Privacy Policy

1. Introduction & who we are

Konnexion AI ("Konnexion", "we", "us") provides a multi-tenant platform that connects a merchant's Shopify store with the WhatsApp Business Platform, brokering messages and running an AI commerce agent. In this policy, "Merchant" means a business that uses our platform, and "User" or "you" means anyone whose information we process — including Merchants, their team members, and the end-customers who message a Merchant on WhatsApp.

As a Meta Tech Provider, each Merchant connects their own WhatsApp Business Account and Shopify store. We process data on the Merchant's behalf to operate the service, and the Merchant is the controller of their end-customers' data.

2. What information we collect

We collect only what we need to run the service:

• Account data — Merchant name, business details, contact email, team-member logins and roles.
• Connection credentials — WhatsApp Business Account and Shopify access tokens, stored encrypted (AES-256-GCM) and used only to operate your integration.
• Contacts & conversations — the phone numbers, names, tags, custom fields and message history that flow through a Merchant's WhatsApp line.
• Commerce data — orders, catalog and fulfilment data read live from the connected Shopify store to answer customer questions.
• Usage & technical data — IP address, device/browser info and logs, for security and reliability.

We do not knowingly collect data from children. Bring-your-own AI model keys are stored encrypted and used only to call the model provider you choose.

3. Shopify data & platform webhooks

When a Merchant connects a Shopify store, we process store, catalog, order and customer data through Shopify's APIs and the Storefront/Customer Account MCP. We honour Shopify's mandatory compliance webhooks:

• customers/data_request — we provide the stored data we hold about a customer on request.
• customers/redact — we delete a customer's data when Shopify instructs us to.
• shop/redact — we delete a shop's data after the app is uninstalled and the retention window passes.

4. How we use information

We use the information above to:

• operate the platform — deliver and receive WhatsApp messages, run the AI agent, and sync commerce data;
• authenticate users and secure accounts;
• provide analytics and attribution to the Merchant about their own messaging;
• provide support, and communicate service and billing updates;
• detect, prevent and investigate fraud, abuse and security incidents;
• comply with legal and regulatory obligations.

We do not sell your personal information, and we do not use end-customer conversation content to train our own models.

5. AI processing & your model provider

The conversational AI agent runs on a model key the Merchant provides (e.g. Anthropic, OpenAI, Google or AWS Bedrock). When the agent generates a reply, the relevant conversation context is sent to that provider under the Merchant's own account and billing. We store only the text and search index the agent needs to function; model usage is governed by the provider's terms.

6. Cookies & similar technologies

Our marketing website uses minimal cookies necessary for basic functionality and, where enabled, privacy-respecting analytics. The application uses cookies strictly necessary for authentication and session security. You can control cookies through your browser settings; disabling strictly-necessary cookies may break sign-in.

7. How we share information

We share information only as needed to run the service:

• Infrastructure & sub-processors — hosting, database and queue providers that operate the platform under contract.
• Platform partners — Meta (WhatsApp Business Platform) and Shopify, to deliver the integrations you connect.
• Your chosen AI provider — to generate agent replies, under your own key.
• Legal requests — where required by law, or to protect rights, safety and security.
• Business transfers — in a merger or acquisition, subject to this policy.

8. Data retention

We keep personal information only as long as needed for the purposes above, or as required by law. When a Merchant cancels, we delete or anonymise their data within a reasonable period (typically up to 180 days after cancellation), except where longer retention is legally required. Shopify shop/customer redaction requests are honoured on Shopify's schedule.

9. Security & data protection

We apply industry-standard safeguards: secrets and access tokens are encrypted at rest (AES-256-GCM), data is tenant-scoped so one Merchant can never read another's, access is least-privilege, and data is transmitted over TLS. No method is perfectly secure, but we work continuously to protect your information. Data may be processed on infrastructure located outside your country, with appropriate safeguards.

10. Your rights & choices

Depending on your jurisdiction, you may have the right to access, correct, delete, export or restrict processing of your personal information, and to withdraw consent. Merchants can manage most data directly in the app. End-customers should contact the Merchant they messaged (the controller of that data); we will support the Merchant in fulfilling valid requests. To reach us directly, use the contact details below.

11. International transfers

Where we transfer personal information across borders, we rely on appropriate legal mechanisms and require our sub-processors to maintain equivalent protection.

12. Changes to this policy

We may update this policy as the product and the law evolve. Material changes will be reflected by an updated "Last updated" date and, where appropriate, additional notice. Continued use of the service after changes take effect constitutes acceptance.

Contact