WhatsApp Marketing Hub Privacy Policy
Last updated: 26 October 2026
WhatsApp Marketing Hub by Obsedia helps Shopify merchants send WhatsApp campaigns, cart reminders, order updates and other messages from their own WhatsApp Business account. This policy explains how personal data is used when a merchant installs or uses the app, contacts us, or sends messages to its customers.
1. Who we are
The service is operated by Genius Nutrition S.R.L., trading as Obsedia, Romania. Company registration: J23/4568/2015. VAT number: RO35355847.
Our business address is Business Logistic Center, Tamasi Street No. 20, Hall 6A, Buftea, Ilfov, 070000, Romania, European Union.
Privacy requests: privacy@obsedia.ai. Service and support: agents@obsedia.ai.
Merchants decide why their customer data is used, which customers receive messages, and what those messages contain. We process that customer data on their behalf to provide the app. We are separately responsible for our own merchant-account, support, security and business records.
If you received a message from a store, that store is normally your first contact for questions about its marketing or customer records. We help the store respond to requests concerning data handled by this app.
2. Information we process
Depending on the features a merchant uses, we process:
- Store and account information: Shopify store and installation identifiers, authorised-user information, permissions, app settings, subscription and support details.
- WhatsApp connection information: business-account and phone-number identifiers, connection status, access credentials and relevant template-approval information.
- Messages and campaigns: templates, example values, text, images, links, buttons, selected products, audiences, schedules and automation settings.
- Customer and shopping information: customer identifiers, phone numbers, WhatsApp marketing-consent records and relevant product, order, checkout, payment-status, fulfilment and delivery information. Names and customer-specific links are used when the selected message needs them.
- Message and reporting records: recipient eligibility, opt-outs, sending restrictions, submission and delivery status, errors, message-link references and orders attributed to messages.
- Billing and service records: delivered-message usage, subscription information, Shopify billing references, security events and information needed to investigate a support request.
- AI Agent requests: instructions typed by authorised store users, the conversation context needed to answer, relevant app configuration and aggregate results, and references to requested actions. The model's app tools do not provide customer contact lists or access credentials.
We obtain information from the merchant, its Shopify store, Meta/WhatsApp and the operation of the app. The merchant may also place personal information in its own message content or uploaded media.
We do not receive a merchant's payment-card details through the app. Shopify processes Obsedia subscription and usage charges, and Meta separately processes its WhatsApp charges.
3. Why we use information
We use information to connect accounts, help merchants create and approve messages, prepare audiences, send authorised messages, run automations, show delivery and attributed-order results, provide support, protect the service and record usage accurately.
When a merchant uses AI Agent, the request and necessary app context are processed to explain the app and prepare supported actions. Campaign scheduling and automation activation retain merchant review and the app's current sending checks.
The app checks WhatsApp marketing consent recorded in Shopify and applies relevant opt-outs, contact restrictions, quiet hours and sending-frequency settings. An email or SMS subscription does not, by itself, provide WhatsApp marketing consent. Template approval by Meta is separate from permission to contact a customer.
For customer information processed on a merchant's behalf, the merchant is responsible for its lawful instructions and the legal basis described in its privacy notice. For our own records, we use the legal bases applicable to the purpose, including performing our agreement with the merchant, complying with legal obligations, protecting our legitimate business and security interests, or consent where required.
4. Message links, attribution and cookies
The app can associate a message link with a Shopify cart and a later order to help the merchant understand which messages bring customers back. The storefront tracking component records the message reference in the Shopify cart only when Shopify reports that marketing permission is allowed. Revoking permission stops new capture; the component also attempts to remove an existing cart reference.
Attribution depends on the available link, cart and order information. It is not a guarantee that a message caused a purchase.
The app also uses short-lived security cookies during WhatsApp account setup. Shopify and Meta may use their own cookies and similar technologies under their policies. A merchant's storefront may use other tracking tools that are outside this app.
5. Who receives information
We share information when needed to provide the service:
- Shopify provides the store platform, relevant store information, app installation and Obsedia billing.
- Meta/WhatsApp provides WhatsApp account connection, template review, message delivery and message-status services. Requested template reviews can include content, examples and media. Sending a message involves providing its recipient number and content to WhatsApp.
- OpenAI processes AI Agent requests and the minimum context needed to generate replies and supported tool requests. Its applicable service terms and data controls govern that processing.
- Railway and infrastructure providers used for the service support hosting, databases, media storage and operational backups.
- Authorised support or professional advisers may receive information needed to help us operate the business, meet legal obligations or resolve a dispute.
We may also disclose information where required by law or to protect lawful rights and the security of the service. This app is not a service for selling customer lists or using a merchant's audience for Obsedia's own marketing.
6. International processing
Service providers may process information in countries other than the country where the merchant or customer is located. Applicable provider agreements and data-protection requirements govern those transfers. Where required, international processing must be supported by an applicable adequacy decision or appropriate contractual safeguards. Contact privacy@obsedia.ai for information about the recipients and safeguards relevant to a request.
7. Security and retention
We use safeguards designed to protect information, including access restrictions between stores, protected credentials, encrypted customer-bearing sending material and restricted operational logging. Pseudonymous identifiers are still treated as personal data where they can be linked to a person.
Conversation text is held in the current working session; Obsedia does not retain full AI transcripts or use browser-persistent storage for this feature. Saved campaigns, automations, settings and restricted action metadata follow their applicable service retention rules. OpenAI's applicable service data controls govern its processing and retention.
We keep information for the purpose for which it is needed. Eligible completed, non-financial message history is subject to a 90-day cleanup policy. Active campaigns, unresolved messages, privacy requests, consent and opt-out restrictions, security records and financial evidence have separate retention needs and may be kept longer where necessary.
Uninstalling disables the installation and stops new sends. It does not instantly erase every stored record or retract a message already accepted by WhatsApp. Verified deletion requests and Shopify's privacy procedures are handled separately. Financial or other records that must be retained for legal reasons are restricted to the relevant purpose.
Backup copies may remain until they expire under the applicable backup process. Restored information must pass the service's privacy and consent safeguards before customer processing resumes. We do not promise that every record or backup is deleted immediately on uninstall.
8. Your rights and choices
Depending on applicable law, you may request access, correction, deletion, restriction, a copy of your data, or object to certain processing. Where processing relies on consent, you may withdraw it without affecting processing that was lawful before withdrawal.
Merchants can contact privacy@obsedia.ai and identify their Shopify store. Customers should normally contact the store whose message they received; they can also contact us for assistance in directing a request. We may ask for limited information to verify identity, authority and the records concerned. Do not send passwords, access tokens or unnecessary identity documents.
We respond within the time required by applicable law. GDPR requests normally require a response within one month; if a permitted extension or legal exception applies, we explain it. You may also complain to your competent supervisory authority. In Romania, this is ANSPDCP.
Replying STOP or otherwise withdrawing marketing permission is an opt-out; it is not automatically a request to erase every customer or business record. Instructions for deletion are available at obsedia.ai/data-deletion.
9. Children and sensitive information
The app is intended for business use by Shopify merchants. Merchants should not use it to send unlawful messages or include sensitive personal information that is unnecessary for the selected message or unsupported by the service.
10. Changes and contact
We update this policy when the service or relevant requirements change. The date above identifies the current text. Where required, we provide notice of material changes.
For privacy questions or requests, contact privacy@obsedia.ai. For help using WhatsApp Marketing Hub, contact agents@obsedia.ai.