Data processing agreement
For merchants: how we process your customers' data on your behalf.
Roles
You are the controller of your customers' data. We are the processor, acting on your documented instructions — the settings you choose in the admin are those instructions.
What we do with it
Store orders, confirm them on WhatsApp, reconcile courier payments and produce your analytics. Nothing outside that list.
Sub-processors
Meta carries the WhatsApp messages. Our hosting and database providers store the data in the EU. The couriers you use receive what a delivery needs; the ad platforms you connect receive hashed identifiers only. This list is updated here as it changes.
Security
Data is encrypted in transit and at rest. Every store's data is isolated at the database level, and staff access is logged.
Incidents
If a breach touches your customers' data, we tell you without undue delay and no later than 72 hours after we confirm it — what happened, and what we did about it.
Deletion
When you leave, your store's data is exported to you on request and deleted from live systems within 90 days. Backups follow their normal rotation.