your data, your rules.

Andes USA Investment LLC, operating from Santiago, Chile, is the data controller for heysteff. Contact: [email protected].

Account data: name, email, company name, and billing information to operate your workspace.

Usage data: activity logs, performance metrics, and technical records to maintain and improve the service.

Your customers' data: messages, conversations, and contact information your customers send you through connected channels (WhatsApp, Instagram, Messenger, Gmail). We are processors of this data, not primary controllers.

OAuth access tokens: connection tokens for Meta (Facebook/Instagram), Google, and Shopify are stored encrypted in our database to operate channels on your behalf.

We use your data exclusively to: deliver and operate the service, process payments, send service communications (changes, incidents, invoices), and comply with legal obligations. We don't use customer data to train global AI models or share it with third parties beyond providers necessary to operate the service.

We use trusted providers to operate the service: cloud infrastructure (servers and database), payment processor (Whop), transactional email provider (Resend), and AI models (Anthropic, OpenAI). All have appropriate data processing agreements.

When you connect your Facebook Page or Instagram account to heysteff using Facebook Login, we receive and store the following data through Meta's official APIs (Graph API) and Meta webhooks:

What we receive (Platform Data):

• Direct messages and comments your customers send via Instagram DM, Facebook Messenger, and comments on your Page's posts.
• Conversation metadata: message IDs, timestamps, channel type, and the sending end-user identifier (PSID/IGSID).
• Basic information about the connected Page or account: name, ID, picture, and the permissions you granted us.

How we use this Platform Data: exclusively to deliver incoming messages into the unified inbox of the client that connected the account, allow their team to reply from within our app, and operate the optional AI assistant that the same client trained with their brand voice. Processing is per-tenant and isolated via Row Level Security at the database layer.

What we do NOT do with Platform Data: we do not sell, rent, or share it with third parties; we do not use it to build advertising audiences or marketing profiles; we do not use it to train global or third-party AI models; we do not combine it with data from other tenants.

Retention and deletion: messages are retained per the client's plan and deleted when the channel is disconnected or the workspace is deleted. To request immediate deletion of your Meta data processed by heysteff, visit heysteff.com/data-deletion.

When you install the heysteff Reviews app on your Shopify store, we access and store the following data through Shopify's official APIs (Admin API, App Proxy, and webhooks):

What we receive:

• Order and checkout data: order number, products, amounts, fulfillment status, and abandoned checkouts, to know who to ask for a review and when.
• Customer contact data: the name, email, and/or phone tied to the order, used only to send the review request over the relevant channel (WhatsApp, email).
• Review content: the rating, text, and any photos or videos your customer chooses to submit, along with the associated product.
• Basic store information: name, domain, plan, and owner email, to set up your account.
• Shopify access token: stored encrypted to operate the app on your behalf.

How we use this data: exclusively to request, collect, moderate, and display reviews on your store, and for the notifications and flows you configure. Processing is per-tenant and isolated via Row Level Security at the database layer.

Protected Customer Data: we handle your customers' personal data in line with Shopify's Protected Customer Data requirements: least-privilege access only, encryption at rest and in transit, and no selling or use for advertising or third-party model training.

What we do NOT do: we do not sell or rent your store or customer data; we do not use it to build advertising audiences; we do not use it to train global or third-party AI models; we do not combine it with data from other tenants.

Retention and deletion: data is retained per your plan and deleted when the app is uninstalled or the workspace is deleted. We automatically process Shopify's compliance webhooks (customers/redact, shop/redact, customers/data_request). For immediate deletion, visit heysteff.com/data-deletion.

We retain account data while it's active. Conversation messages are retained per your plan. Upon cancellation, you may request full export and deletion within 30 days. Billing data is retained as required by Chilean law.

You have the right to access, correct, port, and delete your data. To exercise these rights, email us at [email protected] or use the deletion option at /data-deletion. We respond within 30 days.

We use strictly necessary cookies for session and authentication. We don't use advertising tracking cookies or share behavioral data with ad platforms.

Channel credentials are stored encrypted with XChaCha20-Poly1305. The database uses Row Level Security (RLS) with strict per-tenant isolation. More details at /security.

For material changes, we'll notify you by email at least 15 days ahead. Questions: [email protected].