Privacy Policy

Creovine LTD operates Buddy and is responsible for the personal data described in this policy. Buddy is a global product and is available to customers and their audiences worldwide. You can reach us about privacy at [email protected].

This policy applies to the Buddy website, application, APIs, and related services (together, the "Services").

Our responsibilities depend on the data in question:

• We are the controller for data about our own account holders and website visitors, such as account, profile, billing, and usage data. We decide how and why that data is processed.
• We are a processor for the contact and messaging data that a customer uploads or generates while using Buddy to engage their own audience. The customer is the controller of that data and decides how it is used; we process it on the customer's documented instructions to provide the Services. If you are an end recipient contacted through Buddy, please direct rights requests to the business that messaged you, and we will support that business in responding.

Data you provide

• Account and profile data: name, email address, password credentials, phone number, profile details, and workspace information.
• Billing data: plan, billing contact, and transaction records. Card details are handled by our payment processors and are not stored by us.
• Contact and subscriber data uploaded by customers: names, phone numbers, email addresses, consent and opt-in records, source, tags, audiences, and engagement history of the people a customer chooses to engage.
• Content you create: campaigns, message templates, automations, flows, replies, notes, and support or feedback messages.

Data created through use of the Services

• Messaging data: the content and metadata of messages sent and received through connected channels, including delivery, read, and response events, and timestamps.
• WhatsApp and Meta connection data: your WhatsApp Business Account identifier, phone number identifier, business profile details, and access tokens. Access tokens are encrypted at rest and are never exposed to the browser.
• Analytics and product data: conversions, revenue attribution, and aggregate performance metrics you configure.

Data collected automatically

• Device and technical data: IP address, browser and device type, operating system, and similar identifiers.
• Usage data: pages viewed, features used, actions taken, and diagnostic and error logs used to operate, secure, and improve the Services.
• Cookies and similar technologies, as described in our Cookie Policy.

Data from third parties

• From Meta and the WhatsApp Business Platform when you connect a WhatsApp Business Account, including account and phone number details and message delivery events.
• From connected services and integrations you choose to enable, such as ecommerce platforms, CRMs, and developer tools.
• When you connect Shopify, we import products and prices to show your store catalog; customer names, email addresses, phone numbers, and email and WhatsApp marketing consent states to show synced contact and consent details; and recent orders, payment status, and refunds to show purchases and report campaign related sales. We may match a buyer's phone number with a message recipient after a send to measure associated purchases. We also process this data to handle required privacy and security requests. We do not import customer addresses from Shopify. Connecting a store does not add its customers to a WhatsApp sending audience, and a phone number or customer record alone does not authorize a WhatsApp message.

• Provide, operate, secure, maintain, and improve the Services.
• Create and manage accounts, workspaces, subscribers, campaigns, automations, analytics, and integrations.
• Send and receive messages on connected channels at your direction, and deliver the campaigns and automations you configure.
• Process payments and manage subscriptions and billing.
• Provide customer support and respond to your requests, questions, and feedback.
• Send account, product, security, and service communications.
• Monitor, prevent, detect, and address fraud, abuse, security incidents, and violations of our terms or applicable policies.
• Understand usage and product performance, and develop new features.
• Comply with legal obligations and enforce our agreements.

Where data protection law such as the EU or UK GDPR applies, we rely on the following legal bases when we act as a controller:

• Performance of a contract, to provide the Services you request and administer your account.
• Legitimate interests, to secure, operate, and improve the Services, prevent abuse, and communicate with you, balanced against your rights.
• Consent, where required, for example certain cookies and optional communications. You may withdraw consent at any time.
• Compliance with a legal obligation.

When we act as a processor for customer data, the customer is responsible for establishing a legal basis for their processing, including obtaining the opt-in and consent required to message their audience.

Buddy integrates with the WhatsApp Business Platform provided by Meta. When you connect a WhatsApp Business Account and send or receive messages, data is processed by Meta as an independent controller under its own terms. Your use of WhatsApp through Buddy is also subject to Meta and WhatsApp policies, including the WhatsApp Business Messaging Policy and Meta's Platform Terms.

• See the WhatsApp Business Messaging Policy.
• See the WhatsApp Business Data Processing Terms and Meta's privacy resources for how Meta processes data.
• You are responsible for obtaining valid opt-in from the people you message and for complying with applicable messaging rules.

We do not sell personal data. We share data only as described here:

We do not use Shopify customer data for cross-context behavioral advertising. Optional website analytics runs only after an affirmative cookie choice and is disabled by a Global Privacy Control signal. If you ask us not to sell or share your personal data for advertising, we will honor that request; you can also reject analytics on our cookie preferences page.

• Service providers and subprocessors that host, store, secure, and support the Services, under contracts that require appropriate protection.
• Messaging and platform providers such as Meta and the WhatsApp Business Platform, to deliver the messages you send.
• Payment processors, to process transactions.
• Professional advisers, auditors, and authorities where required by law, legal process, or to protect rights, safety, and the integrity of the Services.
• In connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your direction or consent, including integrations you enable.

See the Subprocessor List for the categories of providers we use.

Buddy operates globally, and personal data may be processed in countries other than your own, including countries that may not provide the same level of protection as your home country. Where we transfer personal data internationally, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms where required.

We retain personal data for as long as needed to provide the Services, and afterwards as required to meet legal, accounting, dispute resolution, security, and enforcement obligations. Retention periods depend on the type of data and the purpose for which it is held. When data is no longer required, we delete or anonymize it. Customer data processed on a customer's behalf is retained according to that customer's configuration and instructions.

For connected Shopify stores, Buddy keeps a local copy of customer records last updated within the past 400 days and orders placed within the past 400 days. Older copies are removed by daily maintenance. Fulfilled Shopify privacy-request records are removed after 90 days. Disconnecting a store removes its imported customer records; Shopify redaction requests are handled separately.

Message and event content and in-app notifications are removed after 400 days. Application access records are removed after two years. Consent and opt-out records are retained while needed to honor your choices and prevent unwanted messages.

Buddy supports merchant-defined audience rules, message workflows, and purchase reporting. Buddy does not use customer personal data to make solely automated decisions with legal or similarly significant effects. We will not introduce such a use without a separate assessment, customer notice, a way to request human review, and a way to opt out where required. Contact[email protected] to object to profiling or ask about a decision.

We use technical and organizational measures designed to protect personal data, including encryption in transit, encryption of sensitive secrets such as access tokens at rest, row level access controls that isolate each workspace, role based permissions, audit logging, and least privilege access for our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have some or all of the following rights regarding your personal data:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data, subject to legal exceptions.
• Restrict or object to certain processing.
• Data portability, to receive your data in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

If you are in California, you may have the right to know, delete, and correct personal information, and to opt out of the sale or sharing of personal information. We do not sell personal information, and we will not discriminate against you for exercising your rights.

To exercise your rights, contact [email protected] or use the Data Deletion page. If you were messaged by a business through Buddy, contact that business, and we will assist them as their processor.

You can ask us to delete the personal data we hold about you at any time. If you connected through Facebook, removing Buddy from your Facebook settings sends us a deletion request automatically and returns a confirmation code you can track.

See the Data Deletion page for the ways to request deletion, what is deleted, expected timelines, and how to check the status of a request.

We use essential cookies for the Services to function, and may use analytics or preference cookies where permitted. Learn more in the Cookie Policy.

The Services are not directed to children, and we do not knowingly collect personal data from children under the age required by applicable law in their jurisdiction. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

Buddy may offer features that use automation or artificial intelligence to assist you, for example to suggest message content or audiences. These features support your decisions and do not make decisions that produce legal or similarly significant effects about individuals without human involvement.

The Services may link to or integrate with third-party websites and services that we do not control. Their privacy practices are governed by their own policies, and we encourage you to review them.

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised policy.

Buddy is operated by Creovine LTD. For privacy questions, requests, or to reach our data protection contact, email [email protected] or use the contact page.