Legal
Privacy policy
What the app reads, what it stores, and how to get it deleted — written to be checked against what the product actually does.
This policy covers Cognilexa OÜ’s Shopify app, WhatsApp Agent. It describes what we read, what we keep, who we share it with, and how to have it removed. It is written so you can match each statement against the product rather than take it on faith.
What we read from your store
The agent has to look things up in order to answer accurately, so it reads through the Shopify API with the scopes you approve at install, and within per-agent permission groups you choose:
- Products, variants and inventory — so availability and specification questions are answered from your real catalogue.
- Orders and fulfilments — so “where is my order?” is answered from the live record. This touches personal data, so it is granted deliberately and can be withheld per agent.
- Customers — only when you grant it, and only so the agent can recognise a returning buyer.
What we store
- Conversations and messages — the WhatsApp threads between your store and your customers, kept so you and your team can read and continue them.
- Your configuration — store profile, policies, brand voice, agent instructions and templates that you write.
- A private product index — a search collection built from your catalogue so the agent can search it. It is scoped to your store alone.
- Usage counters — how many messages, agents and products are in use, which is how plan limits are enforced.
How your data is separated from other merchants’
The app is multi-tenant by store. Your conversations, leads, templates and catalogue index are scoped to your account. Your product index is a private collection for your store alone.
What we do not claim
The honest state matters more here than a polished one, because you are about to grant access to customer data:
- Automated deletion is incompleteWe honour Shopify’s mandatory privacy webhooks, but fully automated erasure is unfinished. A deletion request may need manual action from us. We will do it, and tell you when it is done rather than describing it as automatic.
- No retention schedule is enforced in codeWe do not publish retention periods we do not actually implement. Ask us and we will delete on request instead of pointing at a number we do not honour.
- No compliance certificationWe are not SOC 2 certified and do not describe ourselves as fully GDPR compliant. See data and security for the full list of claims we do not make.
Who processes data on our behalf
Answering a message requires sending the conversation content to a language-model provider, and delivering it requires Meta’s WhatsApp Business Platform. Shopify hosts the store data we read. We do not sell personal data, and we do not use your customers’ conversations for advertising.
Deleting data
You can uninstall the app at any time, which stops all processing. For a deletion request — for your whole store or for a single customer — email [email protected] from your store’s admin address. Tell us whether it is a store-level or customer-level request, and we will confirm when it is complete.
Billing data
Subscriptions are handled by Shopify, not by us. We never see or store your payment details. Charges are billed in USD through your Shopify invoice.
Changes and contact
If this policy changes in a way that affects what we do with data, we will date the change. Data questions, requests and complaints go to [email protected].
Start with the free plan
Free: 1 agent, 50 AI replies a month and up to 100 products indexed. No credit card required, billed through Shopify, cancel any time.