Privacy Policy

Last updated: September 9, 2026

WhatRev ("we", "our", or "us") sends daily Shopify store performance reports to Shopify merchants via WhatsApp. This policy explains what data we collect, how we use it, and your rights under applicable Indian law including the Digital Personal Data Protection Act, 2023 ("DPDPA").

1. What we collect

WhatsApp number: Your WhatsApp number, including country code, to deliver reports.
Monthly revenue target: The target you set during onboarding to calculate progress.
Shopify OAuth token: An access token that lets us read your store's orders and returns. We never store your Shopify password.
Meta Ads token (optional): An access token to read your ad spend and ROAS from Facebook/Instagram campaigns via the Meta Marketing API.
Google Ads token (optional): An OAuth 2.0 access token authorising the scope https://www.googleapis.com/auth/adwords to read your Google Ads spend, impressions, clicks, and ROAS data.
Amazon Selling Partner token (optional): An OAuth token issued through Amazon's Login with Amazon (LWA) flow that lets us read your Amazon seller order and sales data via the Selling Partner API. We never store your Amazon password.
Amazon Ads token (optional): An OAuth token that lets us read your Amazon Advertising spend, ACOS, and campaign performance data via the Amazon Ads API.
Slack bot token and destination (optional): If you connect Slack, we store an encrypted bot token plus the Slack workspace and channel you choose, solely to upload your daily report there. We never store your Slack password.
Telegram chat ID (optional): If you connect Telegram by starting the WhatRev bot, we store the ID of that private chat solely to deliver your daily report there. The bot token is held only as an encrypted Cloudflare secret; we do not store your Telegram password or read your conversations.
Order and revenue data: We fetch yesterday's and month-to-date order data to generate your report. This data is not stored permanently — it is fetched fresh each day and used only to generate the report card sent to your WhatsApp.
Usage and log data: When you use WhatRev, our servers may automatically collect your IP address, browser type, device type, and pages visited. This data is used solely for security monitoring and is not linked to your identity.
Cookies: We use strictly necessary session cookies to keep you logged in. We do not use advertising or tracking cookies.

2. How we use your data

To generate and send your daily WhatsApp report card.
To upload your daily report card to the Slack channel you choose, if you opt in to Slack delivery.
To upload your daily report card to the private Telegram chat you explicitly connect, if you opt in to Telegram delivery.
To track your subscription status and trial period through Shopify Billing.
To calculate progress toward your monthly revenue target.
We do not sell your data to any third party.
We do not use your data for advertising or marketing profiling.

3. Google Ads API — limited use disclosure

WhatRev's use of data obtained from the Google Ads API is strictly limited to providing and improving the WhatRev service as described in this policy. We do not use Google Ads data to serve advertisements, build user profiles, or share with any third party other than as required to operate the service. Our use of Google Ads API data complies with the Google Ads API Terms of Service and Google's Limited Use Policy.

Specifically, data accessed via the Google Ads API is used only to:

Calculate and display your Google Ads spend, ROAS, and related metrics in your daily WhatsApp report.
Nothing else. The data is not stored beyond the generation of that day's report.

4. Amazon Selling Partner API & Amazon Ads API — data use disclosure

WhatRev's use of data obtained from the Amazon Selling Partner API and the Amazon Ads API is strictly limited to providing and improving the WhatRev service as described in this policy. We do not use Amazon data to serve advertisements, build user profiles, or share it with any third party other than as required to operate the service. Our use of this data complies with Amazon's Data Protection Policy and Acceptable Use Policy.

Specifically, data accessed via Amazon's APIs is used only to:

Calculate and display your Amazon order, sales, and (where connected) advertising metrics in your daily WhatsApp report.
Nothing else. The data is not stored beyond the generation of that day's report.

5. Data security

All OAuth and bot access tokens (Shopify, Meta, Google, Amazon, and Slack) are encrypted at rest using AES-256-GCM encryption before being stored in our database. The Telegram bot token is held only as a Cloudflare secret and is never stored in our database. Your WhatsApp number is stored in plaintext as it is required for message delivery. We use HTTPS for all data in transit.

6. Third-party services

WhatRev integrates with the following third-party services to operate:

Shopify — to read store order data via their official OAuth API.
Meta (Facebook) — to read ad spend data via the Meta Marketing API.
Google — to read Google Ads data via the Google Ads API. Use of this integration is also subject to the Google Ads API Terms of Service.
Amazon — to read seller order/sales data via the Selling Partner API and, where connected, advertising data via the Amazon Ads API.
Slack — to upload your report image to the Slack channel you explicitly select, if you connect Slack delivery.
Telegram — to upload your report image to the private WhatRev bot chat you explicitly connect, if you opt in to Telegram delivery.
Authkey — our WhatsApp Business Solution Provider for message delivery.
Cloudflare — our database (D1) and file storage (R2) provider, operating on Cloudflare's global network.

7. Data retention

We retain your account data for as long as your subscription is active. If you cancel your subscription or request deletion, we delete your OAuth tokens immediately and your account data within 30 days. Daily report data (order figures, ad spend) is not retained after the report is delivered.

8. Children's privacy

WhatRev is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that a user is under 18, we will promptly delete their account and associated data.

9. Your rights under DPDPA

Under India's Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

Access: You can request a summary of all personal data we hold about you and the purposes for which it is processed.
Correction: You can request correction of inaccurate or incomplete personal data, including your WhatsApp number or monthly target.
Erasure: You can request deletion of your account and all associated personal data at any time. See our Data Deletion page.
Grievance redressal: You may contact our Grievance Officer (details below) if you have a complaint about how your data is handled.
Nomination: You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.

10. Contact & Grievance Officer

For any privacy-related questions, requests, or grievances under DPDPA, email us at hello@whatrev.com. We respond within 2 business days. As required under DPDPA, our Grievance Officer can be reached at the same address.