WhatsApp, GDPR and Shopify: how Whapi handles personal data

What personal data Whapi processes

Whapi processes the personal data it needs to send WhatsApp messages for your store: your account details, your customers’ phone numbers and order details, the messages sent, and how you use the app. The table follows sections 2, 3 and 6 of the Whapi privacy policy.

Whapi’s Shopify App Store listing also shows which Shopify data the app can access, including customers’ names, phone numbers and physical addresses, and device data such as geolocation, IP address, browser and operating system. The full list is in what data Whapi can access in your store.

Who is responsible for what: your store, Whapi, Meta and Shopify

Your store decides which customers to message and why, so under GDPR it is usually the controller of that data, while Whapi sends the messages on your behalf. GDPR (Article 4) calls the party that decides why and how personal data is used the controller, and a party that processes it on the controller’s behalf a processor.

In a typical Whapi setup, your store collects the phone number at checkout, chooses the automations and writes the messages. Whapi sends those messages on your behalf, which its privacy policy states in section 3. The policy does not use the words controller and processor, so treat the roles below as guidance and confirm them for your own setup.

Meta’s WhatsApp Business Messaging Policy makes the business responsible for the notices, permissions and consents it needs, including a published privacy policy. If your records of processing need a data processing agreement, the location of data or a list of service providers, email info@usewhapi.com.

WhatsApp opt-in and consent

Before you send a business-initiated WhatsApp message, the customer must have given you their number and agreed to receive WhatsApp messages from your business. That is Meta’s rule for every business on WhatsApp, and it applies on top of whatever legal basis you rely on under GDPR.

Meta’s opt-in requirements say you must clearly state that the person is opting in to messages from your business, state your business name, and comply with applicable law. Meta also recommends telling people which kinds of messages they will get, or collecting a separate opt-in for each kind, and making it easy to opt out. Under the WhatsApp Business Messaging Policy you must respect every request to block, stop or opt out, whether it comes in on WhatsApp or anywhere else.

Many countries also have national rules on electronic direct marketing that can be stricter than Meta’s policy, so check them before you send campaigns. The WhatsApp newsletter signup in Whapi lets customers opt in to marketing messages on your store, which gives you a clear record of who agreed.

How long Whapi keeps data

Whapi keeps message logs for 90 days and other data while your account is active, then deletes your data within 30 days of account deletion unless the law requires it to be kept. Those periods come from section 6 of the privacy policy.

When you uninstall Whapi, Shopify’s own rules add a second clock:

• Shopify sends Whapi a shop/redact request 48 hours after you uninstall the app.
• Shopify requires apps to complete each privacy request within 30 days of receiving it.

Copies of messages also exist outside Whapi. Meta handles message data under its own terms. If you use WhatsApp coexistence, the same chats are in the WhatsApp Business App on your phone, and your customers keep the messages they received on their own phones.

Access and deletion requests through Shopify

Handle customer requests in your Shopify admin. Shopify forwards them to Whapi through its mandatory privacy webhooks, which every app in the Shopify App Store must subscribe to, whether or not it collects personal data.

1. Open the customer in Shopify. In your Shopify admin, go to Customers and open the customer who made the request.
2. Request or erase their data. Click More actions, then Request customer data for an access request or Erase personal data for an erasure request. You have 10 days to cancel an erasure request.
3. Shopify notifies your apps. Shopify sends the request to the apps installed on your store, including Whapi, and apps must complete it within 30 days of receiving it.
4. Clean up outside Shopify. Shopify’s request doesn’t reach other companies you share data with, or chats in the WhatsApp Business App on your phone. Delete those yourself, and email info@usewhapi.com if you need anything else from Whapi.

Security and sharing

Whapi does not sell personal data, and its privacy policy lists the only parties it shares data with: Meta, to deliver messages through the official WhatsApp Business Platform; service providers that help run the service, such as hosting and analytics; and authorities when the law requires it.

The policy also describes encryption in transit and at rest, secure API connections and regular security audits, and notes that no method of transmission over the internet is 100% secure. On the Team plan, your agents answer customers from the shared Team Inbox, so give inbox access only to people who need it.

AI assistant connectors

AI assistants get access to your Whapi data only if you connect one and approve it inside the Whapi app in your Shopify admin. Each connection is limited to the store you approved. On the Team plan, the assistant can read shared inbox conversations, including customer names, phone numbers and message text.

Whapi stores access keys only in hashed form; they expire after one hour, and renewal keys expire after 30 days unless used. Data returned to the assistant is processed by its provider under that provider’s privacy policy, and Whapi does not use data accessed through AI connectors to train AI models. See Connect Whapi to Claude for how it works.

Cookies on usewhapi.com

This website uses Google Analytics in consent mode. For visitors in the EEA, the UK and Switzerland, analytics and advertising storage stays off until they accept the cookie banner. Visitors in European time zones see the banner, and their choice is saved in their own browser. These cookies apply to the website only; they are not part of the Whapi app inside Shopify.

GDPR checklist for WhatsApp on Shopify

Use this list before you turn on WhatsApp automations for customers covered by GDPR, such as those in the EU or the UK.

1. Update your store’s privacy policy to say you send WhatsApp messages and that Whapi and Meta process them.
2. Collect a WhatsApp opt-in that names your store and says which messages customers will get.
3. Collect a separate opt-in before you send campaigns, newsletters or promotional reminders.
4. Keep a record of when and where each customer opted in.
5. Honor every opt-out request, on WhatsApp or anywhere else, and stop messaging that customer.
6. Handle access and deletion requests in your Shopify admin, and clear related chats in the WhatsApp Business App.
7. Give app access in Shopify only to staff who need it.
8. Email info@usewhapi.com for anything your records need from Whapi.