Privacy policy
Shiply Notify · Last updated: 18 October 2026
This policy explains what data Shiply Notify, the Shopify app that sends order status updates on WhatsApp, processes. We act as controller for merchant data and as processor for the store's customer data, on the merchant's behalf, under the Data Processing Agreement.
1. Controller
KRYVUM LABS SLU, Tax ID B27581206, Calle Rubén Darío 36 Local 1, 08030 Barcelona, Spain. Phone +34 611 647 748. Data protection contact: verifactuconnect@gmail.com.
Supervisory authority: Spanish Data Protection Agency (www.aepd.es).
2. Merchant data
| Data | Purpose | Legal basis |
|---|---|---|
| Store domain, name and language | Provide the service and identify the account | Performance of contract (Art. 6.1.b GDPR) |
| WhatsApp Business credentials (Meta token, account and number IDs), encrypted | Send notifications from the merchant's account | Performance of contract |
| QR mode session (if used) | Send notifications from the WhatsApp linked by the merchant | Performance of contract |
| Settings, templates and subscription status | Configure the service and apply the plan | Performance of contract |
| Technical logs without customer personal data | Security and troubleshooting | Legitimate interest (Art. 6.1.f GDPR) |
3. Store customer data (as processor)
To send each notification we read the order from Shopify: customer name, phone, address country, order number, amount, products and tracking details. We do not request or store the customer's email.
We store the phone encrypted (AES-256-GCM), an irreversible fingerprint to detect duplicates and opt-outs, and a masked version for the log. Name and phone are deleted automatically after the period chosen by the merchant (30, 60, 90 or 180 days; 90 by default). Opt-outs (STOP) are kept only as an irreversible phone fingerprint, so we never message someone who opted out again.
We do not use this data for our own purposes, we do not sell it and we do not profile or make automated decisions.
4. WhatsApp and Meta
With the official API, messages are sent from the merchant's own WhatsApp Business account, under the merchant's agreement with Meta. In QR mode, they are sent from the WhatsApp the merchant links by scanning a code, using unofficial software (Evolution API) on our EU server, which does not store chat content. In both cases WhatsApp receives the recipient's phone and the message text, governed by the WhatsApp terms accepted by the merchant.
5. Recipients and sub-processors
| Sub-processor | Service | Data location |
|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd.) | App servers (Cloud Run, Cloud Tasks) and QR mode server (Compute Engine) | Belgium (europe-west1), EU |
| Neon Inc. | PostgreSQL database | Frankfurt (AWS eu-central-1), EU |
| Shopify Inc. | Store platform and subscription billing | Canada (EU adequacy decision) |
6. Retention
Customer data: per the period chosen by the merchant (90 days by default). Store data: while the app is installed. When the app is uninstalled we delete the WhatsApp credentials and session, and Shopify asks us to delete the store's data 48 hours later; we do so on receiving that request.
7. Security
- Encryption in transit (TLS) and at rest (database encrypted by the provider).
- Phones and credentials additionally encrypted in the application (AES-256-GCM).
- Infrastructure in the European Union, with separate test and production environments.
- Restricted system access with two-step verification.
- Logs without customer personal data.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to verifactuconnect@gmail.com. If you are a store's customer, please contact the store first, as it is the controller of your data; we will help it handle your request. You may also complain to the AEPD.
9. Cookies
The app runs inside the Shopify admin and does not use its own tracking cookies or analytics tools.