Privacy Policy

Welcome to WA Chat Button Pro ("we", "our", or "us"). We are committed to protecting the privacy and security of the merchants who use our Shopify application. This Privacy Policy explains what information we collect, how we use it, and what rights you have in relation to your data.

By installing or using WA Chat Button Pro, you agree to the collection and use of information in accordance with this policy. If you do not agree, please uninstall the app from your Shopify store.

We collect the following categories of information when you install and use WA Chat Button Pro:

2.1 Shopify Store Information

• Store domain (e.g., yourstore.myshopify.com)
• Store name and country
• Shopify access token (used to sync app settings to your theme via metafields)

2.2 App Configuration Settings

• WhatsApp phone number you enter in the app
• Button colors, positions, and appearance preferences
• Pre-filled message text
• Business hours settings
• Visibility and device targeting preferences
• Facebook Page username (if Messenger button is enabled)
• Custom icon uploads (stored as base64 in your store's metafields)

2.3 Usage Analytics

If you use our analytics feature (Pro plan), we collect click event data including:

• Button type clicked (WhatsApp, Messenger, or Buy Button)
• Your store domain (to associate events with your store)
• Timestamp of each click event

We do not collect any personal information about your customers (end-users/shoppers). Analytics only track aggregate click counts per store.

2.4 Billing & Subscription Information

Subscription and billing data is managed entirely by Shopify through their Billing API. We do not directly collect or store payment card numbers or financial information. We only receive confirmation of active subscription status from Shopify.

We use the information we collect for the following purposes:

• App functionality: To deliver the core features of the app, including syncing your button settings to your storefront via Shopify metafields.
• Session management: To authenticate your store and maintain a secure session with Shopify's OAuth system.
• Analytics: To display click statistics in your app dashboard (Pro plan only). Analytics data is only accessible to you.
• Customer support: To identify and resolve issues related to your installation or configuration.
• App improvements: Aggregated, anonymised usage patterns may be used to improve the app's features and performance.
• Subscription management: To determine your plan (Free or Pro) and gate features accordingly.

We may share limited data only in the following circumstances:

• Infrastructure providers: Our app is hosted on Railway (railway.app). Your store's configuration data is stored on their servers. Railway operates under strict data security standards.
• Shopify: We use Shopify's APIs and platform to read/write metafields and manage subscriptions. Shopify's own Privacy Policy governs their handling of your store data.
• Legal requirements: We may disclose information if required by law or to protect the rights and safety of our users and services.

We retain your store's data for as long as the app is installed on your Shopify store.

• Configuration settings are kept to ensure your buttons continue to work correctly.
• Session tokens are kept to maintain your authenticated connection with Shopify.
• Analytics data is retained for up to 90 days on a rolling basis.

When you uninstall the app, we receive a shop/redact webhook from Shopify (within 48 hours of uninstall). Upon receiving this webhook, we permanently delete all data associated with your store from our systems, including settings, session tokens, and analytics records.

WA Chat Button Pro is designed to be compliant with the General Data Protection Regulation (GDPR) and Shopify's Partner Program requirements. We implement all mandatory Shopify privacy webhooks:

6.1 Mandatory Privacy Webhooks

• customer/data_request — When a merchant or customer requests what data we hold about them, we respond by confirming that we do not store personal customer data. Any merchant data held is provided upon request within 30 days.
• customer/redact — We do not store personal customer (shopper) data. Upon receiving this webhook, we confirm there is no customer data to redact.
• shop/redact — Upon receiving this webhook (48 hours after app uninstall), all merchant store data including configuration settings, analytics records, and session tokens are permanently and irreversibly deleted from our database.

6.2 Your Rights (Merchants)

As a merchant using our app, you have the right to:

• Access: Request a copy of all data we hold about your store.
• Correction: Request correction of any inaccurate data.
• Deletion: Request deletion of your store data at any time (or simply uninstall the app).
• Portability: Request your configuration data in a portable format.

To exercise any of these rights, please contact us at the email address listed in the Contact section below.

We take reasonable and appropriate technical measures to protect your data against unauthorised access, alteration, disclosure, or destruction:

• All data transmission between your browser, Shopify, and our servers is encrypted using HTTPS/TLS.
• Shopify access tokens are stored securely in our database and never exposed in client-side code.
• Our app uses Shopify's official OAuth 2.0 flow for authentication — we never ask for or store your Shopify admin password.
• HMAC signature verification is used to validate all requests originating from Shopify.
• Our infrastructure provider (Railway) maintains physical and network security for our servers.

While we strive to use commercially acceptable means to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

Our app integrates with or relies on the following third-party services:

• Shopify — Core e-commerce platform. Our app uses Shopify's Admin API, Billing API, and theme extension system. Shopify's Privacy Policy applies to data processed through their platform.
• Railway (railway.app) — Cloud hosting provider for our app server and database. Data is stored on Railway's infrastructure.
• Meta / Facebook — The Messenger button feature uses m.me/ links to open Facebook Messenger. We do not share any data with Meta; the link simply opens a conversation on the customer's device.
• WhatsApp (Meta) — The WhatsApp button uses wa.me/ links. No data is transmitted to WhatsApp by our app; the link opens WhatsApp on the customer's device.

We are not responsible for the privacy practices of these third-party services. We encourage you to review their respective privacy policies.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify merchants of significant changes through the app interface or email where required.

Your continued use of WA Chat Button Pro after any changes to this policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us: