Privacy policy

Last updated: 22 October 2026

WhatsFly – WhatsApp Order Notifications (“the app”) is a Shopify public app that sends approved WhatsApp template messages for order events using each merchant’s own WhatsFly credentials.

Data we process

• Shop domain, name, timezone, and currency
• Offline OAuth access tokens required to receive webhooks
• Customer name, phone number, shipping address, and order details needed to fill WhatsApp templates
• Encrypted WhatsFly API tokens and phone number IDs
• Message logs (masked phone numbers, WhatsFly message IDs, delivery status)
• Billing subscription identifiers from Shopify

Why phone numbers and order data are required

WhatsApp Business templates are sent to the customer phone number stored on the Shopify order. Order number, totals, and status are required template variables. This is protected customer data and is used only to deliver merchant-configured notifications.

Storage and retention

Data is stored in PostgreSQL with tenant isolation. WhatsFly tokens are encrypted at rest with AES-256-GCM. Default log retention is 180 days and is configurable per shop. After a shop/redact webhook, shop data is deleted.

Sharing

Order phone numbers and template variables are sent to WhatsFly solely to deliver messages the merchant configured. We do not sell personal data. We do not use customer data for advertising.

Merchant and customer rights

The app implements Shopify mandatory webhooks: customers/data_request, customers/redact, and shop/redact. Contact the support email published on the app listing for privacy requests.