to protect rights, investigate abuse, comply with law, or respond to valid legal process; and
• a successor in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to appropriate safeguards.

Service providers are authorized to process information only for the services they provide to us and are expected to protect it appropriately.

6. Retention and deletion

We retain information while a merchant has an active installation and for as long as reasonably necessary to provide the service, maintain security and business records, resolve disputes, enforce agreements, and meet legal obligations. The exact period depends on the type of information and why it is processed.

• When an app is uninstalled, automation is disabled, Shopify credentials are revoked from our active records, and the associated WhatsApp session is disconnected and scheduled for deletion.
• We process Shopify’s mandatory customer-redaction and shop-redaction requests. Shop redaction deletes the merchant record and associated application data, subject to limited information that must be retained by law or in protected, time-limited backups.
• Customer-data export files generated for a verified privacy request expire and are automatically deleted after seven days.
• Operational application logs are generally rotated after fourteen days. Backup copies are removed according to our backup rotation schedule.

A merchant can request earlier deletion, subject to legal, security, fraud prevention, dispute-resolution, and backup limitations.

7. Your privacy rights and choices

Depending on where you live, you may have rights to request access, correction, deletion, portability, or restriction of personal information; to object to certain processing; or to withdraw consent. You may also have the right to appeal our response or complain to a data-protection authority.

If you are a Shopify merchant or staff member, contact us using the details below and identify your store’s myshopify.com domain. If you are a merchant’s customer or WhatsApp contact, contact that merchant first. Because the merchant controls the relevant customer relationship, we will ordinarily assist the merchant in responding to your request. Shopify privacy requests are also processed through Shopify’s mandatory compliance webhooks.

We may need to verify your identity and authority before completing a request. We will not discriminate against you for exercising an applicable privacy right.

8. Security and international transfers

We use administrative, technical, and organizational safeguards designed to protect information, including encryption in transit, encryption of sensitive tokens at rest, access controls, service isolation, signed webhook and internal requests, logging, backups, and least-privilege operational access. No system can be guaranteed completely secure.

WappAI is operated from India, and our service providers may process information in India, the United States, and other countries. These countries may have different privacy laws from your country. Where required, we use appropriate contractual or other safeguards for international transfers.

9. Children’s privacy

WappAI is a business service for Shopify merchants and is not directed to children. We do not knowingly collect personal information directly from children. Merchants are responsible for ensuring their use of WappAI complies with laws that apply to children’s information.

10. Changes to this policy

We may update this policy to reflect changes to WappAI, our data practices, or applicable requirements. We will post the updated policy at this URL and revise the “last updated” date. If a change is material, we will provide additional notice when required by law.