Privacy Policy

Last updated: October 8, 2026

WhatRev provides store performance reports and related account services to Shopify merchants. This policy explains how we handle information when you visit our website, install or use our app, connect an integration, receive a report, or contact support. In this policy, "we", "our", and "us" refer to WhatRev. It applies to users worldwide.

For merchant account information, website usage, and service security, we determine how information is used to operate WhatRev. For store data that a merchant authorizes us to access, we process it to provide the requested reporting service. The merchant remains responsible for its own store privacy notices and customer requests.

1. What we collect

• WhatsApp number: Your WhatsApp number, including country code, to deliver reports.
• Account email and profile information: Your email address and the account details you provide, used for sign-in, account notices, and report delivery where you choose email.
• Monthly revenue target: The target you set during onboarding to calculate progress.
• Shopify connection and store information: Your store domain, an OAuth access token, store currency, and store time zone. We use these to authenticate the connection, calculate reports in the correct currency and reporting period, and schedule delivery. We never store your Shopify password.
• Shopify order and refund information: Through Shopify's APIs, we read order creation dates, order amounts, refund identifiers, refund processing dates, and refunded amounts. We use this information to calculate daily and month-to-date sales, order counts, average order value, and returns. Our reports retain store-level metrics and report assets rather than buyer profiles.
• Shopify billing and installation information: Subscription identifiers, subscription and trial status, and installation or uninstallation events. Shopify processes app charges through Shopify Billing; WhatRev does not collect your payment-card number through this billing flow.
• Meta Ads token (optional): An access token to read your ad spend and ROAS from Facebook/Instagram campaigns via the Meta Marketing API.
• Google Ads token (optional): An OAuth 2.0 access token authorising the scope https://www.googleapis.com/auth/adwords to read your Google Ads spend, impressions, clicks, and ROAS data.
• TikTok Ads token (optional): An access token and the selected advertising-account details needed to read TikTok Ads spend and related reporting metrics.
• Amazon Selling Partner token (optional): An OAuth token issued through Amazon's Login with Amazon (LWA) flow that lets us read your Amazon seller order and sales data via the Selling Partner API. We never store your Amazon password.
• Amazon Ads token (optional): An OAuth token that lets us read your Amazon Advertising spend, ACOS, and campaign performance data via the Amazon Ads API.
• Slack bot token and destination (optional): If you connect Slack, we store an encrypted bot token plus the Slack workspace and channel you choose, solely to upload your daily report there. We never store your Slack password.
• Telegram chat ID (optional): If you connect Telegram by starting the WhatRev bot, we store the ID of that private chat solely to deliver your daily report there. The bot token is held only as an encrypted Cloudflare secret; we do not store your Telegram password or read your conversations.
• Report and account data: We fetch order, revenue, return, and connected-platform performance data to generate reports and troubleshoot delivery or reporting issues. We retain the account records, daily metrics, delivery records, and generated report assets needed to operate the service and meet the retention terms below.
• Support request and access data: If you open a support request, we collect your request details and whether you consent to temporary support access. A support access code is stored only as a cryptographic verification value; support sign-in and diagnostic-view audit records do not contain your code, passwords, OAuth tokens, raw IP address, or report content.
• Usage, security, and analytics data: Our services may collect device, browser, IP-derived security information, pages visited, and service events to secure and improve WhatRev. Google Analytics and Meta Pixel may process visits to our website and web app when enabled. These tools may use cookies or similar technologies under their own policies.
• Cookies: We use necessary session cookies to keep you logged in and may use analytics or marketing technologies as explained in section 11.

Information about your store's customers

Our Shopify reporting queries do not request customer names, email addresses, telephone numbers, or billing and shipping addresses. WhatRev does not install storefront tracking scripts or cookies to monitor your customers' browsing for this reporting service.

Shopify may send customer identifiers, contact details, and order identifiers in mandatory privacy-request webhook payloads. We receive these to handle access or deletion requests, not to create buyer profiles. Limited request identifiers, including a customer ID, may appear in operational logs. Merchants should avoid including unnecessary customer personal information in support messages.

2. How we use your data

• To generate and send your daily WhatsApp report card.
• To send reports and account communications by email where you choose email delivery or provide an email address for your account.
• To upload your daily report card to the Slack channel you choose, if you opt in to Slack delivery.
• To upload your daily report card to the private Telegram chat you explicitly connect, if you opt in to Telegram delivery.
• To track your subscription status and trial period through Shopify Billing.
• To calculate progress toward your monthly revenue target.
• To authenticate support teammates and, only after your explicit consent and a valid support access code, provide temporary read-only diagnostics for your support request.
• To maintain security and support-access audit records, including support sign-ins and categories of diagnostics viewed.
• To respond to privacy requests, process Shopify compliance notifications, prevent abuse, and comply with applicable legal obligations.
• We do not sell your data to any third party.
• We do not use your connected-store or advertising-platform data to serve advertisements or build advertising profiles.

3. Google Ads data

Specifically, data accessed via the Google Ads API is used only to:

• Calculate and display your Google Ads spend, ROAS, and related metrics in your dashboard and reports delivered through the channels you choose.
• To operate reporting, delivery, support, and security functions described in this policy. We do not use Google Ads data to serve advertisements or build advertising profiles.

4. Amazon data

Specifically, data accessed via Amazon's APIs is used only to:

• Calculate and display your Amazon order, sales, and, where connected, advertising metrics in your dashboard and reports.
• To operate reporting, delivery, support, and security functions described in this policy. We do not use Amazon data to serve advertisements or build advertising profiles.

