Data Protection

Who this page is for

This page explains how LoopChat handles personal data about your customers when you connect your store (including Shopify) and your messaging channels. It forms part of the data processing terms in our Terms and Conditions.

What we process

When a store connects LoopChat, we copy the customer data the features you use need: the customer's name, email address, phone number and addresses, their orders and abandoned checkouts, your products and collections, and whether the customer agreed to email or SMS marketing in Shopify.

If you turn on storefront tracking, we also record product views and add-to-cart events from your store, so that browse and cart reminders work.

We also keep the WhatsApp, Instagram and Facebook messages between you and your customers, so they show in your LoopChat inbox.

Why we process it

Only to run the features you set up for your store: order and delivery updates, cart and browse reminders, campaigns, journeys, the shared inbox, segments and sales reports.

We do not sell personal data, and we never use one store's customers for another store. LoopChat makes no automated decisions about a person that have legal or similarly significant effects.

Where it is stored

LoopChat runs on Amazon Web Services in the Sydney region (ap-southeast-2, Australia). The application server, its databases, file storage and backups are all kept there.

How long we keep it

While the app is installed, store data is kept so that journeys, segments and the inbox keep working. When a store uninstalls LoopChat, syncing and the store's scheduled journeys stop straight away.

A deletion can be requested by Shopify (for a store about 48 hours after it uninstalls LoopChat, or for a customer who asked the store to erase their data), by the store owner, or by the customer. Every request is recorded and shown to the store owner in LoopChat, and our team deletes the data within 30 days of the request.

Today our team carries out each deletion by hand. Automatic deletion is built into LoopChat, but it stays switched off until we finish reviewing it.

Deleted data can stay in our encrypted backups until they are removed. Today a database backup is removed automatically after 37 days (121 days once our backup update is live), and recovery points for the message database are kept for 35 days.

Sub-processors

Amazon Web Services (Australia, Sydney region): hosting, databases, file storage and backups for all LoopChat data.

Meta Platforms (WhatsApp Business Platform, Instagram and Messenger): delivers the messages you send and receive. Meta receives the customer's phone number or account ID and the message content.

AI model providers: Groq, OpenAI, Google (Gemini), Anthropic, DeepSeek and xAI (Grok). LoopChat's AI features (AI replies, AI agents, AI writing tools and AI search over your content) send the relevant conversation text, including any customer details in it, to one of these providers to produce the answer.

Which of them handle your data depends on our platform AI settings, which our admin chooses (the default AI provider and the provider used to index content for AI search), and on the model each AI agent in your workspace is set to. Google (Gemini) is our default today. If we add a provider, we update this list first. With the own-key add-on, content goes to the provider you connect, under your own account with them.

Shopify: the source of your store data. We read from your store and write to it only through Shopify's API, with the permissions you approve.

Google (Gmail): sends LoopChat emails to you and your team members, such as account, team and billing emails and, if you turn it on, a daily summary of new leads that lists their names and contact details.

If you connect your own payment gateway (for example Razorpay) or SMS provider for payment links or text messages, the details needed for each payment or message go to that provider, under your account with them.

Security measures in place today

All traffic to LoopChat uses HTTPS (TLS), and browsers are told to use HTTPS only.

AWS encrypts our database tables and file storage at rest. Our server's disk is being moved to encrypted storage.

Database backups are encrypted (AES-256) before they leave the server and are copied every night to private, versioned storage in the same AWS region. Our message database can be recovered to any point in the last 35 days.

Shopify access tokens are stored encrypted with AES-256-GCM. Account passwords are stored only as bcrypt hashes.

Each workspace can read only its own data. Every team member has a role (Admin, User or Agent), and only Admins can download a customer's data export. Two-step sign-in is available for every account.

Whenever a team member views or exports customer details, orders, WhatsApp conversations or segment members, the workspace audit log records who did it and when.

Inside Shopify admin, LoopChat checks Shopify's signed session on every request.

Security measures we are putting in place

A second nightly copy of the message database in encrypted storage. Backups older than 30 days move to archive storage, and every backup is removed automatically after 121 days.

A weekly test that restores our backups to prove they can be read back.

Encryption switched on by default for every new disk in our AWS account.

A test environment that holds only anonymised data, so real customer details exist only in production.

A second, secure copy of the backup encryption key, kept away from the server.

If something goes wrong

Contain: we revoke the affected keys and sessions and stop the affected service.

Assess: we work out which data, stores and customers are affected, using our server and audit logs.

Notify: we tell affected merchants, and Shopify when store data is involved, without undue delay and within 72 hours of confirming an incident, with what happened and what to do.

Fix and review: we remove the cause, restore the service, check nothing else was affected, write down what happened and change our process so it does not happen again.

Our incident owner is Sujan. Emergency contact: +91 9620509390. Email: loopchat604@gmail.com.

Who we are

LoopChat is a product of QUANTELLOVENTURES PRIVATE LIMITED, No 67b, 2nd Floor, Jyoti Nivas College Road, Koramangala, Bengaluru, Karnataka 560095, India. GSTIN: 29AAACQ8789R1Z3.

Questions

If anything here is unclear, ask us and we will explain it in plain terms.