Legal

Privacy Policy

Last updated: October 5, 2026

Trisend ("we", "us", "our") operates the Trisend application available through the Shopify App Store. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you install and use our application.

1. Information We Collect

When you install Trisend, we collect the following information from your Shopify store:

  • Store information: Shop domain, store name, email address, and billing details.
  • Customer data: Customer names, email addresses, phone numbers, order history, and tags as authorized by your granted API scopes.
  • Order data: Order details for revenue attribution and analytics.
  • Product data: Product catalog information for recommendation features.
  • Usage data: Campaign sends, open rates, click rates, and conversion metrics.

2. How We Use Your Information

  • To provide email, SMS, and WhatsApp marketing services on your behalf.
  • To build audience segments and automate marketing workflows.
  • To generate analytics, attribution reports, and performance metrics.
  • To manage your subscription and billing through Shopify's Billing API.
  • To send transactional communications related to your account.

3. Third-Party Service Providers

We use the following third-party providers to deliver our services:

  • Amazon Web Services (AWS SES): Email delivery infrastructure. Emails are sent through our SES account on your behalf.
  • Twilio: SMS delivery infrastructure. SMS messages are sent through our Twilio account on your behalf.
  • Meta (WhatsApp Business Platform): WhatsApp messaging. Merchants on Growth plans and above connect their own WhatsApp Business account — messages are sent from the merchant's account, not ours. See section 4.
  • Hetzner: Server infrastructure hosted in the EU (Helsinki, Finland). Our analytics database (ClickHouse) runs on these servers.
  • Amazon S3: Temporary storage of contact-import files and export downloads (deleted automatically within 7 days) and encrypted database backups.

4. WhatsApp and Meta Platform Data

When a merchant connects WhatsApp, they sign in with Facebook through Meta's Embedded Signup and choose which WhatsApp Business account to share. We do not receive or store their Facebook profile, friends, posts or any other personal Facebook data. We receive and store only what is needed to send their WhatsApp messages:

  • The access token Meta issues for that WhatsApp Business account — stored encrypted (AES-256-GCM) and used only by our servers.
  • The WhatsApp Business account ID, phone number ID, display phone number, verified business name, quality rating and messaging limit.
  • The merchant's message templates and their approval status.
  • Delivery and read statuses of messages sent, and replies customers send to the business number (shown in the merchant's WhatsApp inbox).

We use this data only to provide the merchant's WhatsApp features (sending their campaigns and automations, syncing their templates, showing replies and delivery results). We never sell it, never use it for advertising or profiling, and never share it except with Meta to deliver the merchant's messages. Disconnecting WhatsApp in Trisend deletes the access token and account details immediately; uninstalling Trisend deletes all of the store's data. See Data Deletion.

5. Data Storage & Security

Your data is stored in a PostgreSQL database and our analytics database (ClickHouse), both on our own servers in the EU (Hetzner, Helsinki, Finland). All data is transmitted over HTTPS (TLS 1.2+). Access tokens for connected accounts are encrypted at rest. We implement industry-standard security measures including encrypted connections, access controls, and regular security updates.

6. Data Retention

  • Account data: Retained while your app is installed. Deleted within 30 days of uninstallation via Shopify's mandatory shop/redact webhook.
  • Campaign analytics: Retained for 24 months for reporting purposes, then automatically purged.
  • Customer data: Deleted upon receiving a customer data erasure request (customers/redact webhook) or upon app uninstallation.
  • Session data: Cleared immediately upon app uninstallation.
  • Connected-account credentials (e.g. the WhatsApp access token): deleted immediately when the account is disconnected.

7. GDPR & CCPA Compliance

We comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). We act as a data processor on behalf of merchants (data controllers). For details on your rights and our compliance measures, contact us at support@trisend.app.

8. Shopify Mandatory Webhooks

We fully implement Shopify's mandatory compliance webhooks:

  • Customer Data Request: When a customer requests their data, we compile and export all stored data for that customer.
  • Customer Data Erasure: When a customer requests deletion, we erase all personal data associated with that customer.
  • Shop Data Erasure: When a merchant uninstalls the app, we delete all shop data, customer records, campaigns, and analytics within 30 days.

9. Your Rights

You have the right to:

  • Access the personal data we hold about your customers.
  • Request correction of inaccurate data.
  • Request deletion of your data (processed via Shopify's compliance webhooks).
  • Export your data at any time through the app's analytics export feature.
  • Withdraw consent by uninstalling the app, or disconnect WhatsApp at any time.
  • Request deletion of data received through Meta — see Data Deletion.

10. Cookies

Trisend does not use tracking or advertising cookies. The app uses only essential cookies: one that keeps you signed in after you open Trisend from your Shopify admin, and one that remembers your language.

11. Children's Privacy

Trisend is a business-to-business service and is not directed at individuals under the age of 16. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at privacy@trisend.app.

Trisend, 6/A, Road-4, Plot-2, Mirpur, Dhaka-1216, Bangladesh. See also our Contact page.