Privacy Policy

This Privacy Policy explains how Yogardens Agritech Private Limited("Shopap", "we", "us") collects, uses and protects information when providing the Shopap service — a platform that handles business conversations on WhatsApp, runs online stores for businesses, and gives each business and its team a console on the web and in the Shopap mobile app. We have written it in plain language.

Roles: who is responsible for your data

The Customer is the Data Controller. The business using Shopap — a distributor, retailer, pharmacy, brokerage, clinic or other business — decides which customers and partners to serve, what data to maintain, and how information processed through the service is used in their business.

Shopap is the Data Processor.We process data only on the Customer's behalf and only to provide the service described below.

In this policy, "Customer" means the business that subscribes to Shopap. "You" may be that business, a member of its team (including suppliers and delivery staff it invites), or a person who messages it or buys from its online store.

Information we process

Conversations and business records

• WhatsApp message content sent to the Customer's business number, including text, voice notes (and their transcriptions), images, documents and shared locations
• Phone numbers of customers, retailers, prospects, patients and Customer staff
• Order, booking, delivery, payment and transaction records
• Lead and prospect information collected during qualification — names, contact numbers, and stated requirements such as budget, preferred location and timeline
• Appointment scheduling details — names, contact numbers and visit timing
• Customer and contact information maintained by the Customer (names, businesses, addresses, agreed pricing)
• Customer business information (business details, catalogue, product data, inventory levels, pricing, knowledge content, ledger and dues records where those features are used)

Online stores run on Shopap

• Your phone number, used to sign you in with a one-time code sent on WhatsApp
• Delivery addresses you save, including the map location you choose
• Your cart, orders, order updates and payment status
• Documents you upload with an order, such as a prescription (see below)

Console and mobile app users

• Your name, phone number, email address, role and the business accounts you belong to
• Your activity in the console, such as orders you update or messages you send, recorded in the business's activity history
• Files you choose to attach, such as payment proofs or delivery photos
• Device and notification data, described below

Prescriptions and health documents

Some businesses on Shopap, such as pharmacies and medicine delivery services, let customers upload a prescription with an order. We treat these documents with extra care:

• A prescription is uploaded by you, to the business you are ordering from, and is used only to prepare and fulfil that order.
• AI may read the document to suggest the items on your order. A person at the business always reviews it before the order goes ahead.
• It is shown only to the business's staff and, where the business uses partner pharmacies to fulfil orders, to the pharmacy fulfilling your order.
• It is kept for as long as the business needs it to meet its legal record-keeping duties, and is never used for marketing or any other purpose.

Location

When you choose a delivery address on a map, we use that location to check whether the business delivers to you, calculate the delivery fee and guide delivery staff. Address search and maps are provided by Google Maps Platform. We use a location only when you choose or share it. The Shopap app does not track your location in the background.

Mobile app and notifications

The Shopap console is available on the web and as a mobile app for Android and iPhone. To send you alerts — for example a new order, a quote request or an assigned delivery — we keep:

• A notification token for your device (issued by Google or Apple, or by your browser for web notifications), your device platform and app version
• Which business accounts the device should receive alerts for
• Your notification settings

This data is used only to deliver alerts. App notifications are delivered through Firebase Cloud Messaging (Google) and the Apple Push Notification service; web notifications through your browser's push service. A token is removed when you sign out, when the device stops accepting it, or when your account is deleted.

The app accesses your camera, photos or files only when you choose to attach something. It does not read your contacts and does not show advertising.

How messages are delivered

WhatsApp messages are delivered through the Meta WhatsApp Business Platform. When you communicate over WhatsApp, Meta processes those messages in accordance with its own terms and privacy policies. Shopapreceives message content addressed to the Customer's business number in order to provide the service.

AI processing disclosure

Shopapuses third-party AI providers to understand messages, images and documents, to draft replies grounded in the business's own catalogue and knowledge content, and to prepare records such as orders, leads and appointments. Specifically:

• AI providers we may use include: Anthropic (Claude), OpenAI, Google (Gemini).
• Content is shared with these providers only to provide the service— understanding what was asked, answering it from the business's information, and preparing the record.
• A business's catalogue and knowledge content is indexed for search with an embeddings provider (Voyage AI), so answers come from that business's own information.
• Content processed through Shopap is not used to train AI models.
• Businesses can review what the AI did, and important actions — such as prescription orders — always pass a human review step.

Purpose and legal basis

We process personal data under India's Digital Personal Data Protection Act, 2023 (DPDP Act), on the basis of the Customer's instructions and consent obtained by the Customer from its customers, retailers or prospects in the course of their existing business relationship. We process data for these purposes only:

• Answering messages and turning them into structured records
• Matching products, applying pricing and validating inventory
• Running the Customer's online store, orders and deliveries
• Qualifying inbound leads and recording stated requirements
• Booking, rescheduling and reminding about appointments
• Sending confirmations, reminders, order updates and alerts to the Customer's team
• Preparing structured data for export to the Customer's tools
• Providing support and maintaining service reliability

Data retention

• Records are retained for as long as the Customer's account is active, so the Customer can access their own history.
• If a subscription ends, Customer data is deleted or anonymised within 90 days, except where law requires longer retention.
• Notification tokens are removed on sign-out or when no longer valid.
• Deletion requests are handled as described under Data Deletion below.

Security and where data is processed

• Data is encrypted in transit (TLS).
• Our application, databases and search run in India (AWS Mumbai region).
• Some subprocessors listed below — such as AI providers, file storage and notification services — may process data outside India, only as needed to provide the service.
• Each business's data is kept separate, and team members see only what their role allows.
• Access to production data is restricted to authorised personnel and protected by access controls.

Subprocessors

We use the following subprocessors to provide the service:

• Meta Platforms (WhatsApp Business Platform) — Message delivery between the Customer's business and its customers and contacts
• Amazon Web Services (AWS) — Application hosting, databases and search (Mumbai region, India)
• Cloudflare — DNS, network protection, and storage of uploaded files and media (Cloudflare R2)
• Anthropic (Claude) — AI processing of messages, images and documents to understand requests, draft replies and prepare records
• Google (Gemini) — AI processing of messages, images and documents to understand requests, draft replies and prepare records
• OpenAI — AI processing of messages, images and documents to understand requests, draft replies and prepare records
• Voyage AI — Search indexing (embeddings) of a business's catalogue and knowledge content
• Google Maps Platform — Address search, map location and delivery distance
• Google Firebase Cloud Messaging — Delivering notifications to the Shopap mobile app on Android and iPhone
• Apple Push Notification service — Delivering notifications to the Shopap mobile app on iPhone

Cookies and analytics

This website uses Google Analytics, deployed via Google Tag Manager, to understand aggregate website usage — such as pages visited and general interaction patterns. This involves cookies set by Google and the transfer of usage data (including device and browser information) to Google. Analytics data is not combined with any data processed through the Shopap service.

The Shopapconsole, mobile app and online stores use only the cookies and local storage needed to keep you signed in and remember your settings. We do not use advertising cookies or third-party advertising trackers. You can limit analytics collection through your browser settings or tools such as Google's opt-out browser add-on.

Children

The Shopap console and app are for businesses and their teams, and are not intended for anyone under 18. Online stores on Shopap are run by the businesses that own them.

Your rights

Individuals whose data is processed through Shopap — such as your customers, prospects or staff — may request access to, correction of, or deletion of their personal data. Because the Customer is the Data Controller, requests may be made either to the business you dealt with or directly to us at hello@shopap.tech — we will coordinate with the relevant Customer.

Data Deletion

Deleting a Shopap login (business owners, team members, suppliers and delivery staff): follow the steps on our account deletion page.

Deleting other personal data (for example as a customer of a business on Shopap):

• Email hello@shopap.tech with the subject line "Data Deletion Request", including the phone number the request relates to and, if you can, the name of the business or store.
• We will acknowledge your request within 7 days.
• Verified deletion requests are completed within 30 days, except where we or the business are legally required to retain specific records (for example, tax, accounting or prescription records).

Changes to this policy

If we make material changes to this policy, we will update this page and revise the "Last updated" date. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

Governing law, grievances and contact

This policy is governed by the laws of India. For any questions or grievances about this policy or our data practices, contact us below; we respond to grievances within 7 days.

Yogardens Agritech Private Limited
1117, 1st Cross, AECS Layout A Block, Near Ramya Garments, Opp. Singasandra Lake Gate, Singasandra, Bengaluru, Karnataka 560068, India
hello@shopap.tech
+91 93536 64752