Data Processing Agreement

About this agreement

This Data Processing Agreement is between QUANTELLOVENTURES PRIVATE LIMITED, trading as LoopChat ("LoopChat", "we"), and the business that uses LoopChat ("you"). It forms part of our Terms and Conditions (loopchat.in/terms-conditions).

It applies automatically to every merchant using LoopChat, including merchants who install the LoopChat app from the Shopify App Store. You accept it by creating an account, installing the app or using the service. It is an electronic record under the Information Technology Act, 2000 and does not need a signature.

If you would like a copy signed by both of us, write to loopchat604@gmail.com.

Who does what

This agreement covers personal data about your customers and other people you deal with that LoopChat handles for you ("customer data"). You decide why and how that data is used, so you are the controller. We handle it on your behalf, so we are your processor. Under India's Digital Personal Data Protection Act, 2023, these roles are called Data Fiduciary and Data Processor.

Details about you and your team, such as your login and billing details, are not customer data. Our Privacy Policy (loopchat.in/privacy-policy) covers those.

Each of us follows the data protection laws that apply to us.

Your responsibilities

You are responsible for having a lawful basis for the customer data you bring into LoopChat, including valid opt-in for the people you message, and for telling your customers how you use their data.

You are also responsible for the settings you choose, for who you add to your workspace, and for making sure the instructions you give us are lawful.

What we process and why

Whose data: your customers, the shoppers on your store and the people who message you.

What data: names, email addresses, phone numbers and addresses; orders, checkouts, fulfillments, refunds and returns; email and SMS marketing consent as set in Shopify; and the WhatsApp, Instagram and Facebook messages between you and your customers.

If you turn these features on, we also process the storefront events from Shopify web pixel tracking, the chat messages and form details from the chat button on your store, and the cart events from the cart drawer.

Why: only to run the features you set up, such as order updates, cart and browse reminders, campaigns, journeys, the shared inbox, segments, reports and the AI features you turn on.

How long: while you use LoopChat and until the data is erased as described under Deletion below.

What we promise

We process customer data only on your instructions. Your instructions are your use of the service, the settings you choose in LoopChat and this agreement. If the law requires us to do something else, we tell you first unless the law stops us. If we believe an instruction breaks the law, we tell you.

We do not sell customer data, and we never use one merchant's customers for another merchant. LoopChat makes no automated decisions about a person that have legal or similarly significant effects.

Everyone at LoopChat who can reach customer data must keep it confidential, and we limit that access to the people who need it to run or support the service.

Sub-processors

You allow us to use the sub-processors below. We update this list before we add a new one. If you object to a new sub-processor, you can cancel your account. We remain responsible to you for how our sub-processors handle customer data, within the liability limit in our Terms and Conditions.

Amazon Web Services (Australia, Sydney region): hosting, databases, file storage and backups.

Hostinger International Limited (Malaysia, Kuala Lumpur): holds a separate off-site copy of our backups.

Meta Platforms (WhatsApp Business Platform, Instagram and Messenger): delivers the messages you send and receive. Meta receives the customer's phone number or account ID and the message content.

Our WhatsApp Business Solution Provider (India): for WhatsApp numbers connected through it, forwards the messages you send to Meta and handles WhatsApp message billing. It receives the customer's phone number and the message content.

AI model providers: Groq, OpenAI, Google (Gemini), Anthropic, DeepSeek and xAI (Grok). LoopChat's AI features send the relevant conversation text, including any customer details in it, to one of these providers to produce the answer. Groq is our default today, with Google (Gemini) as the backup. An AI agent in your workspace uses the model it is set to.

Shopify: the source of your store data. We read from your store and write to it only through Shopify's API, with the permissions you approve.

Google (Gmail): sends LoopChat emails to you and your team, which can include customer details, such as the daily summary of new leads if you turn it on.

Google (Firebase Cloud Messaging): delivers push notifications to the LoopChat mobile app used by you and your team. A notification can include the customer's name and a short preview of their message.

