Merchant Terms & Data Processing
This describes what Kinetx processes on your behalf as a merchant using the app, why, and what you're responsible for as the business that owns the relationship with your customers. See also our Privacy Policy, which covers the customer-facing disclosure.
1. Roles
For your customers' personal data (name, phone, email, order details), you are the data controller and Kinetx is the data processor. You determine why the data is collected (requesting a review after fulfillment); we process it only to carry that out on your behalf.
2. What We Process On Your Behalf
- Order and customer data from Shopify webhooks: customer name, phone, email, product/order details — used to send review request messages and track responses.
- Review content: star ratings and written text your customers submit via WhatsApp or email.
- Your own credentials: WhatsApp Business API token, review-platform API keys — encrypted at rest, used only to send messages and publish reviews on your behalf.
Full detail on encryption, sub-processors (Meta, Groq/Anthropic, Judge.me, Postmark, Resend), and retention is in the Privacy Policy.
3. Your Responsibilities
- You're responsible for having a lawful basis to collect and share your customers' contact information with us for this purpose (typically covered by your own store's terms/privacy policy and applicable consumer protection or marketing-consent law in your customers' jurisdiction — WhatsApp Business Messaging policy requires the customer relationship to be genuine, e.g. an actual order).
- You're responsible for your own WhatsApp Business Account and Meta compliance (template approval, messaging limits, opt-out handling on your account).
- If a customer contacts you directly asking that their data be deleted or corrected, let us know at privacy@kinetx.in and we'll action it, in addition to the automatic handling triggered by Shopify's GDPR webhooks.
4. What We Guarantee
- We process your customers' data only to provide the review-request service — never sold, never used for unrelated marketing.
- Sensitive data (phone numbers, your API credentials) is encrypted at rest (AES-256-GCM) and in transit (TLS).
- When you uninstall, your account is deactivated immediately; your data (and your customers' data) is deleted or anonymised within 48 hours, with any remaining trace fully anonymised within 30 days. Full detail in the Privacy Policy.
- We maintain a documented security incident response process and will notify you within 72 hours of confirming an incident that exposed your or your customers' data.
5. Termination
Either party may stop using/providing the service at any time by uninstalling the app (you) or by written notice (us). Section 4's data-deletion commitments apply on termination regardless of which party ends the relationship.
6. Changes
We may update these terms. Material changes will be communicated via the app dashboard and/or email. Continued use of the app after changes constitutes acceptance.
7. Contact
Questions about this agreement: privacy@kinetx.in