What we collect
To run the platform, we collect account and connection details for the channels and stores you connect (WhatsApp, Instagram, Messenger, Facebook comments, and your Shopify, WooCommerce, or other connected store), the conversations and orders that flow through those connections, the guardrail limits you configure, and basic account/billing information for your workspace.
- Connection data: OAuth tokens and channel identifiers, stored as secret references, never as raw credentials in the database.
- Conversation data: messages, comments, and attachments your customers send through connected channels.
- Commerce data: order status and inventory data read from your connected store to answer customer questions.
- Configuration data: the discount caps, refund limits, and escalation rules you set.
- Account data: workspace owner and staff details, billing contact, and usage metering.
How we use it
We use this data only to operate the platform for your workspace: routing conversations, looking up orders, checking your guardrail limits before any action, handing off to your staff with context, and metering your usage against your plan. We do not sell customer data, and we do not share it across workspaces.
AI & model use
Shopy-Link is designed to work across leading AI model providers rather than lock you into a single one. No workspace's conversation or order data is used to train any AI model, and no separate model is built per workspace — every workspace uses the same underlying reasoning models, differentiated only by your own configuration: your guardrails, your connected accounts, and any knowledge base documents you add. Provider-specific data-processing terms are published alongside each model.
Where data lives
We use a small number of specialist providers (subprocessors) to run the platform. Each is listed below with what it's used for. We do not add a new subprocessor without updating this list.
How we protect it
Security is built into the platform's architecture, not added after the fact:
- No raw secrets: credentials are stored as secret references only, enforced at the database level.
- Append-only audit logs: every governed action is logged and cannot be altered or deleted.
- Fail-closed by default: if a guardrail check cannot run, the action does not happen. There is no "allow by default" fallback.
- Encryption: data is encrypted in transit and at rest using our cloud provider's standard encryption.
- Single system of record: no independently-writable copies of your data; one database is the source of truth.
Retention & deletion
We keep your workspace data for as long as your account is active, plus a limited window afterward so you can export it or pick up where you left off if you come back. You can request deletion or a full export of your data at any time by contacting us, and we act on verified requests promptly.
Your rights
You can request access to, correction of, or deletion of your data, and the same rights extend to your customers' data collected through the platform. To exercise any of these, contact us below — we verify the request and act on it directly.
Breach notification
If we become aware of a security incident affecting your data, we notify you without undue delay, explain what happened, and take immediate steps to contain and remediate it.
Messaging & consent
Messages sent through WhatsApp and other connected channels follow the applicable platform rules for commercial messaging, including honoring opt-in consent and any opt-out request immediately.
Children's data
Shopy-Link is a business tool for sellers and is not directed at, or knowingly used to collect data from, anyone under 18. If you believe a minor has provided us data through the platform, contact us and we will remove it.
Who we are
Shopy-Link is built and operated by Investa AI Solution LLC. For registered entity details or anything else about who's behind the platform, contact us — we're happy to share.
Contact
Questions about this page or a data request: privacy@investasolution.com