Last updated: 2 July 2026
This page details exactly what data Product Inquiry on WhatsApp processes, why, how long it is kept, and how we meet our GDPR and Shopify compliance obligations. It complements our Privacy Policy.
Data inventory
| What we store | Why | Retention |
|---|---|---|
| Shop domain & owner email | Identify your store and send essential service and support communications | For the life of the install; deleted after uninstall |
| App settings (button config, WhatsApp number) | Render and route your inquiry button | For the life of the install; deleted after uninstall |
| Customer inquiry data (name, phone, email, message, product) | Deliver the inquiry to you and record it in your dashboard | Until deleted by you or via a redaction request |
Your GDPR rights
If you or your customers are in a region covered by the GDPR or similar laws, you have the right to access the personal data we hold, to have it corrected, to have it erased, to restrict or object to its processing, and to data portability. To exercise any of these rights, email piw@wprobo.com and we will respond within 30 days.
Mandatory Shopify compliance webhooks
As required of every Shopify app, we implement Shopify's three mandatory compliance webhooks, and they are handled automatically:
- customers/data_request — when a customer requests their data, we compile and provide the inquiry data we hold about them.
- customers/redact — when a customer redaction is requested, we permanently delete that customer's inquiry data.
- shop/redact — sent by Shopify roughly 48 hours after a store uninstalls the app; on receipt we permanently delete or irreversibly anonymize that store's personal data.
In practice this means all personal data (contact details, message contents, access tokens) is deleted or irreversibly anonymized approximately 48 hours after you uninstall, without any action needed on your part. We retain only aggregated, non-personal statistics (e.g. total inquiry counts) that cannot identify any person. Encrypted backups are purged on a rolling 60-day cycle, and redactions are re-applied if a backup is ever restored.
Subprocessors
We rely on the following subprocessors to operate the app:
- Shopify — Commerce platform your store runs on.
- Railway — Application hosting.
- Neon — Managed PostgreSQL database hosting.
- Resend — Transactional and notification email delivery.
Security measures
- All app endpoints that receive Shopify traffic are verified using HMAC signatures.
- All data is encrypted in transit using TLS.
- Database access follows least-privilege principles, limited to what each service needs.
- Storefront-facing API calls are routed through Shopify's signed App Proxy so requests are authenticated.
For any data-handling question, contact us at piw@wprobo.com.