Privacy Policy

Account Information: When you sign up, we collect your name, email address, and password. If you sign in using Facebook Login, we receive your Facebook user ID, name, and email address based on the permissions you grant.

Organization Data: We collect your business name, industry, and team member information to set up your workspace.

WhatsApp Business Data: When you connect your WhatsApp Business Account through Meta's Embedded Signup, we receive your WhatsApp Business Account ID, phone number ID, and business verification status. We access your WhatsApp message history, contact information, and conversation metadata to provide our messaging and CRM services.

Contact Data: We store information about your WhatsApp contacts, including phone numbers, names, conversation history, tags, and any custom fields you create.

Message Content: We process and store WhatsApp messages (text, images, documents, and other media) sent and received through your connected WhatsApp Business Account to provide inbox, campaign, and automation features.

Usage Data: We collect information about how you use the platform, including pages visited, features used, and actions taken.

Payment Information: Payment details are processed securely by Stripe, or by Shopify if you pay through your Shopify bill. We do not store your full credit card number on our servers.

When you integrate with Meta platforms, we specifically collect and process:

• Facebook Login: User ID, name, email address (with your consent via the permissions dialog)
• WhatsApp Business API: Business Account ID, phone number IDs, message templates, conversation data, contact phone numbers, message content and media, delivery/read receipts
• WhatsApp Embedded Signup: Business verification status, selected phone number, business profile information

We use Meta platform data solely to provide TripleTick's services to you. We do not sell Meta platform data to third parties. We do not use Meta platform data for advertising purposes unrelated to our service.

We use the information we collect to:

• Provide, maintain, and improve our WhatsApp sales and marketing platform
• Send and receive WhatsApp messages on your behalf through the WhatsApp Business API
• Manage your contacts, conversations, and CRM data
• Execute marketing campaigns and automated messaging flows
• Authenticate your identity and manage your account
• Process payments and manage your subscription
• Provide customer support
• Send service-related notifications (not marketing)
• Analyze usage patterns to improve our platform
• Comply with legal obligations

We may share your information with:

• Meta Platforms: Message content and contact data are transmitted via the WhatsApp Business API to deliver messages. This is required for the core functionality of the service.
• Supabase Inc.: Our database and authentication provider, which stores your data securely with row-level security and encryption.
• Vercel Inc.: Our hosting provider, which processes web requests.
• Anthropic PBC: Our AI provider. If you use AI-powered features (message suggestions, auto-replies, automated assistant), message content is sent to Anthropic to generate responses.
• Sentry: Our error-monitoring provider, which may incidentally process data contained in error reports.
• Stripe Inc.: Our payment processor, which handles billing and subscription data only (not message content or Meta data).
• Shopify Inc.: If you connect Shopify, we write draft orders and customer tags to your store and send your usage for billing, as described in section 5.

We do not sell your personal data to any third party. We do not share your data with third parties for their own marketing purposes.

You can connect Stripe, Shopify, and Google Calendar to your workspace. Only an owner or admin can connect or disconnect them. We ask only for the access listed below.

Stripe

• What we read: Payments, refunds, and disputes on your Stripe account, and your business name. For a payment we read the amount, currency, description, the payer's email and phone, and the Stripe customer it belongs to.
• What we write: When you send a payment link, we create a Customer in your Stripe account with the contact's name, phone number, and email if we have it, plus the TripleTick contact ID. We also create the Checkout Session for the link. We never create charges, refunds, or payouts. Refunds are made in Stripe.
• Why: To send a payment link that is already filled in, and to keep each order in TripleTick (paid, refunded, disputed) in line with Stripe.
• What we keep: The order (amount, currency, status, description, Stripe payment ID) and the Stripe customer ID linked to the contact. The email a buyer types at Stripe checkout is saved on that order only. We never write it to the contact. For payments made outside TripleTick, we use the payer's email and phone only to find the matching contact, and we do not store them.
• How long: Until you disconnect. Orders stay as your workspace's records. We delete them on request.
• How to disconnect: Settings, Integrations, Stripe, Disconnect. Also remove TripleTick in Stripe under Settings, Installed apps.

