Privacy Policy

For merchant accounts (the people who sign up and run a store), Totapakhi is the controller of your account data.

For customer conversations (people who message a merchant on Messenger, Instagram or WhatsApp), the merchant decides how those conversations are used and is the controller. We process those messages on the merchant’s behalf, only to provide the service to them. If you messaged a shop, you can contact that shop directly, or reach us and we’ll pass your request on.

From merchants

• Account details: your name, email address and store name, and a securely hashed password. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Catalog data: products you import or add, such as titles, descriptions, prices, variants, stock levels, images and links, and the address of any Shopify or WooCommerce store you import from.
• Connection credentials: optional Shopify or WooCommerce API keys, and the access tokens Meta issues when you connect a Facebook Page, Instagram account or WhatsApp number. These are encrypted before they are stored.
• Settings: your assistant instructions, pause and quiet-hour settings and time zone.

From customers who message a connected store

• The platform’s identifier for you (a Messenger or Instagram ID, or your WhatsApp phone number) and your public profile name.
• The messages you exchange with the store, and when they were sent.

Automatically

• A sign-in cookie that keeps merchants logged in. We don’t use advertising or cross-site tracking cookies. Your light or dark theme choice is saved in your browser’s local storage.
• Standard server logs (such as IP address, browser type and time of request), used for security and troubleshooting.

• To run your account and store, and to show your catalog and conversations in your dashboard.
• To receive customer messages from Meta and send replies back through the same channel.
• To generate AI replies: when a customer writes, the recent conversation, the matching products from the merchant’s catalog and the merchant’s approved instructions are sent to our AI provider to draft an answer.
• To review assistant instructions merchants submit before they go live, so the assistant stays safe and accurate.
• To keep the service secure, prevent abuse, fix problems and comply with the law.
• To contact merchants about their account, security or important changes to the service.

Replies are generated by Google’s Gemini models through the Gemini API. Only what’s needed for a reply is sent: the recent messages in that conversation, the relevant products and the store’s instructions. Google processes this data under its API terms to return the reply; we don’t send merchants’ passwords, API keys or channel tokens.

The assistant can make mistakes. It is designed to answer only from the merchant’s catalog and to hand anything else, such as orders, refunds or complaints, to a person.

We don’t sell personal data or share it for advertising. We share it only with:

• Meta Platforms (Facebook Messenger, Instagram and WhatsApp), to receive and deliver messages for channels a merchant connects.
• Google, for AI replies (Gemini API) and, if you choose it, “Continue with Google” sign-in.
• Shopify or WooCommerce stores you ask us to import from, to read your catalog.
• Our hosting and infrastructure providers, who store and process data for us under confidentiality and security obligations.
• Authorities, when the law requires it, or to protect the rights, safety or property of our users or the public.
• A buyer or successor, if Totapakhi is involved in a merger or acquisition, under the same protections as this policy.

Data we receive through Meta’s platforms is used only to provide messaging features to the merchant who connected the channel, in line with Meta’s Platform Terms.

• Account, catalog and conversation data is kept while the merchant’s account is active.
• Disconnecting a channel deletes its access token and the conversations received through it.
• Deleting your account permanently removes your store, catalog, channel connections and conversations straight away. Copies in backups are overwritten within 30 days.
• Server logs are kept for a limited period for security, then deleted.

Passwords are hashed with scrypt. Store API keys and channel tokens are encrypted at rest and never sent to your browser. Each store’s data is kept separate from every other store’s, and traffic is encrypted in transit with HTTPS. No system is perfectly secure, so please use a strong, unique password and tell us straight away if you suspect a problem.

Depending on where you live, you may have the right to access, correct, export or delete your data, and to object to or limit how it’s used. You can:

• Edit your name, store name and password in Settings.
• Disconnect any channel from the Channels page at any time.
• Delete your account and all its data from Settings. See Data deletion for the details, including how customers of a store can ask for their messages to be removed.
• Email [email protected] for anything else, including a copy of your data. We reply within 30 days.

You also have the right to complain to your local data protection authority.

Totapakhi is a tool for businesses and isn’t meant for anyone under 18. We don’t knowingly collect data from children.

Our providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses.

We’ll update the date at the top when this policy changes. If a change is significant, we’ll let merchants know by email or in the dashboard before it takes effect.

Questions or requests about privacy: [email protected].