5. Data security

OAuth and bot access tokens are encrypted at rest before storage. The Telegram bot token is held only as a Cloudflare secret and is never stored in our database. Support access codes are never stored in plaintext. Your WhatsApp number and email address are stored as needed for service delivery. We use HTTPS for data in transit.

6. Third-party services

WhatRev integrates with the following third-party services to operate:

• Shopify: Store API access, app installation, billing, and privacy-request notifications.
• Meta, Google, TikTok, and Amazon: Data from the store and advertising accounts you connect.
• Slack and Telegram: Report images and destination identifiers for the workspace, channel, or private chat you connect.
• Authkey and, where configured, Twilio: WhatsApp message delivery, including the recipient number and report content or delivery link.
• Resend: Transactional and report emails, including the recipient email address and message content.
• Google Analytics and Meta Pixel: Website and web-app usage and marketing measurement when enabled. These services may receive browser, device, page-view, and cookie information.
• Cloudflare: Application hosting, database (D1), file storage (R2), and related infrastructure.

We share information with these providers as needed for the functions described above. A report sent to a destination you choose becomes available to people who can access that destination, including members of a Slack channel. Information already delivered is also subject to the recipient platform's retention and privacy settings.

Authorized personnel may access information for service operation and support. We may disclose information when required by law or reasonably necessary to protect users, investigate abuse, or defend legal claims. We do not sell connected-store data or provide it to advertising networks for targeting.

7. Data retention

We retain account, connection, report, and delivery data while your account is active and needed to provide the service. When you request deletion through WhatRev's account-deletion flow, access is suspended and a 30-day recovery period begins. Unless you restore the account during that period, the account and its connected tokens, report data, delivery history, stored report assets, support cases, access codes, and access grants are scheduled for permanent deletion after the recovery period.

Uninstalling the Shopify app follows a separate process. After we confirm the uninstall, we delete the WhatRev accounts and service data associated with that store. Shopify's subsequent shop-deletion webhook repeats this cleanup. This uninstall cleanup does not use the voluntary account-deletion recovery period.

Operational logs and limited security or compliance records may be retained separately where needed to investigate failures or abuse, demonstrate request handling, or meet legal obligations. Support and security audit records retained after account deletion are de-linked from the deleted account. Deleting data from WhatRev does not delete reports already received in WhatsApp, email, Slack, or Telegram; those copies are controlled by the recipient and the delivery platform.

For instructions, visit our Data Deletion page. You can also send a privacy deletion request to hello@whatrev.com.

8. Children's privacy

WhatRev's merchant accounts are intended for adults aged 18 or older. We do not knowingly offer merchant accounts to children. If you believe a child has provided account information, contact us so we can investigate and delete it where appropriate. Store customers may be of any age; our limited handling of Shopify privacy-request data is described above.

9. Your privacy choices and requests

Users in any country can contact us to request access to, correction of, or deletion of personal information held by WhatRev. Depending on the laws that apply to you, you may also have rights to receive a portable copy, restrict or object to processing, withdraw consent, nominate a representative, or complain to a data-protection authority. Statutory rights apply according to the relevant law and its effective date; this policy does not limit those rights.

• Account requests: Email hello@whatrev.com with the type of request and enough account or store information to identify the relevant records. Do not send passwords, access tokens, or payment-card information.
• Customer requests: If you are a customer of a Shopify store, contact that merchant first. The merchant can initiate Shopify's access or deletion process. You may also contact us directly about information you believe WhatRev holds.
• Verification: We may ask for information reasonably needed to verify your identity or authority to act for an account or customer. We respond within applicable legal deadlines and explain any lawful limits or retention requirements.
• Connected integrations: You can stop future access by disconnecting an integration or revoking WhatRev's authorization with that platform. Revoking access is different from deleting information already held by WhatRev.
• Report delivery: You can change connected destinations or contact support to stop optional deliveries. A report already sent cannot be recalled from a recipient's account.

Shopify sends mandatory customer-access, customer-deletion, and shop-deletion notifications to support this process. Our reporting database holds store-level metrics rather than buyer profiles; a request may therefore have no corresponding buyer records in that database. Operational logs and support information are considered separately when responding to a request.

10. International processing

WhatRev serves merchants internationally. Our infrastructure and the providers listed above may process information in countries other than where you or your store are located, including outside the European Economic Area or the United Kingdom. We do not promise that information stays in a single country. The laws and protections in another country may differ from those in your country.

You can contact us to ask about the processing locations and transfer arrangements relevant to your information. Where applicable law requires a particular transfer safeguard, that requirement applies independently of your use of the service; connecting an integration does not waive your statutory privacy rights.

11. Cookies and website measurement

Necessary cookies support sign-in and account security. Our website and web-app pages also use Google Analytics and Meta Pixel when enabled to measure visits and marketing effectiveness. These tools may collect device and browser information, IP information, page views, and cookie identifiers. This measurement is separate from our store-reporting queries and does not install tracking on a merchant's Shopify storefront.

Non-essential tracking requires consent where applicable law requires it. Browser settings and tracking-protection tools can limit cookies and requests to third-party services, but may also affect some website features. Contact us with questions or requests about website tracking. Withdrawing consent does not affect processing that was lawful before withdrawal.

12. Changes to this policy

We may update this policy when our services or data practices change. We publish the revised policy with a new update date and provide any additional notice or request for consent required by applicable law.

13. Contact us

For privacy questions, access or deletion requests, or complaints, contact the WhatRev privacy team at hello@whatrev.com. We aim to acknowledge requests within 2 business days; completing a request may take longer depending on identity verification, its scope, and applicable legal deadlines.

Privacy contact: Alex
Phone/WhatsApp: +91 92725 92069
Registered office: Survey No. 85, 1, Sus - Pashan Rd, above Domino's, Sus, Pune, Maharashtra 411021.