This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Bharat Innovations, operator of Wapimate (“we”, the “Processor”), and the business using Wapimate (“you”, the “Controller”). It applies whenever we process personal data of your customers on your behalf, and you accept it by using the service.
1. Roles
You decide which customers to message and why, so you are the controller of your customers' personal data. We process it only to provide Wapimate to you, on your documented instructions: your settings, automations, campaigns and messages.
2. Data we process
- Customers of your store: name, phone number, email address, shipping and billing address, order history, cart contents, marketing consent.
- Conversations: WhatsApp messages exchanged between your business and your customers.
- Your team: names and email addresses of the people you invite.
We don't process payment card details for your customers, and we don't sell personal data.
3. Purpose
Sending the WhatsApp messages you configure (order confirmations, COD verification, cart reminders, shipping updates, campaigns), showing your team the shared inbox and order history, measuring results, and — only if you turn it on — generating AI-suggested replies.
4. Sub-processors
We use these sub-processors to run the service:
- Meta Platforms (WhatsApp Business Platform): message delivery.
- Shopify: source of store, customer and order data you connect.
- Oracle Cloud Infrastructure (Mumbai, India): hosting and database.
- Brevo: account emails such as password resets and team invites.
- Razorpay: subscription payments (your billing data only).
- Anthropic: AI-suggested replies, only when you enable the AI assistant.
We will update this list before adding a new sub-processor, and you may stop using the service if you object.
5. Security
We keep appropriate technical and organisational measures in place, described on our Security page, including encryption in transit and at rest, isolation between workspaces, role-based access and audit logging. Everyone with access to personal data is bound by confidentiality.
6. Requests from your customers
When a customer asks to access or delete their data, we help you respond. Shopify privacy requests are handled automatically: customer redaction requests delete that customer's contact, conversations, orders and carts; data access requests are recorded and fulfilled by email to you within 30 days. Customers can also reply STOP to any message to opt out.
7. Personal data breaches
If we become aware of a breach affecting your data, we will notify you without undue delay and within 72 hours, with what we know about its nature, the data affected and the steps we are taking.
8. Deletion
When you uninstall our Shopify app, all store data (customers, orders, carts and products) is deleted 48 hours later when Shopify sends its shop redaction request. When you close your Wapimate account, we delete your workspace within 30 days of your request, except where the law requires us to keep billing records. Backups roll over within 14 days.
9. Audits
On reasonable request, we will provide the information you need to show that this DPA is being followed.
10. Law
This DPA is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, and the courts of Jaipur, Rajasthan have jurisdiction. Contact us through the details on our contact page.