Privacy Policy

Last updated: May 15, 2025

Wawo - Review Automation ("we", "our", "the App") is a Shopify application that automates WhatsApp review requests after order delivery and routes customer feedback to the appropriate destination. This Privacy Policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

When a merchant installs Wawo - Review Automation, we receive and store the following data from Shopify:

• Shop data: shop domain, access token, configuration settings (Trustpilot URL, delay, routing preferences, branding).
• Order data: order ID, fulfillment status, tracking number, carrier, and delivery events.
• Customer data: customer name, phone number (used to send the WhatsApp message), and optionally their written feedback and star rating.

2. How We Use This Data

• Send a single WhatsApp review request message after confirmed delivery, via our messaging provider YCloud.
• Route the customer to a Trustpilot review page (positive ratings) or an in-app feedback form (negative ratings).
• Display analytics to the merchant (ratings distribution, delivery funnel, message status).
• Enforce usage limits and billing per the merchant's subscription plan.

3. Third-Party Services

• YCloud — WhatsApp messaging provider. Customer phone numbers are transmitted to YCloud solely to deliver the review request message. YCloud's privacy policy: ycloud.com/privacy.
• Ship24 — Parcel tracking service used for non-native carriers to detect delivery events.
• Shopify — The App operates within the Shopify platform and is bound by Shopify's Partner Program Agreement.

4. Data Retention

• Order and customer data is retained for as long as the merchant's account is active.
• Review tokens expire after 7 days and are automatically invalidated 2 minutes after first use.
• When a merchant uninstalls the App, we process a shop data deletion within 30 days upon receiving Shopify's shop/redact webhook.

5. GDPR & Data Subject Rights

We comply with the EU General Data Protection Regulation (GDPR). Merchants can submit customer data requests or deletion requests directly through Shopify, which will forward them to us via webhooks. We process these requests within 30 days.

Data subjects may request:

• Access — a copy of the data we hold about them.
• Deletion — erasure of their data from our systems.
• Correction — update to inaccurate data.

6. Data Security

All data is stored in an encrypted PostgreSQL database hosted on Fly.io (EU/US regions). Data in transit is protected via TLS. Access tokens are stored server-side and never exposed to the client.

7. Children's Privacy

The App is designed for use by merchants and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the App after changes constitutes acceptance of the updated policy.