Effective and last updated: 12 August, 2026
Esta política do aplicativo é publicada apenas em inglês. A versão em inglês é a única versão oficial.
1. Who we are
This app ("bKlug WhatsApp Button", the "App") is provided by MENSAGENS ELÍPTICAS - LDA. (trading as bKlug), a company registered in Portugal.
Tax ID (NIF): PT517467739. Registered address: Rua Sousa Martins, nº 15, 5, 1050-217 Lisbon, Portugal. Contact: contact@bklug.ai.
For the limited data this App processes, bKlug acts as a data processor on behalf of the merchant (the Shopify store owner), who is the data controller for their store.
2. What the App does
The App lets a Shopify merchant add a floating WhatsApp button to their storefront. The button is configured by the merchant in the Shopify theme editor (phone number, prefilled message, contacts, color, position) and is rendered on the storefront on the visitor's own device.
3. Data we collect
From the merchant (on install and use)
When a merchant installs the App, Shopify provides us with, and we process:
- The store's myshopify domain and basic store identification.
- An access token or session credential used to authenticate the App with Shopify.
- The configuration the merchant enters for the button (phone numbers, prefilled messages, contact names, display settings). This is stored in the store's theme settings via Shopify; where the App stores any session data, it is held only to keep the App connected.
- The store owner's email address, read once from the store record at install. We use it only to send the merchant a short sequence of setup emails about the App they installed, and to record which of those have already been sent. Every email carries an unsubscribe link, and unsubscribing stops the sequence permanently.
From storefront visitors (shoppers)
None. The WhatsApp button runs entirely in the shopper's browser. When a shopper taps it, their device opens WhatsApp using a standard WhatsApp link. The App does not set cookies, does not track visitors, and does not send any visitor personal data to bKlug. Any message a shopper then sends is handled by WhatsApp under WhatsApp's own privacy terms, not by this App.
We do not request access to, collect, or store the merchant's customer records, orders, or product data beyond what is needed to run the App.
4. Why we process this data (legal basis)
We process the limited merchant and store data above to provide the App the merchant installed and to keep it functioning (performance of a contract, and legitimate interest in operating the service, under GDPR).
5. Sub-processors
We use the following third parties to operate the App. They process data only as needed to provide their service. The App uses no error-monitoring or analytics vendor today.
Shopify
Provided by Shopify Inc.. United States.
App platform, authentication, theme settings storage
Vercel
Provided by Vercel Inc.. United States.
Application hosting; runs the App and its scheduled jobs
Upstash
Provided by Upstash, Inc.. United States.
Serverless Redis; admin session storage and short-lived operational cache, all entries expiring
Neon
Provided by Neon, Inc.. United States.
Serverless PostgreSQL; store record and email-sequence state
SendGrid
Provided by Twilio Inc.. United States.
Delivery of the post-install emails to the merchant
6. Data retention
We retain the store identification and session data only while the App is installed. Session records carry their own expiry and are removed automatically once they lapse. When the merchant uninstalls the App, we delete or anonymize the associated store data within 30 days, except where we are legally required to retain it. Button configuration stored in the store's theme settings is removed by the merchant or by uninstalling.
7. Data subject rights
Storefront visitors: because the App collects no visitor personal data, there is no visitor data for us to access, correct, or delete. Requests about messages sent through WhatsApp should be directed to WhatsApp.
Merchants and individuals whose data we process may request access, correction, deletion, or portability, and may object to or restrict processing, by contacting us at contact@bklug.ai.
We respond to Shopify's mandatory data-request, customer-redact, and shop-redact webhooks. Because we do not store shopper personal data, our response to customer-data and customer-redact requests confirms that no such data is held.
8. International transfers
Data may be processed in the European Union and in other countries where our sub-processors operate. The sub-processors listed below operate in the United States. Where data leaves the EU or EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
9. Security
We use industry-standard measures to protect the limited data we process, including encrypted transport (HTTPS), encryption at rest at our database providers, and access controls on our hosting environment restricted to authenticated engineering personnel.
10. Changes to this policy
We may update this policy as the App changes. The "last updated" date above reflects the latest version. Material changes affecting how we process data will be communicated through the App listing.
11. Contact
MENSAGENS ELÍPTICAS - LDA. (bKlug), Rua Sousa Martins, nº 15, 5, 1050-217 Lisbon, Portugal. contact@bklug.ai.
bKlug is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta Platforms, Inc. WhatsApp is a trademark of its respective owner.