This Privacy Policy governs the collection, processing, and protection of personal data across the Shoboti platform (shoboti.com), creator storefronts, checkout systems, and associated social commerce automations on Instagram and WhatsApp.
Shoboti ("we", "our", or "us") operates a creator-first e-commerce infrastructure that empowers social media creators to publish curated storefronts, showcase shoppable Reels, and deliver conversational checkout experiences via Instagram and WhatsApp.
Depending on your interaction with the platform, our legal role under applicable data protection laws is as follows:
We collect only the minimum personal data required to operate a secure commerce ecosystem:
sessionId), and application error traces.Under European GDPR (Article 6) and the Indian Digital Personal Data Protection Act, 2023, every data processing activity is backed by an explicit legal ground:
| Processing Purpose | Data Categories | Lawful Basis |
|---|---|---|
| Order fulfillment, checkout, courier delivery & tracking | Name, address, phone, email, order payload | Performance of Contract (GDPR Art. 6(1)(b) / DPDPA Sec. 7(b)) |
| Automated Instagram comment-to-DM responses & purchase links | IGSID, comment text, DM content | User Request & Consent (GDPR Art. 6(1)(a) / DPDPA Sec. 6) |
| Tax compliance, invoicing, statutory accounting & dispute audit | Billing records, GSTIN, payment receipts, order ledgers | Legal Obligation (GDPR Art. 6(1)(c) / Indian Tax & GST Statutes) |
| Platform security, rate-limiting, fraud & chargeback prevention | Hashed IP, session tokens, audit events | Legitimate Interests (GDPR Art. 6(1)(f)) |
| Abandoned cart reminders via WhatsApp | Cart items, phone number, consent snapshot | Explicit Consent with One-Click Opt-Out (GDPR Art. 6(1)(a)) |
In accordance with the Meta Platform Terms and Developer Policies:
instagram_basic, instagram_manage_messages, and pages_show_list) solely to enable creator storefront synchronization and authorized conversational commerce.Shoboti utilizes enterprise AI models (Google Gemini via Google Cloud and Groq LLM inference) to power store shopping assistants, product sizing advice, and Reel visual frame analysis.
We partner with vetted infrastructure providers who comply with GDPR Data Processing Addendums (DPAs), SOC 2 Type II standards, and ISO 27001 certifications:
| Service Provider | Core Function | Data Processed | Location |
|---|---|---|---|
| Supabase Inc. | Database, auth, connection pooling | All platform database records, encrypted tokens | AWS Cloud (Global/India) |
| Vercel Inc. | Web application hosting, edge CDN | Web request traffic, transient edge logs | United States / Global Edge |
| Cloudflare Inc. | R2 Media Storage, image optimization | Product photos, Reel video frames | Global distributed CDN |
| Meta Platforms, Inc. | Instagram Graph API & Webhooks | IGSIDs, public comments, Instagram DMs | United States / Global |
| Razorpay Software Pvt. Ltd. | Payment gateway & creator payouts | Transaction amounts, payment IDs, bank metadata | India |
| Cashfree Payments India | Alternative payment processing & UPI | Payment IDs, checkout verification | India |
| Shiprocket (Bigfoot Retail) | Courier shipping aggregation | Recipient name, shipping address, phone number | India |
| Google LLC (Google Cloud) | Gemini AI inference & vision API | Product descriptions, FAQ context (ephemeral) | Global Data Centers |
| Groq Inc. | Ultra-low-latency LLM inference | Real-time DM assistance prompts (ephemeral) | United States |
| Truecaller International LLP | 1-tap shopper mobile verification | Mobile phone number verification token | Sweden / India |
| WhatsApp LLC (Meta) | Transactional delivery alerts | Recipient phone number, order status notifications | United States / Global |
We do not use invasive third-party cross-site advertising cookies. Our application sets only functional and security-essential cookies:
sb-*-auth-token (Supabase authentication token for creator and staff login sessions), token_hash (session verification), and anonymous cart tokens required to keep items in your shopping bag as you browse Reels.You can restrict or block cookies through your browser settings. However, disabling essential session cookies will prevent login and checkout functionalities from operating properly.
We preserve personal records only as long as required to fulfill commercial services or satisfy statutory legal obligations:
| Record Type | Retention Period | Statutory / Business Justification |
|---|---|---|
| Active Creator Accounts | Duration of account tenure + 30 days after cancellation | Service delivery & account recovery grace period |
| Orders, Invoices & Ledger Records | 7 Years | Mandatory under Indian GST Act, Income Tax Act, and MCA rules |
| Customer Shipping Addresses | Order delivery + 30-day return window, then scrubbed upon erasure request | Fulfillment, returns verification, and chargeback protection |
| Instagram Comment & DM Logs | 90 Days | Automated response deduplication and rate-limit auditing |
| Platform Audit Events & Security Logs | 180 Days | CERT-In cybersecurity compliance and incident forensics |
Depending on your jurisdiction (European Union, United Kingdom, India, California/United States), you possess comprehensive legal rights over your personal data:
Request an export of all personal data held about you in machine-readable JSON format.
Request permanent deletion of your profile, address book, conversation history, and tokens.
Correct inaccurate or incomplete shipping information or account contact details.
Revoke marketing or recovery consent instantly via one-click unsubscribe links.
To exercise any of these rights, visit our dedicated Data Deletion & Rights Page or email our Data Protection team directly at privacy@shoboti.com. We verify your identity and process requests within 48 hours (statutory maximum 30 days).
Shoboti is strictly intended for individuals who are at least 18 years of age (or the age of commercial legal capacity in your territory). We do not knowingly collect personal data from children or conduct behavioural tracking, targeting, or profiling of minors under Section 9 of the India Digital Personal Data Protection Act, 2023 or the US Children's Online Privacy Protection Act (COPPA). If you become aware that a minor has submitted personal data to us, contact compliance@shoboti.com for prompt removal.
We deploy defence-in-depth technical and operational safeguards:
In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 8 of the DPDP Act 2023, the designated Grievance Redressal Officer and Data Protection Officer for Shoboti is: