by IT BRAIN

Privacy policy

Last updated October 28, 2026

iSmart Reach is a Shopify app made by IT BRAIN ("we"). It sends order messages to a store's customers by WhatsApp and, where set up, SMS. This policy explains what data the app handles, why, and for how long. The store using the app ("merchant") decides which messages are sent; for customer data we act on the merchant's behalf as a data processor.

Data we handle

About merchants: store domain and name, timezone, currency, app settings, Shopify plan, the Shopify access token the app needs to work, and the WhatsApp Business account ID, phone number ID, display number and access token created when the merchant connects WhatsApp, and, if the merchant adds them, the merchant's courier API login for TCS, Trax or PostEx. Tokens and courier logins are stored encrypted.

About the store's customers: first name, phone number and country, order number and total, order and fulfillment status, tracking details, preferred language, marketing consent (for abandoned checkout messages and the merchant's campaigns), the product page link for review requests, the messages sent and their delivery status, Confirm or Cancel replies, and STOP requests. We do not collect payment card data, email content or browsing data.

Why we use it

To send the order messages the merchant switched on, in the customer's language, including a review request after delivery.
To send the merchant's marketing campaigns, only to customers who agreed to SMS or WhatsApp marketing in the merchant's Shopify store.
To act on the customer's reply: tag the order, or cancel it if the customer asks and the merchant allows it.
To stop messages to customers who reply STOP.
To show the merchant a message history, and to count messages for the merchant's plan and billing.
To keep the service secure and fix problems.

We never sell data, use it for advertising, or message customers for our own purposes.

Who we share it with

Shopify, the platform the app runs on, including billing.
Meta (WhatsApp Business Platform), which delivers WhatsApp messages from the merchant's own WhatsApp Business account.
SMS provider, only when the merchant turns on SMS backup.
The merchant's courier (TCS, Trax or PostEx), only when the merchant adds its courier login: we send the parcel's tracking number to read its delivery status.
Vercel (hosting) and Neon (database), which store and process data for us in the United States.

These providers may process data outside the customer's country. We use providers that protect data under their published security and data processing terms.

Requests from public authorities

If a government or other public authority asks us for data, we check that the request is lawful and valid, challenge requests that are not, share only the minimum data the request legally requires, and keep a record of each request and our response.

How long we keep it

Message history, COD confirmation and parcel tracking records: 90 days, then deleted automatically.
STOP requests: kept while the merchant uses the app, so we keep honouring them.
All of a store's data: deleted within 48 hours after Shopify tells us the merchant uninstalled the app (Shopify's shop data deletion request).
A customer's data: deleted when Shopify sends us that customer's data deletion request.

Security

Data is sent over HTTPS and stored in an access-controlled database that is encrypted at rest. WhatsApp access tokens are also encrypted by the app with AES-256. Only IT BRAIN staff who need it for support can access the app's systems.

Your rights

Customers: to see, correct or delete your data, contact the store you ordered from. The store can request it through Shopify, and we act on those requests. You can also reply STOP to any message to stop receiving messages from that store, or email us. Merchants: contact us at any time about your data.

Contact

IT BRAIN, Pakistan · support@itbrain.com.pk

We will post any changes to this policy on this page.