Privacy Policy

Kudavo is a Shopify app that collects product reviews over WhatsApp. It is run by Gurmehub Bilişim Yazılım Limited Şirketi (“Gurmehub”, “we”), Görükle Mah. Üniversite-1 Cad. Ulutek Teknoloji Geliştirme Binası No: 933 İç Kapı No: B027, 16100 Nilüfer / Bursa, Türkiye. This policy explains what Kudavo collects, why, who receives it and how long it is kept. It covers the Kudavo app and this website.

Who is responsible for which data

Store data. For the details of the Shopify stores that install Kudavo (our merchants), we are the data controller.

Reviewer data. When a store’s customer leaves a review through Kudavo, the store decides to collect it and is the data controller. We process that data on the store’s behalf, as its processor, only to provide Kudavo. If you left a review for a store, that store is your first contact for questions about your data; you can also write to us.

What we collect from stores

• The store’s Shopify domain and name, and the account email Shopify shares with apps.
• The access token Shopify issues to Kudavo, the store’s plan and billing status.
• Settings the store enters, such as a coupon code and the WhatsApp message template it uses.
• If the store connects its own WhatsApp number: the WhatsApp Business Account ID, phone number ID, display number and verified name, plus the access token and PIN Meta issues. The token and PIN are stored encrypted.

What we collect from reviewers

• WhatsApp phone number of the person writing to the store’s number.
• What they send in the chat: the star rating, text, and any voice note, photo or video.
• A written transcript of voice notes.
• Order details from the store’s Shopify account used to confirm the purchase: order ID and number, customer ID, first name and the product reviewed. Kudavo looks for orders from the last 60 days that match the WhatsApp number.
• An opt-out record (the phone number and the store) if the person says they do not want review requests.
• WhatsApp message IDs, kept for seven days to avoid processing a message twice.

Kudavo does not use cookies, advertising identifiers or tracking inside WhatsApp, and it does not read any message that is not sent to the store’s review number.

What is published

Only reviews the store approves are shown on the store’s product pages. A published review can show the star rating, the text or transcript, the voice recording, a verified buyer badge with the order number, and a note when the reviewer received a discount. Photos and videos stay in the store’s Kudavo admin and are not published by Kudavo. Phone numbers are never published.

How we use the data

• To run the review conversation, confirm the purchase and record the review.
• To send the messages the store has set up, such as a review request after delivery, within WhatsApp’s rules.
• To transcribe voice notes and convert media into formats a browser can play.
• To show approved reviews and star ratings on the store.
• To bill the store through Shopify, provide support and keep the service secure.

We do not sell personal data, use it for advertising, or use reviews to train AI models.

Who receives the data

Recipient	What and why
Meta Platforms (WhatsApp Business Platform)	Messages to and from reviewers, and media downloads. Meta delivers the conversation.
Shopify	Order and customer lookups to confirm purchases; published ratings written to the store; billing.
Cloudflare (R2 storage)	Voice notes, photos and videos, stored privately. Voice notes are served to the store through short-lived signed links.
OpenAI (Whisper API)	The audio of voice notes, to produce the transcript. Under OpenAI’s API terms, this data is not used to train its models.
Sentry	Error reports from the app, to find and fix faults. Configured not to send personal data by default.

Some of these providers process data outside Türkiye and the European Economic Area, including in the United States. Where that happens we rely on the safeguards the law allows, such as standard contractual clauses. We share data with authorities only when the law requires it.

How long we keep it

• WhatsApp message IDs are deleted after seven days.
• Reviews, conversations, media and transcripts are kept while the store uses Kudavo, because they are the store’s review history.
• When a store uninstalls Kudavo, Shopify asks us to erase the store’s data about 48 hours later, and we delete everything for that store: reviews, media files, conversations, requests, opt-outs, its WhatsApp connection and the store record.
• When Shopify passes on a customer’s deletion request, we delete that person’s reviews, media, conversations and review requests. We keep only the opt-out record, if there is one, so the person is not contacted again.

Your rights

Depending on where you live, including under the GDPR and Türkiye’s KVKK (Law No. 6698), you can ask to access, correct or delete your data, object to its use or ask for a copy. Reviewers can make these requests to the store or to us; stores can write to us directly. Requests are answered within the period the law sets, at the latest within 30 days. You can also complain to your data protection authority; in Türkiye this is the Kişisel Verileri Koruma Kurumu.

To stop review requests at any time, choose the opt-out option in the WhatsApp chat.

Security

Data travels over encrypted connections. Media is kept in private storage, access tokens are encrypted, incoming WhatsApp messages are checked against Meta’s signature, and only staff who need access to support a store have it.

Children

Kudavo is a tool for businesses. It is not aimed at children, and we do not knowingly collect data from them.

Changes

When Kudavo changes what it collects or who receives it, we update this page and the date at the top.

Contact

Gurmehub Bilişim Yazılım Limited Şirketi, Görükle Mah. Üniversite-1 Cad. Ulutek Teknoloji Geliştirme Binası No: 933 İç Kapı No: B027, 16100 Nilüfer / Bursa, Türkiye. Email: [email protected].