Privacy policy

This policy explains what personal data easymessage (“we”, “us”), operated by Site Hustle, Mansoura, Egypt, collects and what we do with it. It covers our website, the easymessage app, and the data we process for Shopify merchants about their customers.

Two roles

For merchants who sign up, we decide how account data is used — we are the controller. For the merchant's customers (shoppers), the merchant is the controller and we process their data only to provide the service the merchant set up — we are the processor. Shoppers with questions about their data should contact the store first; we help the store answer.

What we collect

• Account data: your name, email address, business name and a hashed (never readable) password; sign-in times and the IP address of requests, for security.
• Connection data: your Shopify store address and access token, and your WhatsApp Business account, phone number ID and access token. Tokens and app secrets are stored encrypted.
• Shopper data from your store: names, phone numbers, email addresses, order details (products, totals, payment and shipping status, tracking numbers), checkout and cart contents, customer tags and marketing consent — received from Shopify when the events happen.
• Messages: the WhatsApp messages sent for you and their delivery status; messages, photos, files and voice notes customers send you in the inbox, and your replies.
• Website: what you type into the contact form. Page-view statistics are counted without cookies and without personal identifiers.

Why we use it

• To run the service: sending the messages your flows and campaigns describe, showing replies in your inbox, and showing you analytics.
• To keep it secure and working: detecting misuse, fixing errors and telling you when a connection needs attention.
• To support you and to email you about your account (for example, problems with your connections). We don't send marketing emails without consent.
• To bill you for your plan.

We do not sell personal data, and we do not use shopper data for our own marketing or to train AI models.

Marketing messages to shoppers

Flows and campaigns marked as marketing are sent only to shoppers whose marketing consent is recorded in the merchant's Shopify store. Any shopper can reply STOP to stop receiving marketing messages from that store.

Who we share it with

• Meta Platforms (WhatsApp Business Platform): message content and recipient phone numbers, to deliver messages. Meta's own terms and privacy policy apply to WhatsApp.
• Shopify: we read store data through Shopify's APIs with the permissions the merchant grants.
• Infrastructure providers that host our servers, database and email, under contracts that require them to protect the data. Our website runs on Cloudflare; contact-form messages are delivered by email through Resend.
• Authorities, when the law requires it.

These providers may process data outside your country, including in the United States and the European Union. Where required, we rely on standard contractual protections for those transfers.

How long we keep it

• Account and connection data: while your account is open. When you close it, we delete it within 30 days, except what the law requires us to keep (such as invoices).
• Shopper data and message history: while the merchant's account is open, or until the merchant or Shopify asks us to delete it.
• Contact-form messages: as long as needed to answer, then up to 12 months.

Deletion requests from Shopify

When a merchant uninstalls easymessage, we stop receiving their store data and remove the store's access token immediately. When Shopify sends a customer-data or store-data erasure request, we delete the matching messages and records. See Data deletion for how to ask us directly.

Security

Data travels over encrypted connections (HTTPS). Access tokens and secrets are encrypted at rest, passwords are hashed, and staff access to merchant data is limited, protected with two-factor authentication and logged.

Your rights

Depending on where you live, you can ask to see, correct, export or delete your personal data, or object to how we use it. To do so, use our contact form. We reply within 30 days. You can also complain to your local data-protection authority.

Changes

If we change this policy in a meaningful way, we'll tell merchants by email or in the app before the change applies.