Privacy Policy
Kinetx ("we", "us", or "our") operates a Shopify application that collects product reviews from customers via WhatsApp after order delivery. This policy explains what data we collect, why, and how we protect it.
1. Data We Collect
- Merchant data: Shopify store domain, WhatsApp Business credentials (encrypted at rest), review platform API keys (encrypted at rest), plan and billing status.
- Customer data: Phone number (AES-256-GCM encrypted), first and last name, email address, order and product information, sourced from Shopify order webhooks.
- Review content: Star ratings and written review text submitted by customers via WhatsApp.
- Message metadata: WhatsApp message IDs, delivery timestamps, read receipts.
2. How We Use Data
- Sending review request messages to customers on behalf of the merchant.
- Analysing review content with an AI model to classify sentiment and route support tickets.
- Publishing approved reviews to third-party review platforms (Judge.me, Loox, Yotpo) at the merchant's direction.
- Generating anonymised analytics for the merchant's dashboard.
3. Data Sharing
We do not sell customer data. We share data only with:
- Meta Platforms, Inc.: to deliver WhatsApp messages via the Meta Cloud API.
- Anthropic, PBC: to analyse review text (no PII is included in LLM prompts).
- Review platforms (Judge.me / Loox / Yotpo): to publish reviews at the merchant's request.
- Resend, Inc.: to send transactional email notifications to merchants.
4. Data Retention
Customer data is retained for as long as the merchant's account is active. When a merchant uninstalls the app, all their data and associated customer records are permanently deleted within 48 hours. Customers may request deletion of their data by replying STOP to any WhatsApp message or by contacting the merchant directly.
5. Security
All personally identifiable information (phone numbers, API keys, access tokens) is encrypted at rest using AES-256-GCM. Opt-out records store only a SHA-256 hash of the phone number. The plaintext number is never persisted. All data is transmitted over TLS.
6. Your Rights (GDPR / CCPA)
If you are a customer whose data was collected through this app, you may request access to, correction of, or deletion of your personal data by contacting the merchant from whom you received the WhatsApp message, or by emailing us at privacy@kinetx.in.
Merchants have access to a data export and deletion tool within the app's settings, in compliance with Shopify's GDPR webhook requirements.
7. Cookies
The merchant-facing app dashboard uses only functional cookies required for session authentication (via Shopify App Bridge). No tracking or advertising cookies are used.
8. Changes to This Policy
We may update this policy. Material changes will be communicated via the app dashboard and/or email. Continued use of the app after changes constitutes acceptance.
9. Contact
Questions about this policy: privacy@kinetx.in