Privacy Policy

1. Who is responsible for your data

For merchant account data (the store, the person who installs Pingbird and their settings), NexoCommerce is the data controller (in India, the "data fiduciary").

For shopper data, the merchant whose store you bought from is the controller. Pingbird processes shopper data only on that merchant's behalf and on their instructions, as their service provider (processor). If you are a shopper, the merchant's own privacy policy also applies, and you can contact the merchant directly about your data.

2. Information we collect

Depending on how you interact with Pingbird, we process the following:

• Merchant and store information from Shopify: store name, store domain, store email address, country, currency, language, subscription plan and billing status, and the Shopify access token that lets the app work.
• WhatsApp Business account information from Meta, when a merchant connects WhatsApp: WhatsApp Business Account ID, phone number ID, display phone number, business display name, message template details, phone number quality rating and messaging limits, and an access token. We do not receive your Facebook password, and we do not access your personal Facebook profile, friends, posts or pages.
• Shopper information from the merchant's Shopify store, needed to send notifications: name, phone number, email address, order number, ordered items and totals, shipping and tracking details, payment method type (for example, cash on delivery), abandoned checkout link, and preferred language.
• Consent records: whether a shopper opted in to or out of WhatsApp messages (including marketing messages), where the consent came from (for example, the order status page, the store's opt-in widget, or a STOP/START reply) and when.
• Message data: the content of WhatsApp and email notifications sent, the template used, delivery status (sent, delivered, read, failed), timestamps, WhatsApp message IDs, and shoppers' replies to the business number (such as COD Confirm/Cancel button taps, STOP/START, or text replies).
• Email sending settings: if a merchant uses their own email server, the SMTP host, port, username, sender address and password.
• Technical and security data: server logs, IP addresses, browser and device information, and admin activity logs, used to operate and secure the service.

3. How we use information

We use data only to provide and improve Pingbird for the merchant who installed it:

• to send the order, shipping, cancellation, refund, COD verification and abandoned-cart notifications the merchant has switched on, by WhatsApp or email;
• to process replies, such as confirming or cancelling a COD order (and tagging or cancelling it in Shopify if the merchant chose that) and honouring STOP/START requests;
• to create unique discount codes for cart reminders and to show the merchant delivery statistics, COD confirmation rates and recovered revenue;
• to manage WhatsApp message templates and monitor the account's health on the merchant's behalf;
• to bill subscriptions through Shopify, provide support, prevent abuse and keep the service secure;
• to comply with legal obligations and with Shopify's and Meta's platform requirements.

We do not sell personal data. We do not use shopper data to advertise to shoppers, to build profiles for our own purposes, or to train artificial intelligence models. Marketing messages, such as cart reminders, are sent only to shoppers who opted in, and every marketing message lets the shopper opt out.

4. Data from Meta and WhatsApp

When a merchant connects WhatsApp through Meta's sign-up flow, Pingbird receives access to that merchant's WhatsApp Business account with the permissions whatsapp_business_management and whatsapp_business_messaging. We use this access only to send and receive the merchant's WhatsApp messages, manage their message templates and show their account status inside Pingbird, in line with the Meta Platform Terms and the WhatsApp Business policies.

You can remove Pingbird's access at any time by disconnecting WhatsApp in Pingbird, uninstalling the app in Shopify, or removing Pingbird under Facebook Settings → Business Integrations. See our Data Deletion Instructions at https://www.nexocommerce.com/legal/pingbird/data-deletion

5. Who we share information with

We share data only with the service providers needed to run Pingbird, and only as much as they need:

• Shopify, which hosts the merchant's store, sends us store and order data, and handles app billing.
• Meta Platforms (WhatsApp Business Platform), which delivers WhatsApp messages. Meta processes message data under its own terms and bills merchants directly for WhatsApp message fees.
• Email delivery providers: the merchant's own email server when they configure one, or our email delivery provider, to send fallback emails.
• Cloud hosting, database and infrastructure providers that store and process data for us under confidentiality and security obligations.

We may also disclose information if required by law, to protect the rights and safety of users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply.

6. How long we keep information

• Message content (the text of messages and email addresses in message records) is deleted after 90 days. Message metadata (template, status, timestamps) is kept for up to 13 months for the merchant's reports, then deleted.
• Abandoned checkout records are deleted after 90 days.
• Consent records and shopper contact records are kept while the store has Pingbird installed, as proof of consent, unless deletion is requested earlier.
• When a merchant uninstalls Pingbird, sending stops immediately, scheduled messages are cancelled, and the stored Shopify and Meta access tokens are removed. All remaining data for that store is permanently deleted when Shopify sends its store data erasure request, 48 hours after uninstall.
• Message templates and phone numbers in the merchant's own WhatsApp Business account belong to the merchant and stay in their Meta account; we do not delete them.

7. How we protect information

Data is encrypted in transit (HTTPS/TLS). Access tokens and email server passwords are encrypted at rest, and passwords are never shown back in the app. Access to the admin panel is limited to authorised staff, protected by hashed passwords and rate limiting, phone numbers are masked in admin views, and admin actions are logged. Shopify and Meta webhooks are verified with signatures. No method of transmission or storage is completely secure, but we work to protect your data and will notify affected merchants and authorities of a data breach as required by law.

8. Your choices and rights

• Shoppers can stop WhatsApp messages at any time by replying STOP to the store's WhatsApp number (reply START to resume), and can unsubscribe from marketing emails with the link in every email.
• Depending on where you live (including under the EU/UK GDPR, the California Consumer Privacy Act and India's Digital Personal Data Protection Act, 2023), you may have the right to access, correct, delete or port your personal data, to withdraw consent, to object to or restrict processing, and to nominate someone to exercise your rights.
• Shoppers can make requests to the merchant they bought from, or to us at support@nexocommerce.com. We also act on the customer data and deletion requests that Shopify sends us on a merchant's behalf.
• Merchants can export or delete their data by contacting us, or delete it by uninstalling the app.

We will respond within the time required by applicable law, normally within 30 days. If you are not satisfied with our response, you may complain to your local data protection authority (in India, the Data Protection Board of India).

9. International transfers

NexoCommerce is based in India, and our service providers, including Shopify and Meta, may process data in other countries. Where data is transferred internationally, we rely on our providers' contractual and security safeguards to protect it.

10. Children

Pingbird is a business tool for merchants and is not directed at children. We do not knowingly collect personal data from children under 18 for our own purposes. If you believe a child's data has been processed, contact us and we will delete it.

11. Changes to this policy

We may update this policy as Pingbird changes. We will post the new version on this page with a new "Last updated" date, and notify merchants inside the app or by email of significant changes.

12. Contact and grievance officer

NexoCommerce, Vibhav Khand, Gomti Nagar, Lucknow, Uttar Pradesh 226010, India.

For privacy questions, data requests or grievances, email our grievance officer at support@nexocommerce.com. We acknowledge requests within 72 hours.