Shopify

• What we read: Your products and variants (title, description, price, images, stock count, and status), and your shop's name and currency. Your customers' name, email, and phone number, and whether each customer agreed in Shopify to receive marketing messages at that phone number. Your paid orders: items, quantities, totals, refunds, and the email typed at checkout. If you turn on abandoned checkout follow-up, your abandoned checkouts: the items, the total, and the link that reopens the checkout. We never read or store addresses.
• What we write: When your assistant sends a checkout link, we create a draft order in your store with the chosen items and a discount code if you set one up. The draft carries no customer details; the buyer enters them at checkout. We delete the draft if the link expires unused. Customers who chat with you on WhatsApp get a "WhatsApp" tag. We never change or delete your customers or orders. We register webhooks so Shopify tells us when products, customers, orders, and checkouts change.
• Why: So your assistant can answer from your real products and stock, knows who it is talking to, can send a checkout link for the exact items a customer chose, and can follow up an abandoned checkout on WhatsApp. We send a first WhatsApp message to a shopper only if you have confirmed that your checkout asks permission to message on WhatsApp, the shopper agreed in Shopify, and that number has not opted out. When your assistant replies in a chat, the person's name and any abandoned checkout's items and total are sent to our AI provider (see section 4).
• What we keep: A copy of your products in your workspace's inventory. Each customer becomes a contact, linked to their Shopify customer ID. Paid orders appear on the matching contact; when you connect, we also bring in the last 60 days. The email typed at checkout is saved on that order only, and only if it differs from the contact's. Each abandoned checkout is kept as a short record: the number of items, the total, the checkout link, and whether it was recovered.
• How long: Abandoned checkout records are deleted after 90 days. Contacts and orders stay until you delete them, or until Shopify asks us to erase them. When Shopify sends a customer erasure request, we delete that customer's Shopify orders and checkout records and remove the name, email, and phone that came from Shopify; a contact we created from Shopify who never chatted with you is deleted completely. When Shopify sends a customer data request, we email your workspace owners a download link, valid for 7 days, to everything we hold about that customer.
• Billing: If your workspace uses the Shopify app, you pay for TripleTick on your Shopify bill. Shopify takes the payment. We read your plan and billing cycle from Shopify and send it your extra usage. We do not see your payment details.
• How to disconnect: Uninstall TripleTick in your Shopify admin, or go to Settings, Integrations, Shopify, Disconnect, which also uninstalls the app (unless another of your workspaces still uses the store). Shopify tells us 48 hours later, and we then erase everything that came from your store. People who chatted with you on WhatsApp keep their contact and chat, without the Shopify data.

Google Calendar

• What we read: Your Google account email and your list of calendars. We also ask for permission to see when you are busy and to read events on the calendars you choose.
• What we write: Nothing yet. We ask for permission to add, change, and delete appointment events on your calendar, for appointments booked through TripleTick.
• Why: We use this access to see when you are free and to add appointments booked through TripleTick to your calendar.
• What we keep: The connection: your Google email and the access tokens, which are kept in our encrypted secrets store (Supabase Vault), not in plain database columns. We do not copy your events.
• How long: Until you disconnect. We delete on request.
• How to disconnect: Settings, Integrations, Google Calendar, Disconnect. We also revoke our access at Google. You can remove it yourself at myaccount.google.com/permissions.

TripleTick's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

To delete data from a connected service, contact us at security@tripletick.ai.

Your data is stored securely using Supabase (built on PostgreSQL) with the following protections:

• Encryption at rest and in transit (TLS 1.2+)
• Row-level security (RLS) ensuring organization-based data isolation
• Regular automated backups
• Access controls limiting data access to authorized personnel
• API keys and secrets stored as environment variables, never in source code

We retain your data for as long as your account is active or as needed to provide our services. When you delete your account, we will delete or anonymize your data within 90 days, except where retention is required by law.

You have the right to request deletion of your data at any time. You can:

• Delete individual contacts and conversations from within the TripleTick app
• Request full account deletion by contacting us at security@tripletick.ai
• Revoke Facebook/Meta permissions from your Facebook App Settings, which will trigger our data deletion process

For full details, see our Data Deletion Policy.

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Portability: Request your data in a machine-readable format
• Restriction: Request that we limit processing of your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at security@tripletick.ai. We will respond within 30 days.

TripleTick operates in compliance with Meta's WhatsApp Business Platform policies:

• We only send messages to contacts who have opted in to receive communications
• We respect the 24-hour messaging window for session messages
• We honor opt-out requests immediately and maintain an opt-out list
• We do not send spam or unsolicited bulk messages
• We provide clear opt-out mechanisms in all marketing messages

We use essential cookies for authentication and session management. We may use analytics tools to understand how our website and platform are used. We do not use third-party advertising cookies or tracking pixels.

TripleTick is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

Your data may be stored and processed in Australia, the United States, and Canada, and may otherwise be processed in countries other than your own. We ensure appropriate safeguards are in place for international data transfers, including standard contractual clauses where required.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of TripleTick after changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Entity: Future Condos Inc.
• Email: security@tripletick.ai
• Website: tripletick.ai