WowChat Privacy Policy
WowChat is a WowApps product that lets a business use the official WhatsApp Business Platform to talk with customers, send approved message templates and, later, run order messages and campaigns. This policy covers two things, and says which is which:
- The WowChat review workspace. A web workspace that is available now. It is connected to one WhatsApp test business account and shows the WhatsApp Business Platform requests WowChat makes.
- The WowChat Shopify app. A planned app that is not released yet. Sections marked "planned" describe how it will work.
"Merchant" means a store owner or staff member. "Customer" means a person whose phone number or messages a Merchant handles through WowChat.
1. What the review workspace handles today
- Messages. The text of messages sent from, and received by, the connected WhatsApp number, up to 300 characters each, with message ids, delivery status and the last four digits of the other person's number. The most recent 300 messages are kept.
- Contacts. For each contact: a keyed hash of the phone number, its last four digits, whether marketing opt-in is recorded, a short note describing how consent was captured, and timestamps, including when the contact last messaged us (this opens the 24-hour reply window).
- Activity records. The most recent 100 webhook and action events and the most recent 60 API request records (method, path, status and time). They do not contain tokens, codes or secrets.
- Connection data. If an administrator connects a WhatsApp account through Meta's signup, we store its account id, phone number id and access token in an encrypted file (AES-256-GCM). Today the workspace instead uses an access token held in the server's configuration.
- Sign-in data. A hash of each session id and its expiry time. Sessions last eight hours.
- In your browser only. Test recipients you save are kept in your own browser's local storage. They are not sent to our server.
- Technical data. Our network provider and server process IP addresses and request logs to deliver the service and limit abuse.
We use test numbers and test contacts for the review workspace and do not load real customer data into it.
2. What the planned Shopify app will handle
When released, WowChat for Shopify is planned to handle: Merchant account details from Shopify; WhatsApp connection data for the account each Merchant authorizes; Customer data that Shopify makes available under the permissions the Merchant approves, such as name, phone number, email, order and checkout details and marketing consent; message content and delivery status; and technical and support data. We will request Shopify's protected customer data access before handling Customer data. Shopify's mandatory privacy requests (customer data request, customer erasure and shop erasure) will be supported.
3. How we use information
- To connect a WhatsApp Business account, create and manage message templates, send approved templates, send free-form replies inside the 24-hour window, and show incoming messages and delivery status.
- To process webhooks from Meta after checking their signature.
- To respect consent. Marketing templates are sent only to a contact with recorded opt-in, and a STOP reply withdraws it immediately.
- To provide support, keep the service secure, prevent abuse and meet legal obligations.
We do not sell personal information.
4. Who we share information with
- Meta Platforms (WhatsApp). Messages and template requests go through the WhatsApp Business Platform to be delivered. Meta's own terms and privacy policy apply to that processing.
- Cloudflare. Our network provider carries traffic to the workspace and may process request data for that purpose.
- Shopify (planned app). We will exchange data with Shopify to read store data and handle billing.
- Legal reasons. When the law requires it, or to protect rights and safety.
5. Security
- All traffic uses HTTPS and sign-in is required. Administrator and reviewer passwords are separate, and repeated wrong passwords lock sign-in for a period.
- Webhook requests from Meta are verified by signature before they are processed.
- Stored WhatsApp connections are encrypted. Application secrets and the access token used by the review workspace are kept in server configuration files with restricted permissions, outside the data store, and are available only to WPXPO administrators.
- Data files are readable only by the application. No online system is perfectly secure, so we cannot promise absolute security.
6. How long we keep information
- Messages, activity records and API request records are kept by count, not by date: the newest 300, 100 and 60 are kept and older ones are overwritten.
- Contact records stay until a deletion request, or until we clear the workspace. They have no automatic expiry.
- Sessions expire after eight hours.
- A deletion request (see data deletion) removes messages, activity records, API request records, contacts and any stored WhatsApp connection. Credentials held in server configuration are removed or rotated by WPXPO on request.
7. Your choices
Depending on where you live, you may have the right to access, correct, delete, restrict or move your personal information, and to object to its use. Someone who does not want WhatsApp messages from a business can reply STOP. To make a request, email support@wpxpo.com or follow the steps on the data deletion page.
8. International transfers
Information may be processed in countries other than where you live, including where Meta and our network provider operate. We use appropriate safeguards where the law requires them.
9. Children
WowChat is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.
10. Changes
We may update this policy and will change the effective date above. We will describe significant changes in the workspace or by email.
11. Contact
WPXPO, support@wpxpo.com