Privacy policy

From visitors to informly.co: standard server logs (IP, user agent), anonymous analytics events (page views, referrer), and cookies you accept (see Cookie policy).

From customers who sign up: name, work email, company, billing details, integration credentials. Authentication via email or Google sign-in.

From end-customers (data our customers send us): contact identifiers (name, email, phone), survey responses, loyalty stamps, coupon redemptions, ticket content, and usage events from integrated systems.

To run the platform you signed up for; to send transactional product notifications; to bill, support, and improve the service; and to detect abuse or fraud. We do not sell personal data, ever. We do not train AI models on customer or end-customer data without explicit opt-in.

Performance of contract (delivering the service you signed up for), legitimate interests (security, fraud prevention, product improvement), legal obligation (tax, accounting), and consent (marketing where required).

We use vetted infrastructure providers — listed publicly on our Sub-processors page. We require equivalent data-protection terms from every sub-processor.

Stock photos.Photos our customers pick from Unsplash for their surveys are served straight from Unsplash (images.unsplash.com), so Unsplash, a third party, receives the IP address, browser details and image requests of anyone who views a page showing one. When a customer searches for photos in the image picker, our servers send the search words to Unsplash; we keep the photos a workspace chose (a link and the photographer's credit, never a copy) in its image library. Unsplash's handling of this data is covered by the Unsplash privacy policy.

Customer accounts are retained for the life of the contract plus 90 days. End-customer data — including data we receive through connected platforms such as Shopify and WhatsApp — is retained for the duration of the customer's subscription plus 90 days after cancellation, or until an earlier deletion or redaction request, whichever comes first. We delete or redact sooner when we receive a verified customer-deletion request (see "11. Shopify customer data" and "12. WhatsApp data").

Access, rectification, erasure, portability, restriction, objection, and the right to withdraw consent. Submit a request to privacy@informly.co — we respond within 30 days.

Personal data is hosted in the United States (Google Cloud, us-central1). Where personal data of individuals in the EEA or UK is transferred to the United States or to another sub-processor in a third country, we rely on the EU Standard Contractual Clauses (EU SCCs) and the UK International Data Transfer Addendum (UK IDTA), together with supplementary technical measures. Our current sub-processors and their regions are listed on the Sub-processors page.

See our Security page for the technical and organizational measures we have in place.

Material changes are announced via product email and an effective-date update at the top of this page at least 30 days before they take effect.

Privacy questions: privacy@informly.co. EU/UK representative on request.

When a merchant connects their Shopify store, Informly accesses protected customer data through Shopify's APIs. We request only the minimumfields we need to deliver the service the merchant configures: the customer's name and email (and the order context needed to time a request). We do not request customer phone numbers or addresses.

Why we use it.This data is used solely to send the surveys, feedback requests, and follow-ups the merchant sets up. We do not sell it, use it for advertising, or process it for any purpose beyond providing the app's functionality to that merchant.

Retention.Shopify customer data is retained for the duration of the merchant's subscription plus 90 days after cancellation or app uninstall, or until an earlier deletion request — whichever comes first.

Deletion + redaction.We honor Shopify's mandatory compliance webhooks — customers/data_request, customers/redact, and shop/redact — and action them within 30 days. A merchant or end-customer can also request access or deletion directly at privacy@informly.co. The same sub-processors and security measures described above apply to Shopify data.

When a customer connects a WhatsApp number through Meta's signup, Informly sends the WhatsApp messages that customer sets up through Meta's WhatsApp Business Platform.

What we receive. About the business: its WhatsApp Business account and phone number identifiers, display name, quality rating and messaging limits, its message templates and their review status, and an access token Meta issues to Informly, which we store encrypted.

About its customers: the WhatsApp phone number (and, where Meta provides one, a WhatsApp user ID), whether each message we send was delivered, read or failed, and opt-outs: a stop reply or a marketing-preference change. Replies are read only to detect an opt-out; we do not store their text.

From the WhatsApp Business app: if the business also uses its number in that app, Meta shares the app's contacts (names and phone numbers) with us when the number connects. We do not store the business's chat history or the messages it sends from the app.

Why we use it.Solely to send the messages the business sets up, to customers it has recorded WhatsApp consent for, and to honor opt-outs. We do not sell it, use it for advertising, or process it for any other purpose. Meta processes the messages as the business's WhatsApp provider; see the Sub-processors page.

Retention.As for other end-customer data (see "5. Retention"): the business's subscription plus 90 days, or until an earlier deletion request.

Disconnecting + deletion.A business disconnects WhatsApp in Informly under Settings → WhatsApp: we stop receiving the account's updates and delete our access token at once. To delete the WhatsApp data we hold, a business or one of its customers can email privacy@informly.co; we action requests within 30 days.

Informly Go is the companion app for staff of businesses that use Informly. Accounts are created by the business on informly.co; the app has no sign-up.

What we receive.The staff member's sign-in email (through Firebase Authentication); a device identifier generated by the app, with the device model, operating system and app version, to pair a phone or tablet with the business's workspace; and what the staff member or a customer enters: survey answers, loyalty scans, and updates to contacts, tickets and notes. Customer data the app shows or edits is the business's end-customer data described in "1. Data we collect".

Camera. Used only to scan loyalty pass codes on the device. We do not store or upload images.

On the device. Kiosk answers are kept on the device until they sync to Informly, then removed. The data is encrypted in transit.

Deletion. The business removes a staff member or device in Informly. A staff member or customer can email privacy@informly.co to request deletion; we act on requests within 30 days.