Privacy Policy
What data Recoverly processes, why, and the controls merchants and their customers have over it.
Last updated: August 31, 2026
Recoverly ("the App") helps Shopify merchants add a WhatsApp chat button to their storefront and send WhatsApp messages such as abandoned-cart reminders, order confirmations, and shipping updates through the WhatsApp Business Platform (Meta). This policy explains what data the App processes and why.
Information we collect
When a merchant installs the App we access and store:
- Store information — store name, domain, and the settings the merchant configures in the App.
- Order and checkout information — order id, order total, checkout status, and fulfillment status, used solely to trigger the messages the merchant has configured.
- Customer contact information — customer name and phone number, used solely to deliver WhatsApp messages on the merchant's behalf, and only where the customer has consented (checkout text-marketing consent or an explicit WhatsApp subscription on the storefront).
- WhatsApp connection data — the merchant's WhatsApp Business Account id, phone number id, and access token issued by Meta during Embedded Signup.
- Message records — messages sent through the App and delivery/read receipts returned by Meta, plus customer replies to power the merchant's inbox.
How we use information
- To deliver the messaging features the merchant configures.
- To show the merchant analytics about their own messages.
- To comply with legal obligations.
We do not sell personal data, use it for our own advertising, or share it with third parties other than the processors required to run the service (Shopify, Meta/WhatsApp, and our hosting provider Fly.io).
Consent and opt-out
Marketing messages are only sent to customers who opted in. Customers can opt out at any time by replying STOP to any message; the App honors the opt-out immediately.
Data retention and deletion
Data is retained while the merchant uses the App. When a store owner deletes a customer, or uninstalls the App, we permanently delete the related personal data in response to Shopify's GDPR webhooks (customers/redact, shop/redact). Customers may also request deletion through the merchant they purchased from.
Security
Data is stored on encrypted infrastructure, access tokens are kept server-side only, and all traffic uses TLS.
Contact
Questions or data requests: [email protected]