Privacy Policy

Last updated: July 11, 2026

WhatRev is a product owned and operated by High Propel Technologies (OPC) Pvt. Ltd. ("we", "our", or "us"), which sends daily Shopify store performance reports to Indian D2C founders via WhatsApp. This policy explains what data we collect, how we use it, and your rights under applicable Indian law including the Digital Personal Data Protection Act, 2023 ("DPDPA").

1. What we collect

WhatsApp number: Your Indian mobile number (+91) to deliver reports.
Monthly revenue target: The target you set during onboarding to calculate progress.
Shopify OAuth token: An access token that lets us read your store's orders and returns. We never store your Shopify password.
Meta Ads token (optional): An access token to read your ad spend and ROAS from Facebook/Instagram campaigns via the Meta Marketing API.
Google Ads token (optional): An OAuth 2.0 access token authorising the scope https://www.googleapis.com/auth/adwords to read your Google Ads spend, impressions, clicks, and ROAS data.
Amazon Selling Partner token (optional): An OAuth token issued through Amazon's Login with Amazon (LWA) flow that lets us read your Amazon seller order and sales data via the Selling Partner API. We never store your Amazon password.
Amazon Ads token (optional): An OAuth token that lets us read your Amazon Advertising spend, ACOS, and campaign performance data via the Amazon Ads API.
Order and revenue data: We fetch yesterday's and month-to-date order data to generate your report. This data is not stored permanently — it is fetched fresh each day and used only to generate the report card sent to your WhatsApp.
Usage and log data: When you use WhatRev, our servers may automatically collect your IP address, browser type, device type, and pages visited. This data is used solely for security monitoring and is not linked to your identity.
Cookies: We use strictly necessary session cookies to keep you logged in. We do not use advertising or tracking cookies.

2. How we use your data

To generate and send your daily WhatsApp report card.
To track your subscription status and trial period via Razorpay.
To calculate progress toward your monthly revenue target.
We do not sell your data to any third party.
We do not use your data for advertising or marketing profiling.

3. Google Ads API — limited use disclosure

WhatRev's use of data obtained from the Google Ads API is strictly limited to providing and improving the WhatRev service as described in this policy. We do not use Google Ads data to serve advertisements, build user profiles, or share with any third party other than as required to operate the service. Our use of Google Ads API data complies with the Google Ads API Terms of Serviceand Google's Limited Use Policy.

Specifically, data accessed via the Google Ads API is used only to:

Calculate and display your Google Ads spend, ROAS, and related metrics in your daily WhatsApp report.
Nothing else. The data is not stored beyond the generation of that day's report.

4. Amazon Selling Partner API & Amazon Ads API — data use disclosure

WhatRev's use of data obtained from the Amazon Selling Partner API and the Amazon Ads API is strictly limited to providing and improving the WhatRev service as described in this policy. We do not use Amazon data to serve advertisements, build user profiles, or share it with any third party other than as required to operate the service. Our use of this data complies with Amazon's Data Protection Policy and Acceptable Use Policy.

Specifically, data accessed via Amazon's APIs is used only to:

Calculate and display your Amazon order, sales, and (where connected) advertising metrics in your daily WhatsApp report.
Nothing else. The data is not stored beyond the generation of that day's report.

5. Data security

All OAuth access tokens (Shopify, Meta, Google, Amazon) are encrypted at rest using AES-256 encryption before being stored in our database. Your WhatsApp number is stored in plaintext as it is required for message delivery. We use HTTPS for all data in transit.

6. Third-party services

WhatRev integrates with the following third-party services to operate:

Shopify — to read store order data via their official OAuth API.
Meta (Facebook) — to read ad spend data via the Meta Marketing API.
Google — to read Google Ads data via the Google Ads API. Use of this integration is also subject to the Google Ads API Terms of Service.
Amazon — to read seller order/sales data via the Selling Partner API and, where connected, advertising data via the Amazon Ads API.
Authkey — our WhatsApp Business Solution Provider for message delivery.
Razorpay — for subscription billing.
Supabase — our database and file storage provider, hosted in India.

7. Data retention

We retain your account data for as long as your subscription is active. If you cancel your subscription or request deletion, we delete your OAuth tokens immediately and your account data within 30 days. Daily report data (order figures, ad spend) is not retained after the report is delivered.

8. Children's privacy

WhatRev is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that a user is under 18, we will promptly delete their account and associated data.

9. Your rights under DPDPA

Under India's Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

Access: You can request a summary of all personal data we hold about you and the purposes for which it is processed.
Correction: You can request correction of inaccurate or incomplete personal data, including your WhatsApp number or monthly target.
Erasure: You can request deletion of your account and all associated personal data at any time. See our Data Deletion page.
Grievance redressal: You may contact our Grievance Officer (details below) if you have a complaint about how your data is handled.
Nomination: You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.

10. Contact & Grievance Officer

For any privacy-related questions, requests, or grievances under DPDPA, email us at hello@whatrev.com. We respond within 2 business days. As required under DPDPA, our Grievance Officer can be reached at the same address.