Privacy Policy

1 Introduction

Welcome to Shlhaa (“we”, “us”, “the Service”). We are committed to protecting your privacy and the security of your data. This Privacy Policy explains how we collect, use, and protect information when you use our services across connected platforms including Shopify, Instagram, Facebook Messenger, and WhatsApp.

By using Shlhaa, you agree to the practices described in this policy.

2 Data We Collect

We collect only the data necessary to process orders and provide delivery services:

• Order Data: Recipient name, phone number, email, address (province, district, area, postal code), product ordered, quantity, price, and payment status. For Shopify stores, this order data is imported automatically from your Shopify orders.
• Conversation Data: Message content related to order confirmation or cancellation only.
• Account Data: Facebook Page ID, Instagram Business Account ID, Shopify store domain, and connected account profile information (name, username, profile picture).
• Ad Performance Data: Advertising metrics (impressions, clicks, reach, spend) from connected ad accounts, used solely for merchant analytics.

We do not collect any additional personal data such as passwords, banking information, or precise geolocation data.

3 How We Use Data

We use collected data exclusively for:

• Processing and recording orders in our order management system.
• Sending orders to approved delivery companies for fulfillment.
• Sending order confirmation or cancellation notifications to merchants.
• Displaying customer names and profile information to help merchants identify customers.
• Providing advertising performance analytics to merchants.
• Preparing daily performance summaries for merchants.

4 Data Sharing

We do not sell or share your data with third parties for marketing or advertising purposes. Order data is shared only with:

• Approved delivery companies: For the sole purpose of delivering orders.
• The merchant (store owner): To manage and track their orders.

5 Data Storage and Security

Order data is stored in secure cloud databases (Supabase) with restricted access permissions. We use encrypted connections (HTTPS) for all data transfers. All API tokens and credentials are stored server-side and never exposed to the client. We retain order data for a maximum of 12 months, after which it is automatically deleted.

6 Your Rights

You have the right to:

• Request access to your stored data.
• Request correction of any inaccurate information.
• Request complete deletion of your data from our systems.
• Withdraw from the service at any time.

To exercise any of these rights, contact us via the email below or visit our Data Deletion page.

7 Use of Meta Platforms

Shlhaa operates through Meta’s APIs, including Instagram Graph API, Instagram Messaging API, and Messenger Platform. We comply with all Meta policies regarding data use and user privacy. We use conversation data exclusively for processing specific orders. We use the Human Agent message tag only for legitimate customer service follow-ups beyond the standard 24-hour messaging window.

8 Use of Shopify Platform

Shlhaa connects to Shopify through the Shopify Admin API to import new orders, update order status, and write back delivery tracking information. We comply with Shopify’s data protection requirements, including its mandatory compliance webhooks. When a store uninstalls the app and a shop data erasure is requested, we delete that store’s data and access tokens. When a customer data erasure is requested, we remove that customer’s personal information from the related orders. When a customer data request is received, we make the stored data available to the store owner.

9 Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this page periodically.

10 Contact Us

If you have any questions about this Privacy Policy or our data practices:

Email: main@shlhaa.com
Website: shlhaa.com