Payments: if you pay us directly, Razorpay handles the payment. If your plan is billed through Shopify, Shopify does. They receive your billing details, not customer data.

Services you connect yourself, such as your own payment gateway, SMS provider or AI key, work under your own account with that company. They are your providers, not our sub-processors.

Where data is stored and sent

LoopChat runs on Amazon Web Services in Sydney, Australia. A separate off-site copy of our backups is kept in Kuala Lumpur, Malaysia. Our team works from India. Sub-processors can process data in other countries, including the United States.

By using LoopChat you instruct us to transfer customer data in these ways. If the law that applies to you, such as the GDPR or UK GDPR, requires a specific safeguard for these transfers, such as standard contractual clauses, write to us before you connect that data and we will work with you to put it in place.

Security

These are the measures in place today. We can change them as long as the overall protection does not get weaker. Our Data Protection page (loopchat.in/data-protection) has more detail.

All traffic to the LoopChat app uses HTTPS (TLS), and browsers are told to use HTTPS only.

AWS encrypts our message database and file storage at rest.

Database dumps are encrypted with AES-256 before they leave the server, and the backups stored in AWS are also encrypted at rest. We test restoring the database backup every week, and our message database can be recovered to any point in the last 35 days.

Shopify access tokens are stored encrypted with AES-256-GCM. Account passwords are stored only as bcrypt hashes.

Each workspace can read only its own data. Every team member has a role (Admin, User or Agent), and only Admins can download a customer's data export. Two-step sign-in is available for every account.

When a team member views or exports customer details, orders, WhatsApp conversations or segment members, the workspace audit log records who did it and when.

Security incidents

If we confirm a security incident that affects your customer data, we tell you without undue delay and within 72 hours of confirming it, at the email on your account, with what happened and what you should do. We also tell Shopify when store data is involved.

We then remove the cause, check nothing else was affected and change our process so it does not happen again. Emergency contact: +91 89510 49416.

Helping you with requests

We help you answer your customers' requests to see, correct or delete their data, including the requests Shopify sends us on your behalf. Requests from Shopify are recorded and shown to you in LoopChat.

If a regulator asks you about how we handle customer data, or you need information from us for a data protection assessment, we give you the information we reasonably can.

Deletion

When you uninstall the LoopChat app or close your account, syncing stops straight away. Shopify sends us a deletion request for your store about 48 hours after you uninstall.

When Shopify sends us a request to delete a customer's data or your store's data, that data is erased within 30 days of the request.

When you ask us to delete customer data, it is erased within 30 days of the request. Closing an account does not erase data by itself, so write to loopchat604@gmail.com, and export anything you want to keep first.

Erased data can stay in our backups until they expire: nightly copies in AWS are kept for 121 days, the off-site copy for 30 days, and recovery points for the message database for 35 days. Records the law requires us to keep, such as invoices, are kept for as long as the law requires.

Information and audits

If you need to check that we meet this agreement, write to us and we will answer in writing with the information you reasonably need. You can ask once a year, and again after a security incident or if a regulator requires it. We do not offer on-site audits unless the law requires them.

General

This agreement lasts for as long as we process customer data for you.

If this agreement differs from our Terms and Conditions or our Data Protection page on customer data, this agreement applies.

The liability limit in our Terms and Conditions covers this agreement. Changes to this agreement, the governing law and the courts are as set out in our Terms and Conditions.

Who we are

LoopChat is a product of QUANTELLOVENTURES PRIVATE LIMITED, a private limited company incorporated in India. Principal place of business: No 67b, 2nd Floor, Jyoti Nivas College Road, 5th Block Industrial Area, Koramangala, Bengaluru, Karnataka 560095, India. GSTIN: 29AAACQ8789R1Z3.

Contact for this agreement: loopchat604@gmail.com.

Questions

If anything here is unclear, ask us and we will explain it in plain terms.