Privacy Policy

Listora is a multi-tenant SaaS platform for Israeli e-commerce merchants. This policy explains what data we collect, how we use it, how we share it, and how to request deletion. The Hebrew edition follows below.

1. Who controls the data

Platform owner: Listora. Privacy contact: pluschatgpt856@gmail.com.

2. What we collect

• Merchant account details (email address, store name, phone number).
• The store's own order and customer records, within the access the merchant granted.
• Access tokens for third-party platforms the merchant connected themselves (Shopify, Meta Business, Google and others), used only to operate those integrations.
• Operational logs (API requests, errors, timestamps).

3. Meta data use

When a merchant connects their Meta Business account via Facebook Login for Business, we receive a scoped access token used exclusively to display their ad accounts, create and manage campaigns, read performance data, and take actions the merchant explicitly initiates within our platform. We do not sell Meta data, do not share it with third parties, and do not use it for Listora's own marketing.

3a. WhatsApp Business Platform data use

Listora acts as a Meta Tech Provider on the WhatsApp Business Platform. The merchant remains the owner of their WhatsApp Business Account (WABA). With the permissions whatsapp_business_messaging and whatsapp_business_management we process the following on the merchant's behalf and at their explicit instruction:

• Data types: Phone numbers (the merchant's and their customers'), message content (text, media, templates), display names, conversation metadata (timestamps, delivery status), WABA IDs and Phone Number IDs.
• Purpose: Replying to customer inquiries on the merchant's behalf, sending merchant-initiated business messages (order confirmations, shipping and tracking updates), AI auto-reply when the merchant has enabled it, message-template lifecycle management, and WABA-level analytics.
• Retention and deletion: Messages are stored for up to 24 months from receipt, or until the merchant deletes the conversation, whichever comes first. Disconnecting the WABA from Listora triggers full deletion of message content and tokens within 30 days.
• Sub-processors: Cloudflare (D1/KV/R2 storage), Meta WhatsApp Cloud API, and an AI provider (OpenAI / Anthropic) only when the merchant has enabled AI auto-reply.
• We do not use WhatsApp data for our own commercial purposes and do not share it with third parties beyond what is required to operate the service. Listora complies with the WhatsApp Business Messaging Policy and the WhatsApp Business Solution Terms.

4. Storage and security

Data is stored on Cloudflare infrastructure (Workers KV, D1, R2) with encryption at rest and TLS in transit. Access tokens are stored encrypted.

5. Sharing with third parties

We do not sell information. We use infrastructure providers (Cloudflare, Sentry, Google Cloud) solely to operate the service. When a merchant enables an integration, only the data relevant to that integration is passed to it (for example Meta, Shopify).

6. Data deletion

Deletion can be requested at any time in two ways:

1. By email to pluschatgpt856@gmail.com. We handle the request within 30 days.
2. For Meta data: disconnecting the app from Meta's own settings screen triggers our Data Deletion Callback at https://listora-backend.ahava-shop.workers.dev/data-deletion. Meta tokens and derived data are deleted within 30 days.

7. Changes to this policy

Material updates are announced by email and inside the product 30 days in advance.

8. Your legal rights

For users in Israel, the European Union and the United Kingdom: rights of access, rectification, erasure and portability under the Israeli Protection of Privacy Law 5741-1981, the GDPR and the UK GDPR respectively. Contact pluschatgpt856@gmail.com.