Privacy Policy

1. Information We Collect

When you install KLYX OmniChat, we collect and process the following categories of data:

Merchant data (from Shopify):

• Shopify shop domain, store name, and plan
• OAuth access token for Shopify Admin API (stored encrypted)
• Product catalog: titles, descriptions, variants, prices, inventory levels, images (used to train the catalog AI)
• Orders and cart data (used solely for WhatsApp abandoned cart recovery, if enabled)
• Customer contact details (phone number, name) as stored in Shopify — only for customers who have opted in to WhatsApp messaging

Instagram data (if connected):

• Instagram Business account access token (stored encrypted)
• Incoming DM text (processed to generate a reply; not stored permanently by default)
• Post captions and media metadata (for the feed embed feature)
• Comment text on posts (to trigger comment-to-DM automations)

WhatsApp data (if connected):

• WhatsApp Business number and Meta Business account ID
• Inbound message content (processed for AI replies; stored for conversation history in the dashboard)
• Customer opt-in and opt-out records

App usage data:

• Conversation logs (anonymized where possible) for dashboard analytics
• Feature usage metrics (which channels are active, conversation counts)
• Error logs for debugging (no customer PII in error logs)

2. How We Use Your Data

We use collected data for the following purposes only:

• Core service delivery: Powering AI replies on all connected channels using your product catalog
• Abandoned cart recovery: Sending WhatsApp messages to opted-in customers who have abandoned carts
• Instagram feed embed: Fetching and displaying your Instagram posts on your Shopify storefront
• Dashboard analytics: Showing you conversation metrics, channel performance, and usage statistics in the app admin
• App improvement: Aggregate, anonymized usage patterns to improve AI accuracy and app features

We do not sell your data or your customers' data to any third party. We do not use your customers' data to advertise to them outside the channels you configure.

3. Third-Party Channels & Services

The App integrates with the following third-party services:

• Shopify Admin API & Billing API — data processing governed by Shopify's Terms of Service
• Meta Graph API (Instagram) — DM and feed data governed by Meta's Platform Terms; subject to Meta's data use policies
• WhatsApp Business API (via Meta) — messaging governed by Meta's WhatsApp Business Terms and the applicable messaging template policies

When you connect Instagram or WhatsApp, you are subject to Meta's terms in addition to ours. You are responsible for obtaining any necessary consents from your customers before messaging them via these channels.

4. Storage & Security

All app data is stored on a Dokploy-managed VPS hosted in the EU. We employ the following security practices:

• All OAuth tokens and API credentials are encrypted at rest using AES-256
• All data in transit uses TLS 1.2 or higher
• Access to production databases is restricted to authorized KLYX systems and personnel
• We do not store raw WhatsApp or Instagram access tokens in logs
• Regular automated backups with encryption

For a full description of our security posture, see the Security Policy.

5. Data Retention

We retain data for the following periods:

• Conversation transcripts: 90 days (configurable in dashboard on Pro plan)
• Product catalog index: Maintained while the app is installed; deleted within 30 days of uninstallation
• WhatsApp opt-in records: Retained until the customer opts out or requests deletion
• Shop OAuth tokens: Deleted within 48 hours of app uninstallation
• Aggregate analytics: Up to 2 years, in anonymized form only

When you uninstall the App, Shopify sends us a mandatory app/uninstalled webhook. Upon receipt, we begin an automated deletion of all personally identifiable data linked to your shop within 30 days.

6. GDPR & Your Rights

If you or your customers are located in the European Economic Area (EEA) or the United Kingdom, the following rights apply under GDPR / UK GDPR:

• Right of access: Request a copy of the data we hold about your shop or your customers
• Right to rectification: Request correction of inaccurate data
• Right to erasure ("right to be forgotten"): Request deletion of data — we honor Shopify's mandatory GDPR customer erasure webhooks automatically
• Right to portability: Request your data in a machine-readable format
• Right to restrict processing: Request that we limit how we use your data
• Right to object: Object to processing based on legitimate interests

To exercise any of these rights, contact us at contact@klyx.agency. We will respond within 30 days.

The data controller is KLYX Agency, India. We act as a data processor on behalf of the Shopify merchant (you) for data belonging to your customers.

7. Children's Privacy

KLYX OmniChat is not directed to children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

8. Contact Us

For privacy-related questions, data requests, or concerns:

• Email: contact@klyx.agency
• Phone: +91-8279555123
• Address: KLYX Agency, India

We aim to respond to all privacy inquiries within 5 business days.