Data handling
What is stored, where it lives, who can see it, and how opt-out works.
A practical description of what is stored and who can reach it.
What is stored
| Data | Why |
|---|---|
| Customer WhatsApp number and profile name | To recognise a returning customer and address them |
| Message history | The order came from it, and the conversation view is how you check what was said |
| Orders, lines, prices, totals | The record of the trade |
| Delivery addresses | So a returning customer is never asked again |
| Payment records and receipt images | Proof of payment, and the duplicate checks depend on it |
| Invoices | Financial records |
| Your catalogue, stock and settings | The shop itself |
Where it lives
In a managed Postgres database and object storage, in a single region. Receipt images and invoices live in private storage — never reachable by URL. The dashboard mints a short-lived signed link per view, and refuses to sign a path outside your own shop's folder.
Separation between shops
Every record belongs to exactly one shop, and every query is filtered by it. The shop is taken from your verified session and never from anything in the address bar, so there is no URL to edit to see somebody else's data.
Where a record has no shop of its own — a payment, an order line — it is reached through the order it belongs to, never directly by id.
Who can see what
- You see your own shop, through a session tied to your WhatsApp number.
- Your customers see nothing but their own conversation and their own orders. A customer asking about "everyone's orders" is answered from a query scoped to them, so there is nothing to disclose.
- We can access shops for support and operations. Plan changes, suspensions and access grants are recorded in an append-only audit log — the code has no path that updates or deletes one.
Opt-out
A customer sends STOP and receives nothing further. START reinstates.
While opted out, nothing at all is sent — not even an explanation, which would itself be a message to someone who asked for none. Their deliberate actions still reach you as an alert, so an order they touched does not silently expire.
Only an explicit START counts as re-consent. Tapping a button does not.
Third parties
- WhatsApp / Meta carries the messages. That is the platform your customers are already on.
- A language model provider classifies message intent and reads receipt images. It receives the message text or the receipt image and the shop context needed to interpret it.
- Hosting and database providers run the infrastructure.
No customer data is sold, and none is used to advertise.
Retention and deletion
Orders, payments and invoices are financial records and are retained. Ask us about a specific customer's data and we will tell you exactly what exists and what can be removed without breaking a financial record.
The full procedure — who to ask, what is removed, what is kept and how long it takes — is on the data deletion page.