Skip to content

Privacy Notice — ConexiaChat

Last updated: 22 July 2026

This is a courtesy translation. If it differs from the Spanish text, the Spanish version of this document prevails. Aviso de Privacidad — ConexiaChat

1. Who we are

ConexiaChat is an omnichannel customer support platform that brings WhatsApp Business and Shopify into a single inbox. This notice explains what data we process, why, how we protect it and how you can exercise your rights.

ConexiaChat is the trade name of José Antonio Nápoles Peláez, based in Cancún, Quintana Roo, C.P. 77536, Mexico, owner and operator of the platform. Full details are in the Legal Notice.

ConexiaChat processes personal data in two distinct capacities, and the difference matters:

  • As controller, only for the merchant account data — name, email, organisation and billing details — and for people who browse this site or leave their details in the contact form.
  • As processor, for the merchant's end customers' data: WhatsApp messages and numbers, contact names and Shopify order data. For that data the merchant business is the controller: it keeps ownership of its WhatsApp Business account and decides what messages are sent and to whom. ConexiaChat processes it on the merchant's behalf and on their instructions, solely to deliver the contracted service.

Accordingly, an end customer's request to access, rectify, cancel or object goes to the merchant they have the relationship with. If one reaches us directly, we forward it to that merchant to handle.

2. Data we process

  • Merchant account: name, email and organisation details needed to run the account.
  • Messaging (WhatsApp): messages, phone numbers and contact names from the conversations the merchant handles.
  • Shopify: when the merchant connects their store, we access customer data (name, email, phone, address) and order history to show it next to the conversation.
  • AI automation: if the merchant turns on the artificial intelligence features, the content of the conversation's messages and the Shopify purchase data (webhooks included) are processed by AI to generate automated replies and flows, as described in section 6.

3. How we use the data

We use this data solely to deliver the service: showing the agent the customer profile and order history next to the chat, so support is informed by context. When the merchant enables AI automation, we also use the conversation content and purchase data to generate automated replies and flows, as described in section 6. We do not sell personal data and we do not use it for anything other than the service.

4. Storage and security

Data is hosted on Supabase with encryption in transit (TLS) and at rest. Shopify and WhatsApp access tokens are stored encrypted in a secrets vault and are never exposed to the browser. Access is restricted by organisation and by role.

5. Third parties (processors and sub-processors)

We share data only with the providers we need to operate: Vercel Inc. (application runtime and hosting), Supabase (infrastructure and database), Meta/WhatsApp Business API (messaging), Shopify (customer and order data, and subscription billing via Shopify App Pricing) and OpenAI, L.L.C. (artificial intelligence automation, when the merchant enables it; see section 6). Each processes data under its own privacy policy.

ConexiaChat does not process or store card details or any other payment data: the subscription is billed entirely through Shopify (Shopify App Pricing), and that payment information never reaches our systems.

6. Artificial intelligence and sub-processing (OpenAI)

ConexiaChat offers optional conversational and marketing automation features powered by artificial intelligence. When the merchant enables them, certain data — the content of the conversation's messages and the purchase data received from Shopify, webhooks included — is transmitted to OpenAI, L.L.C. (“OpenAI”) through its API, acting as a sub-processor of confidential data.

  • Single purpose: this data is processed for the sole purpose of generating and automating replies and marketing flows within the service. It is not used for anything else.
  • No training of public models: under OpenAI's commercial policies for developers (API), data sent through the API is not used to train or improve their publicly available models.
  • Retention: OpenAI retains this data under its standard compliance policies — generally up to 30 days for abuse detection and auditing — after which it is deleted, unless a different period applies under the relevant Data Processing Addendum (DPA).

OpenAI processes the data as a processor/sub-processor under its own privacy policy and DPA. The merchant is responsible for obtaining their end buyers' consent to the automated processing of their data by AI, as set out in the Terms of Service.

7. Retention and deletion

We keep data only while the integration is active. We honour Shopify's mandatory privacy requests: on a customer redaction request we delete that customer's cached data, and when a merchant uninstalls the app we purge their tokens and associated data. To request access to or deletion of your data, see our data deletion instructions or write to our contact address.

8. Contact

For any privacy enquiry, or to exercise your rights, contact us at contact@conexiachat.com.