Qchat: Facebook Messenger Privacy Policy
QByteSoft Technologies ("QByteSoft", "we", "us", or "our") is committed to protecting the privacy, security, and confidentiality of merchants, store administrators, and customers. This Privacy Policy describes how we collect, store, process, and protect information when you install or use the Qchat: Facebook Messenger application ("App", "Qchat") from the Shopify App Store.
1. Information We Collect
When you install and authorize the Qchat: Facebook Messenger App via Shopify OAuth and connect your Facebook Page or Meta Business Account, we collect and process specific categories of data necessary to provide chat widget integration, customer engagement, and live messaging workflows:
A. Merchant & Store Data
- Shop Information: Store primary domain, myshopify.com URL, store name, merchant email address, store owner name, country, currency, and timezone.
- Facebook Page & Meta Integration Credentials: Connected Facebook Page ID, Page name, securely encrypted Facebook Page Access Tokens, and webhook subscription settings necessary for sending and receiving messages.
- Configuration & Widget Settings: Chat widget appearance (brand theme colors, position, greeting dialogues, call-to-action badges, business hours, automated welcome prompts, and notification preferences).
B. Customer & Visitor Messenger Data
When store visitors interact with the Qchat Facebook Messenger widget on your storefront, or message your Facebook Page:
- Messenger Profile Data: Facebook User ID (Page-Scoped ID / PSID), sender display name, and public profile details provided by Meta in accordance with the user's public Facebook privacy settings.
- Chat Transcripts & Content: Customer inquiries, chat messages, timestamps, and delivery/read statuses exchanged between customers and your support team via Facebook Messenger.
- Store Session Context (Non-PII): Storefront page URL or product viewed at the time of initiating a conversation (shared strictly to give the merchant necessary context to assist the customer).
2. How We Use Collected Information
We use the data strictly for legitimate operational purposes:
- Live Messenger Communication & Chat Delivery: Facilitating instant, two-way messaging between online store shoppers and merchant Facebook Pages / Meta Business Inbox via official Meta Graph APIs and webhooks.
- Storefront Widget Rendering: Injecting and rendering the lightweight, responsive chat bubble, interactive greeting cards, and localized chat interface on your Shopify storefront without degrading page load speeds.
- Customer Support & Order Assistance: Empowering merchants to answer buyer inquiries, provide pre-sale advice, share product recommendations, and deliver order assistance.
- Service Communication & Auditing: Sending critical connection health alerts, maintaining security logs, and shielding your storefront against spam or unauthorized activity.
3. Data Protection & Security (AES-256 Encryption)
We implement industry-leading technical and organizational security measures:
- Encryption at Rest: All proprietary custom tokens, Facebook Page Access Tokens, and sensitive authentication credentials are encrypted using AES-256-GCM with unique 96-bit Initialization Vectors (IV).
- Encryption in Transit: All communications between Shopify, Meta/Facebook Graph API endpoints, our application servers, and storefront clients are encrypted using TLS 1.3 and HTTPS.
- Strict Meta Platform Policy Adherence: We strictly comply with Meta Platform Terms, Developer Policies, and Messenger Platform Guidelines. We do not sell, rent, monetize, or broker merchant or customer data to third parties, data brokers, or advertisers.
- Access Controls: Role-based access controls, continuous vulnerability scans, and strict database isolation per store partition.
4. Mandatory Shopify GDPR Webhook Compliance & Meta Data Deletion
Qchat: Facebook Messenger is fully compliant with Shopify's mandatory data protection and GDPR requirements, as well as Meta's Data Deletion standards. Our servers automatically process the following statutory webhooks in real time:
1. customers/data_request
When a customer requests a copy of their stored data from the merchant, Qchat packages any chat interaction records and identifiers associated with that customer ID and securely delivers them to the merchant within statutory timeframes.
2. customers/redact
When a customer requests erasure of their personal data, Qchat immediately purges all customer names, chat transcripts, and Messenger PSID identifiers from our database.
3. shop/redact
48 hours after an app uninstall event, Qchat permanently and irreversibly deletes all stored store records, Facebook Page tokens, chat histories, widget configurations, and settings from our database.
4. Meta Platform Data Deletion Callback
In compliance with Meta Platform Terms, when a user removes the app or requests data removal via their Facebook account settings, Meta invokes our automated Data Deletion Callback endpoint. Qchat instantly deletes all associated user data and provides a verifiable confirmation URL and tracking code.
5. Third-Party Service Providers
We only share data with essential third-party infrastructure and platform providers necessary to operate the App:
- Shopify Inc.: Platform hosting, App Bridge, Theme App Extensions (App Embeds), OAuth authentication, Admin GraphQL API, and App Billing.
- Meta Platforms, Inc. (Facebook): Facebook Messenger Platform, Graph API, and Meta Webhooks infrastructure to route and deliver live messages between customers and Facebook Pages.
- Cloud Infrastructure: PostgreSQL database hosting in secure, SOC 2 Type II certified data centers with encrypted storage and automated backups.
6. Your Rights (GDPR & CCPA/CPRA)
Depending on your jurisdiction, you and your store customers hold the following legal rights regarding personal data:
- Right to Access: Request a full copy of the data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete records.
- Right to Erasure ("Right to be Forgotten"): Request complete deletion of your data.
- Right to Restrict Processing: Request suspension of data processing under certain circumstances.
- Right to Data Portability: Request transmission of your data in a structured, machine-readable format.
- Non-Discrimination: We will never discriminate against you for exercising any of your privacy rights.
7. Contact Information
If you have any questions, privacy inquiries, or wish to exercise your data rights, please contact our Data Protection Officer: