Privacy Policy

1. Who we are, and what this policy covers

Salaf LLC operates Shopdesk: store management software for businesses, together with a shared support inbox those businesses use to answer messages from their customers. In this policy we call those businesses merchants.

This policy covers the personal data we process when you message a Facebook Page a merchant has connected to Shopdesk, or the Instagram professional account linked to that Page, or a WhatsApp Business number a merchant has connected, or when you use the live-chat widget on an online store we host for a merchant. On WhatsApp it also covers a chat the merchant starts with you from that number (§3B).

It is not a merchant’s own shop policy. What a merchant does with your order, your delivery address or its own marketing is covered by that merchant’s privacy policy, which it publishes itself. This document is about the messaging layer between you and them.

2. Our role: a Tech Provider acting for the merchant

Meta’s Platform Terms describe a company in our position as a Tech Provider. We supply the software that carries a conversation; the merchant you chose to message is the party that decides what to do with it.

We process the data described below on behalf of that merchant, to deliver the service they asked us for. We do not use your messages for our own purposes beyond operating, securing and supporting the platform, and we do not combine what you said to one merchant with what you said to another.

Exactly which legal label applies to each of us — controller, processor, or the local equivalent — depends on the merchant and where they operate, so we do not claim one here. The practical arrangement is the one described above, and it is what we will describe to any authority that asks.

3. What we process — Facebook Messenger

When you message a Facebook Page a merchant has connected, Meta sends us the following, and we store it:

• Your Page-scoped ID (PSID). An identifier Meta issues that is unique to you and that Page. It is not your Facebook account ID, it does not work on any other Page, and it is not something we can look you up with anywhere else.
• The text of the messages in the thread — yours and the merchant’s replies.
• Images and files you send. We download them from Meta and keep our own copy, because the links Meta issues expire and a merchant who reopens a thread a week later would otherwise see nothing. We do not store Meta’s own URL for the file.
• The name and profile picture Meta returns for you, used to label the thread so the merchant knows who they are answering. The picture is stored as the link Meta gives us, not copied.

We do not receive your email address, your phone number, your friends or anything else from your Facebook profile, and we do not ask Meta for them.

3A. What we process — Instagram

A merchant can also connect the Instagram professional account that is linked to its Facebook Page. When you send that account a direct message, Meta sends us the following, and we store it:

• Your Instagram-scoped ID (IGSID). The identifier Meta uses for you in Instagram messages. It is not your username. We use it to keep your messages in one thread, to look up the profile details below, and to deliver the merchant’s replies back to you.
• The text of the messages in the thread — yours and the merchant’s replies, including replies the merchant sends from the Instagram app itself rather than from Shopdesk, when Meta passes those on to us.
• Photos, videos, voice messages and files you send. As on Messenger, we download them and keep our own copy, and we do not keep Instagram’s own link to the file.
• Your name, your username, your profile picture, and whether you follow the merchant’s account, as Meta returns them when we ask — used to label the thread and to show the merchant whether you follow them. If you have not set a name, the thread is labelled with your username. The picture is stored as the link Meta gives us, not copied; those links expire after a few days, so while the conversation is active we ask for it again, at most once every two days.

Those are the only profile details we ask Meta for. We do not ask for your email address, your phone number, your followers, the accounts you follow, or anything you have posted.

Stories, shared posts and disappearing photos — shown, never copied

• Stories. When you reply to the merchant’s story, mention the merchant in your own story, or share a story with them, we keep the link Instagram sends so the merchant can see the story in the chat. We never download or store the story’s picture or video. Stories expire, and once Instagram’s link stops working the chat simply says the story is no longer available.
• Posts and reels you share. We keep a link to the post on instagram.com, and its title if Instagram sends one — never the post itself. If what Instagram sends is not a link to the post on instagram.com, we drop the link and keep only a note that a post or reel was shared, with its title if there is one.
• Disappearing photos and videos. Instagram sends us no copy and no link, so all we record is that one was sent.
• Anything we do not recognise. Something Instagram marks as unsupported, or an attachment of a type we have not mapped, is recorded only as an “unsupported message”. It is never downloaded, and its link is not kept.

Unsent messages are deleted here too

If you unsend a message on Instagram, Meta tells us and we delete it on our side as well: its text, any file we stored from it, and any trace of it in the merchant’s conversation list or in a saved AI summary of the chat. The merchant can no longer read it in Shopdesk. What stays is a line in the thread saying that a message was unsent, together with the time it was first sent and Instagram’s reference number for it — which is how we recognise the message if Meta sends it to us again. The words themselves do not stay. If a stored file cannot be deleted straight away, nothing in the inbox links to it any more, and it is deleted with the conversation under §8. A copy can also remain for a while in a failed work-queue job, as described under “How long it is kept” below.

If the notice that a message was unsent reaches us before the message itself, we normally never write the message into the inbox at all — only the line saying it was unsent. In rare cases that fails: when the notice arrives more than a day and a half before the message, or when the part of our system that remembers these notices is briefly unavailable. The message is then stored like any other, and is deleted on the schedule in §8, or sooner if you ask under §10.

If Meta tells us that the merchant unsent one of its own messages in the Instagram app, we do the same, as long as we can match the notice to the message we stored. One case we cannot always match: a reply sent from Shopdesk can go to Instagram as more than one message — a long text, or text with a photo — and if the merchant unsends one of the earlier parts more than 15 minutes after sending it, the reply stays in Shopdesk.

All of this still happens for a conversation the merchant kept after disconnecting Instagram, whenever Meta sends us the notice.

The AI assistants

If a merchant uses the optional AI assistants described in §7 on an Instagram chat, the same limits apply, with Instagram’s details added: your username and your Instagram-scoped ID are not sent, and no story is sent — not even its link. A post or reel you shared is sent as its title and instagram.com link, the way a link typed into the chat would be. A message that was unsent is sent only as the words “message unsent”.

The merchant’s Instagram account, and disconnecting it

When a merchant connects Instagram, we record the account’s ID, its username and a link to its profile picture, so the inbox can show which account a chat came in on. If Shopdesk creates a sales channel for the account, the channel’s name includes the account’s username, for example “Instagram DMs (@yourshop)”. Instagram runs on the same Facebook Page connection as Messenger, whose credentials are encrypted at rest (§11).

A merchant can disconnect Instagram at any time from its Shopdesk integration settings, with Disconnect Instagram. From then on, new Instagram messages no longer reach that merchant’s Shopdesk inbox and replies to Instagram chats are switched off, while Messenger keeps working. The account’s username and picture link are removed from the connection. A sales channel Shopdesk created for the account keeps its name, which includes the account’s username. The conversations already received stay in the inbox, read-only, and are still deleted on the schedule in §8. The account’s ID stays recorded against them, so they stay attached to the right chats and a message unsent later can still be found and removed.

Disconnecting Messenger disconnects Instagram with it, and also asks Meta to stop sending us that Page’s messages. After that we cannot count on hearing about a message you unsend; the 180-day deletion in §8 and a request under §10 still apply.

How long it is kept

Instagram conversations follow the same rules as every other conversation in §8: they are deleted automatically 180 days after the last message, whether or not the merchant marked them resolved. The channel identity record described at the end of §8 exists on Instagram too. It is written when your chat is linked to a customer record at that shop — for example because the merchant created an order for you from the chat — and it holds your Instagram-scoped ID and the name or username shown for you on Instagram.

On the way in, messages from Instagram — and from Messenger, which uses the same route — pass through a short-lived work queue. A job that completes is removed from the queue straight away. A job that fails is kept so we can find out why: failed jobs become due for removal once they are a day old and are cleared when a later message job fails, and the queue never holds more than its 500 most recent failures. Because that clean-up runs when a later job fails rather than on a clock, we do not promise an exact hour. No merchant can see this queue.

3B. What we process — WhatsApp

A merchant can also connect its own WhatsApp Business account to Shopdesk. The conversation is between you and the merchant, on the merchant’s own WhatsApp Business account and phone number; we provide the software its team uses to read and answer it, in the role described in §2. When you message a WhatsApp number a merchant has connected, or the merchant messages you from it, Meta sends us the following, and we store it:

• Your WhatsApp user ID. An identifier WhatsApp issues for you that is specific to that business. It is not your phone number. We use it to keep your messages in one thread, and to deliver the merchant’s replies when WhatsApp has not shared your number. If WhatsApp replaces it — for example because you changed your number — Meta normally tells us, and we move your thread to the new ID.
• Your phone number, when WhatsApp shares it with the business, and your WhatsApp username, if you have set one and WhatsApp sends it. The merchant sees your number beside your name in the inbox; if WhatsApp does not share your number, it sees your username in its place.
• Your WhatsApp profile name, when Meta sends it, used to label the thread so the merchant knows who they are answering.
• The text of the messages in the thread — yours and the merchant’s replies, including replies the merchant sends from its WhatsApp Business app rather than from Shopdesk (see below).
• Photos, videos, voice messages, stickers and files you send. As on Messenger and Instagram, we download them and keep our own copy, and we do not keep WhatsApp’s own link to the file. A file larger than we accept is not downloaded; the chat shows only that one was sent. Photos and files the merchant sends from its WhatsApp Business app are copied the same way, when WhatsApp passes them on to us.
• Other things you send in the chat: a location you share, kept as a map link to that place; a contact card, kept as its text; and a cart you send from the merchant’s WhatsApp catalog, with its items, quantities and prices.
• The delivery status of the merchant’s messages to you — whether each was sent, delivered and read, or could not be delivered — as WhatsApp reports it.

Those are the only details about you we keep from your messages. We do not ask Meta for your profile picture, your status, your contacts or anything else from your WhatsApp account, and group chats never reach Shopdesk. WhatsApp also sends us reactions, and details of an ad you tapped to start the chat; we do not store either. If you edit a message after sending it, the edit is not applied in Shopdesk: the version we first received stays.

WhatsApp and Meta handle your messages on their side under their own terms and their own privacy policy, which this policy does not replace — see WhatsApp’s Privacy Policy.

Replies and chats from the merchant’s WhatsApp Business app

A merchant can keep using the WhatsApp Business app on the same number after connecting it to Shopdesk. When it does:

• replies the merchant sends from the app — on its phone, or on a computer linked to it — are copied into Shopdesk when WhatsApp passes them on to us, and shown in the same thread as the rest of the conversation;
• a chat the merchant starts with you from the app appears in Shopdesk too, even if you never wrote to the merchant first;
• every member of the merchant’s staff who holds its support permission (§11) can read these chats, as they can every other chat in the inbox — including a chat on that number that has nothing to do with the shop.

We do not copy in any messages from before the merchant connected WhatsApp to Shopdesk. Those stay in WhatsApp and never reach us.

Messages deleted for everyone

If you delete a message for everyone in WhatsApp, Meta tells us and we delete it on our side as well, in the same way as an unsent Instagram message, described above: its text and any file we stored from it are deleted, and in its place a line stays saying that a message was deleted, together with the time it was first sent and WhatsApp’s reference number for it, but not its words. The same happens when the merchant deletes one of its own messages for everyone from the WhatsApp Business app. Deleting a message only for yourself, or deleting a chat on your own phone, does not reach us and removes nothing from Shopdesk. This works only while the merchant has WhatsApp connected to Shopdesk: after it disconnects, we no longer receive these notices, and the 180-day deletion in §8 and a request under §10 still apply.

The AI assistants

If a merchant uses the optional AI assistants described in §7 on a WhatsApp chat — including one it started from the WhatsApp Business app — the same rules and limits apply: nothing is sent unless a member of staff asks for it, a draft is never sent to you automatically, and your phone number, your username and your WhatsApp user ID are not sent as details of the chat. What is written in the messages themselves can be sent, including a number you typed or the details in a contact card, location or cart you shared.

The merchant’s WhatsApp account, and disconnecting it

When a merchant connects WhatsApp, we record the IDs WhatsApp uses for its account and its phone number, the number itself and the business name on it, so the inbox can show which number a chat came in on. We also store the credentials that let Shopdesk receive and send messages for that number: Meta’s access token and, for a number first registered through Shopdesk, its security PIN. They are encrypted at rest (§11) and never shown back to anyone in full.

A merchant can disconnect WhatsApp at any time from its Shopdesk integration settings. From then on, new WhatsApp messages no longer reach that merchant’s Shopdesk inbox and replies to WhatsApp chats from Shopdesk are switched off, while Messenger and Instagram keep working. The stored credentials are deleted. The account and number IDs, the number itself and the business name on it stay recorded, so the conversations already received stay attached to the right chats; those conversations stay in the inbox, read-only, and are still deleted on the schedule in §8. Disconnecting in Shopdesk deletes nothing inside WhatsApp itself.

How long it is kept

WhatsApp conversations follow the same rules as every other conversation in §8: they are deleted automatically 180 days after the last message, whether or not the merchant marked them resolved. A reply the merchant sends from its WhatsApp Business app counts as a message in the thread. On the way in, WhatsApp messages pass through the same short-lived work queue as Instagram and Messenger messages, with the same clean-up, described under “How long it is kept” in §3A.

The channel identity record described at the end of §8 exists on WhatsApp too, and it holds your WhatsApp user ID and the name shown for you on WhatsApp. It is written when your chat is linked to a customer record at that shop, and on WhatsApp that can happen automatically: if your phone number matches a customer record there, the chat is linked to it, so the merchant can see your orders while answering you.

4. What we process — the store chat widget

When you open the chat widget on a store we host, we store the following about that conversation:

• A visitor ID we generate for your browser, so the same thread is still there after you reload the page.
• The text of your messages and the merchant’s replies.
• Images you upload — only when the person handling your chat has switched uploads on for that conversation. Uploads are off by default, and switching them on is a deliberate act by a member of the merchant’s staff.
• Which page of the shop you were on when you wrote, so the agent can see what you are asking about.
• Your IP address, and an approximate city looked up from it. The location is city-level only — it is derived from the address, never from your device’s GPS, and we neither ask for nor receive precise location.
• A short browser and operating-system label, for example “Chrome on macOS (Desktop)”. The raw User-Agent header your browser sends is discarded when the request is handled; only that short label is written down.

The last three exist to answer two questions a merchant cannot answer from the words in the message: whether two anonymous chats are the same person, and which browser a broken checkout is breaking on. We keep them deliberately coarse for that reason — a city and a browser name answer both questions, and neither is a fingerprint.

5. What you tell us yourself

The chat widget may ask for your name and mobile number before you start a conversation. Both are optional, and we use what you give us to label the thread and, where the number matches an existing customer record at that shop, to show the merchant your order history alongside the chat.

If you are signed in to the merchant’s shop when you open the chat, the name and email address on that account are attached to the conversation, so the person answering knows who they are talking to without asking you to repeat it.

6. Why we process it

• To deliver your message to the merchant you sent it to.
• To let that merchant reply to you, and to show them the thread.
• To link the conversation to an existing customer record at that shop, where there is one, so the merchant can see your orders while answering you.
• To keep the service working and to prevent abuse — rate limits, spam filters and the caps that stop one visitor flooding a merchant’s inbox.
• To meet our own legal obligations, and Meta’s platform rules, where they apply to us.

7. Who it is shared with

Only the merchant whose Page, Instagram account, WhatsApp number or store you messaged, and that merchant’s authorised staff. Every conversation is stored against exactly one merchant’s store and is only reachable through that store — a merchant cannot see, search or export another merchant’s inbox, and there is no view anywhere in the product that spans two of them.

Behind that, we use service providers in the following categories:

• Cloud hosting — the servers and database the platform runs on.
• Object storage — where images and files sent in a conversation are kept.
• Meta, as the transport for Messenger, Instagram and WhatsApp conversations. Your message reaches us through Meta, and our reply goes back the same way.
• An IP geolocation lookup, used only for the approximate city in §4. It receives the IP address and nothing else — no message, no name, no identifier of any kind.
• An AI provider, and only when a member of the merchant’s staff asks for it. The inbox has two optional assistants — one summarises a chat, one drafts a reply for the agent to edit — and pressing either sends the recent messages in that one thread to a third-party model provider. Neither runs on its own: nothing is sent unless a person clicks, and a merchant who never uses them never has a conversation leave our systems this way.
  What is sent is the conversation text and, for the summary only, three totals about the linked customer’s orders — how many, how much, and the date of the last one. What is not sent: your name, your phone number, your email address, your Page-scoped ID, any order number, and any image from the chat — a photo you sent is referred to by its file name and never uploaded to the model. The draft a model writes is never delivered to you automatically: a member of staff reads it, edits it and sends it.
  Because these two features are the only ones in the product that put a customer’s own words in front of a model, they will only run on an account whose provider terms a Shopdesk administrator has explicitly accepted for handling customer data. Where a merchant brings their own AI account, the terms between that merchant and their provider are the ones that govern it.

We do not sell your data. We do not share it with data brokers, we do not use it for advertising or ad targeting, and we do not build a profile of you across merchants. Merchants are contractually forbidden from doing any of those things with what we hand them — see §5 of our Terms of Service.

8. How long we keep it

180 days from the last message in a conversation. After that the conversation, every message in it, and every image stored from it are deleted automatically. Nobody has to ask, and no one at the merchant can extend it.

The clock runs from the newest message in the thread, not from when it opened — so a conversation you have been going back and forth on for a year is not deleted mid-sentence, and a thread nobody has touched since last winter is.

A conversation is deleted on that schedule whether or not the merchant marked it resolved. Marking a chat resolved is a button in the merchant’s inbox; it is not a statement about you, and leaving it unpressed does not keep your messages alive any longer.

One thing outlasts the conversation, and we would rather say so here than have you find it later. If your messaging ID was ever matched to a customer record at that shop — because the phone number you gave matched an order, because you were signed in, or, on WhatsApp, because the number WhatsApp shared matched one — we keep a small record of that match: the ID, the name shown on your profile for that channel, and which customer record it points at. It holds no message and no image. It is part of the merchant’s own customer record rather than part of the chat, so it is not deleted on the 180-day schedule and it is what would re-attach a future message of yours to the same customer. It is deleted when you ask us to delete your data — see Data Deletion Instructions.

9. Server logs

Separately from the conversation itself, our web servers write an ordinary access-log line for every request they handle, including requests made by the chat widget. That line records the IP address the request came from and a short description of the browser. It is operational plumbing — it is how we find out that something is broken — and it is not part of the inbox: no merchant can read it, it is never used to build a profile, and it holds no message content.

We are not going to state a number of days here, because those files are rotated by size rather than on a schedule: each container keeps a fixed number of recent log files and discards the oldest as new ones fill up. How long a given line survives therefore depends on traffic, and a number in this paragraph would be a promise nothing enforces.

10. Deleting your data

You do not have to wait for the 180 days. You can ask us to delete what we hold about your chats with a business at any time, and we will act on it within 30 days of verifying the request. Because each merchant’s data is stored separately, we need to know which business you messaged in order to find it.

The full instructions, including exactly what gets deleted and what does not, are on the Data Deletion Instructions page.

11. Security

• Traffic between your browser, our servers and Meta is carried over TLS.
• The credentials that connect a merchant’s Facebook Page, or its WhatsApp Business account, to the platform are encrypted at rest, and are never shown back to anyone in full. A merchant’s WhatsApp credentials are deleted when it disconnects WhatsApp.
• A conversation is readable only by staff of the merchant it belongs to, and only by those of them who hold the support permission that merchant granted them.

12. Children

Shopdesk is a tool for businesses and is not directed at children under 13. We do not knowingly collect personal data from them. If you believe a child has sent us a message through a merchant’s Page, Instagram account, WhatsApp number or chat widget, contact us at the address in §15 and we will delete it.

13. Where data is processed

Your data is held on infrastructure operated by Salaf LLC and its cloud providers, and may be processed in a country other than the one you are in. Where we transfer data across a border, we do it only to the providers described in §7, and only for the purposes described in §6.

14. Changes to this policy

When this policy changes we replace this page and update the Last updated date at the top — that date is the marker, so it is the thing to check. If a change materially affects what we collect or who we share it with, we will also tell the merchants using the platform so they can tell you.

15. Contact

Write to support@shopdeskbd.com and tell us what you need. If your question is about an order, a delivery or a refund, the merchant you bought from can answer it faster than we can — they hold that record, not us.

By post: Salaf LLC, 525 Randall Ave 401, Cheyenne, WY 82001, United States.