Docs / Legal / Privacy Policy

Privacy Policy

Last updated: 13 August 2026

1. Who we are

Stravax Engage is operated by Stravax Group LLC, a limited liability company licensed by Sharjah Media City Free Zone Authority (Shams), Government of Sharjah, United Arab Emirates (Licence No. 2537844.01). Registered address: Sharjah Media City (Shams), Al Messaned, Al Bataeh, Sharjah, United Arab Emirates.

Stravax Engage is a WhatsApp engagement platform. Our Shopify app sends WhatsApp abandoned-cart and order-recovery messages to a merchant's customers, on the merchant's behalf and on the merchant's instructions.

We act in two roles:

As a data controller for the merchant's own account information (the business's login, billing, and administrative data).
As a data processor for the customer personal data a merchant's store sends us for recovery messaging. For that data the merchant is the controller and Stravax Group LLC is the processor, acting only on the merchant's documented instructions.

Stravax Engage is used through a web app and an Android and iOS mobile app, and it connects to WhatsApp, Messenger and Instagram as well as to Shopify. This policy covers the whole platform:

Section 2 covers the customer personal data received through the Shopify integration, where we act as a processor for the merchant.
Section 3 covers the personal data handled in the Stravax Engage web and mobile apps, which is what a team member using the apps needs to know.

Throughout this policy, "workspace" means the business account a team member signs in to, and "workspace administrator" means the person at that business who provisions and removes team members.

2. Customer personal data we process through Shopify

When a merchant installs the Stravax Engage Shopify app and enables cart recovery, Shopify sends us abandoned-checkout and order webhooks. From those we store, per abandoned checkout, only:

Customer name (first and last name, where present on the checkout).
Customer phone number (used as the WhatsApp recipient).
Non-personal cart metadata: the Shopify checkout token, the cart recovery URL, currency, cart total, item count, and timestamps.

We do not store the customer's email address, billing address, shipping address, payment details, or order line-item contents. Those fields are not persisted by the app.

The customer name and phone number are the only Shopify Protected Customer Data fields the app requests or retains.

3. Personal data in the Stravax Engage web and mobile apps

The people who use the apps are team members of a business that has a Stravax Engage workspace. There is no sign-up inside the apps: an account only exists because a workspace administrator created it.

3.1 Account data (we are the controller)

Name and email address, as entered by the administrator who created the account.
Password, stored only as a salted hash. We never store it in a readable form.
Two-factor secret, only if the team member chooses to turn on two-factor authentication.
Trusted-device records and an IP address, used to recognise a device and, where a workspace has enabled an IP allowlist, to enforce it. Signing in from an unrecognised device triggers a one-time code sent to the account's email address.
Push notification token, so the mobile app can be told a new message has arrived. It is deleted from our servers when the team member signs out.

3.2 Workspace content shown in the apps (we are the processor)

The apps display the conversations, contacts, leads and campaigns belonging to the workspace. That content includes messages and media exchanged with the business's own customers. The business is the controller of that content; we hold and display it on their instruction. A team member sees it because their administrator granted them access to that workspace.

3.3 Content a team member chooses to send

Each item below is handled only when the team member actively chooses to send it, and each is requested at first use behind an in-app explanation. Declining any of them leaves the rest of the app working.

What	When it is used	What reaches our servers
Photos and videos	Taking a photo or picking one to send	The image or video, as a message
Voice notes	Recording a voice message in a conversation	The audio recording, as a message
Documents	Picking a file to send	The file, as a message
Location	Choosing "Send location"	The device's current coordinates at that moment
A contact card	Choosing to share a contact	The name and phone numbers of the one contact selected

Two limits are worth stating plainly, because they are enforced in the app rather than merely promised. We never upload the address book: only the single contact the team member picks is read. And location is foreground only, captured at the moment of sending. The apps cannot access location in the background, and no background-location permission is requested.

3.4 What the apps do not do

No advertising identifier, and no advertising or marketing use of any of this data.
No third-party analytics, tracking or attribution software of any kind.
No access to the photo library, files or contacts beyond the single item selected. The apps use the operating system's own pickers, which hand over only the chosen item.
No selling of personal data, ever, in either role.

3.5 Why we process it

Account data is processed to operate the service: to authenticate the team member, to keep the account secure, to deliver notifications, and to bill the business. Workspace content is processed only to provide the messaging, CRM and campaign features the business uses the product for, on that business's instruction.

4. Why we process the Shopify data, and our lawful basis

The sole purpose of the Shopify data is to send the merchant's customer a WhatsApp cart-recovery or order-recovery message, and to record whether that message led to a completed order (so the merchant can see recovery performance).

We process this data only on the merchant's instruction. The merchant is responsible for having a lawful basis and the customer consent required to message their customers on WhatsApp. Our app respects the marketing-consent flag on the Shopify checkout: a marketing-category recovery message is only sent to a customer whose checkout indicated marketing opt-in.

We do not use this data to build our own marketing lists, profile customers across merchants, or for any purpose other than delivering the merchant's recovery messaging.

5. We do not sell or share your data

We do not sell customer personal data. We do not share it with third parties for their own purposes, for advertising, or for any purpose beyond operating the recovery service for the merchant. The only third parties that ever receive this data are the infrastructure sub-processors listed in section 7, and only to the extent needed to deliver the message.

6. How we protect it

In transit: all data is encrypted with TLS/HTTPS. Every inbound Shopify webhook is verified by HMAC-SHA256 signature against our app secret before it is processed; an unsigned or incorrectly signed request is rejected.
At rest: data is stored in Cloudflare D1 (database) and Cloudflare R2 (object storage), which Cloudflare encrypts at rest at the platform level. In addition, each merchant's stored Shopify Admin API access token is separately encrypted at the application layer using AES-256-GCM before it is written to the database.
Tenant isolation: every stored record is tagged with the owning merchant's organisation id, and every query is scoped to a single organisation. There is no code path by which one merchant can read another merchant's customer data. The merchant binding for a store is established only through a verified Shopify OAuth install, not from any client-supplied value.
Access logging: privileged and compliance-related actions are written to an append-only administrative audit log.

7. Sub-processors

We use the following sub-processors. For the Shopify customer name and phone number specifically, only the rows marked (receives Shopify name + phone) are in that data path.

Sub-processor	Purpose	In the Shopify name+phone path?
Cloudflare	Hosting, database (D1), object storage (R2), queues, security	Yes (storage)
Meta / WhatsApp (WhatsApp Business Platform)	Delivers the recovery message; the customer name is a message template parameter and the phone number is the recipient	Yes (delivery)
Shopify	Source of the checkout and order webhooks	Source, not a recipient
Stripe	Merchant billing and self-serve wallet top-up	No
Google Ads / Meta Ads	Conversion-event receipt for merchants who enable Ad Sync	No
Anthropic	Optional AI conversation qualifier (processes WhatsApp conversation message text only, for merchants who enable it)	No
Zoho	Two separate uses: (1) the optional Zoho CRM connector, for merchants who connect it, pushes each lead as a Contact/Deal (name, email, phone, company, deal stage and amount) to the merchant's own Zoho CRM account, hosted in whichever Zoho data center that account lives in (US/EU/IN/AU/JP, tenant-controlled); (2) Zoho Mail provides email hosting for Stravax operational mailboxes (@engage.stravax.ai: support, privacy, billing, hello, no-reply), processing email content and sender metadata for support and transactional communications, global region	Yes (CRM connector only, when a merchant connects it and the synced lead originated from a Shopify recovery message; mail is not in this path)

Anthropic is listed for completeness because a merchant may separately enable an AI conversation feature that sends WhatsApp message content to Anthropic. That optional feature does not receive the Shopify-sourced customer name or phone fields.

8. How long we keep it

Account data is kept for as long as the team member's account exists, and is deleted when the account is deleted (section 9). Workspace content is kept for as long as the workspace exists, because it belongs to the business rather than to any one team member.

Abandoned-checkout records (customer name, phone, and cart metadata) are retained for up to 90 days from the time the checkout was abandoned, and are then deleted. See the accompanying Data Retention Policy for the full rationale. Recovery loses value quickly after a cart is abandoned; we keep records only long enough for the recovery to fire, for a late order to be attributed, and for the merchant to see recent recovery performance.

Records are also deleted earlier when a merchant uninstalls the app or when a deletion request is received (section 9).

9. Exercising data rights (access, correction, deletion)

Because we process customer personal data as a processor on the merchant's behalf, a customer exercises their rights through the merchant (the controller). We honour the merchant's instructions and Shopify's mandatory privacy webhooks automatically:

Deletion of a specific customer (customers/redact): on receiving this webhook from Shopify, we delete that customer's abandoned-checkout records for that store, matched by phone number.
Erasure of an entire store (shop/redact): on receiving this webhook (which Shopify sends after a merchant uninstalls the app), we delete all abandoned-checkout records we hold for that store.
Data-access request (customers/data_request): we log the request to our administrative audit trail and fulfil it manually, since the only data we hold for a customer is their abandoned-checkout contact data (name, phone, cart URL) for that store.

A customer or merchant may also contact us directly using the details in section 11.

9.1 Deleting your Stravax Engage account and data

If you use the Stravax Engage web or mobile app and want your personal data deleted, you have two routes. Either works, and neither requires the other.

Ask your workspace administrator to remove your account. This is usually fastest. Removal ends your access immediately and deletes your sign-in credentials, your trusted devices and your push registrations.
Email us at privacy@engage.stravax.ai from the email address on your account, asking for your account to be deleted. If we cannot verify that the request comes from the account holder, we will ask you for confirmation before acting.

What we delete. Your name and email address, your password hash, your two-factor secret, your trusted-device records, your push notification tokens, and your personal settings. Deletion is permanent and cannot be undone.

What is kept, and why. Two things do not go away when your personal account does, and it is better to be direct about them.

The workspace's own content. Conversations with the business's customers, contacts, leads and campaigns belong to the business, not to you, and the business remains their controller. They stay in the workspace after your account is removed. If you want that content deleted, the request has to come from the business, which can ask us to delete the entire workspace.
Records we are required to keep. Billing and accounting records, and a minimal entry in our administrative audit log recording that a deletion was carried out, are retained for as long as applicable law requires us to keep them. They are not used for any other purpose.

How long it takes. We action verified deletion requests within 30 days, and usually much sooner.

Deleting an entire workspace. A business that wants everything removed can ask us at privacy@engage.stravax.ai. We then delete the workspace's accounts, conversations, media, contacts, leads and campaigns, subject only to the retained records described above.

10. International transfers

Data may be processed outside the UAE through our global infrastructure providers (principally Cloudflare and Meta/WhatsApp). Transfers rely on those providers' own safeguards.

11. Contact

Stravax Group LLC, Sharjah, UAE.

Privacy and data requests: privacy@engage.stravax.ai

12. Children

Stravax Engage is a business tool and is not directed to children. We do not knowingly process data relating to anyone under 18.

13. Changes to this policy

We update this policy as the service evolves. Material changes will be posted here before they take effect.