Privacy Policy

Last updated: October 2, 2026

Piaflo - WhatsApp Flows ("Piaflo", "we") is a Shopify app operated by monweb.dev. It lets Shopify merchants send WhatsApp messages to their own customers: order updates, cash-on-delivery confirmations, abandoned checkout reminders, campaigns and conversations in a shared inbox.

Last updated: October 2, 2026. Contact: [email protected].

Our role

For the personal data of a store's customers and visitors, the merchant is the data controller and Piaflo acts as a data processor, processing data only on the merchant's documented instructions (see our Data Processing Agreement). For the data of the merchant's own staff using the app (name, email, Shopify user ID), Piaflo is the controller.

Data we process

From Shopify, only what is needed to send the messages the merchant configures:

• customer first and last name, phone number, email address;
• shipping and billing address fields (used to read the phone number and its country);
• order details used in messages (order number, total, items, status link, tracking link);
• abandoned checkout details (recovery link, total, first item);
• the customer's WhatsApp marketing consent stored in Shopify.

From the WhatsApp Business Platform (through our connectivity provider Zernio and Meta):

• the merchant's WhatsApp Business account and phone number identifiers, display name, quality rating and messaging limits;
• incoming and outgoing messages, media sent by customers, delivery and read statuses;
• message templates and their approval status.

From the storefront widget (only when a visitor submits it): phone number, first name, the consent text shown, the page URL, a one-way hash of the IP address, and the browser user agent, kept as proof of consent.

We do not collect payment card data, government identifiers or special categories of data, and we ask merchants not to send such data through WhatsApp.

Purposes

• sending the order notifications, automated flows and campaigns the merchant configures;
• showing conversations in the merchant's shared inbox;
• honoring consent and opt-outs (STOP);
• measuring delivery, clicks and revenue attributed to messages for the merchant;
• operating, securing and supporting the service.

We never sell personal data, never use it for our own marketing, and never use it to train AI models.

Sub-processors

Transfers outside the EU rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, as applicable.

Retention

• Conversations and messages: 3 months (Free and Starter plans), 6 months (Growth), 13 months (Pro).
• Media received from customers: 90 days.
• Raw webhook events: 14 days. Sending queue: 7 days. Flow execution logs: 90 days.
• Encrypted backups: 14 days.
• Access logs: 12 months.
• Opt-out records: kept as a one-way hash so that we never message a customer who unsubscribed, even after deletion.
• All of a store's data is deleted within 48 hours of Shopify's shop/redact request, sent after the merchant uninstalls the app.

Security

Data is encrypted in transit (TLS) and at rest (AES-256-GCM application-level encryption of personal fields, messages and media, plus encrypted backups). Access is restricted and logged. See our Security page.

Your rights

Customers can stop WhatsApp messages at any time by replying STOP. Requests to access, correct or delete personal data are handled through the merchant, who receives them from Shopify; we fulfil Shopify's customers/data_request and customers/redact requests. You can also write to [email protected], and you have the right to lodge a complaint with your data protection authority (in France, the CNIL).

Changes

We will update this page and its date when our practices change, and notify merchants of material changes.