Privacy Policy

This policy explains how Wetroo Automation (“we”) handles information when a Shopify merchant installs the Wetroo Automation app (“the App”). The App sends WhatsApp notifications to the merchant’s customers through the merchant’s own Wetroo account.

Information we collect

• Store information: shop domain, store name and primary domain, and the access token Shopify issues to the App.
• Wetroo connection: the merchant’s Wetroo API key (stored encrypted with AES-256-GCM), Wetroo account ID, business name and WhatsApp number.
• Customer information, only to send messages or sync to CRM: customer name, phone number, email address (only when the merchant triggers CRM contact sync), and order, checkout, shipping, refund and return details received from Shopify.
• Message records: the phone number, notification type, template name, delivery status and any error for each message sent.
• Opt-outs: phone numbers of customers who replied STOP, so they are not sent marketing messages.
• One-time codes: a hashed (not readable) copy of WhatsApp OTP codes, kept for up to 1 day.

How we use it

Only to provide the App’s features: sending the WhatsApp notifications the merchant has turned on, showing delivery reports, handling COD confirmation replies (by tagging the related Shopify order) and honouring opt-outs. We do not sell personal information or use it for advertising.

Who we share it with

• Wetroo (wetroo.com), the WhatsApp Business platform the merchant connects, which sends the messages.
• Meta / WhatsApp, which delivers the messages to customers.
• Our hosting provider, which stores the App’s data on our behalf.

Retention and deletion

• Message records are deleted automatically after 90 days.
• When the App is uninstalled, the Wetroo API key is deleted immediately and pending messages are cancelled. All remaining store data is deleted when Shopify sends the shop redaction request (48 hours after uninstall).
• Customer data is deleted when Shopify sends a customer redaction request.

Merchant and customer rights

Customers can stop marketing messages at any time by replying STOP on WhatsApp. Merchants and their customers can ask for access to, or deletion of, their data by contacting the merchant or us at support@wetroo.com. We respond to Shopify’s data request and redaction webhooks as required by Shopify.

Security

Data is sent over HTTPS. API keys are encrypted at rest. Webhooks from Shopify and Wetroo are verified with HMAC signatures before they are processed.

Contact

Questions about this policy: support@wetroo.com.

Last updated: November 2026