Privacy Policy

Last updated: October 16, 2026. Waspy Tech LLC, 131 Continental Dr Suite 305, Newark, DE 19713. Contact: admin@waspytech.com.

Who this covers

This policy covers merchants who use Waspy and the end customers who message those merchants or whose Shopify store data is synced so the merchant can reply, see orders, and send the notices they configured. Waspy is the processor for merchant customer data. The merchant is the controller of their customer relationships.

Shopify merchant data

When a store installs the Waspy app we store the shop domain, shop name, shop email, the app plan, and encrypted offline access tokens. We use them to create or link the Waspy account, show the embedded admin, bill the app through Shopify App Pricing, and call the Shopify Admin API for the features the merchant turned on. We do not sell this data.

Shopify customer data

For a linked store we store customer name, email, phone, orders, and abandoned checkouts needed for the inbox, the order view, abandoned-checkout notices, and WhatsApp messages the merchant sends. Tokens are encrypted at rest (AES-256-GCM).

Shopify privacy webhooks

customers/data_request. We build an export of the Shopify customer data we hold and email it to the shop email (Resend). We record that the export was sent.

customers/redact. We delete Shopify personal data and the Waspy contact created from Shopify. If that contact has WhatsApp, Instagram, or Facebook conversations, we do not delete those conversations. We anonymize the personal fields linked to that Shopify customer and record the action.

shop/redact. Shopify sends this after the app is uninstalled. We delete the shop and its Shopify data within 48 hours. app/uninstalled revokes access immediately.

GDPR and CCPA

You can ask to access, correct, delete, or export personal data, and to object to or limit processing. Under the CCPA you can ask us not to sell personal information: we do not sell personal information. Email admin@waspytech.com or use waspytech.com/data-deletion. Shopify customer requests are handled through the webhooks above.

Sub-processors

Google Cloud (hosting, database, storage), OpenAI and Anthropic (AI replies; we do not allow them to train generalized models on merchant data), Meta (WhatsApp, Instagram, Messenger), Resend (transactional email, including Shopify data-request exports), and ElevenLabs (voice, only if the merchant turns it on).

Retention

Shopify data is deleted within 48 hours after uninstall, when Shopify sends shop/redact. Other account data is kept while the account is active and for 30 days after it is closed, unless a longer legal period applies (billing records). Assistant context from messages defaults to 90 days.

Security

Access tokens are encrypted at rest. Traffic uses TLS. Data is isolated per merchant account.