Who we are

Botique is operated by Botique Ltd (“Botique”, “we”, “us”) based in Auckland, New Zealand. This policy explains what information we collect from merchants using the platform and from customers who interact with merchant storefronts or chat assistants on Messenger, Instagram, and WhatsApp, and how we use that information.

Information we collect from merchants

When you sign up for Botique, we collect:

Account details — name, email address, password hash, business name, and contact details.
Meta channel connection data — Facebook Page ID and token, Instagram Business account ID and token, and/or WhatsApp Business phone number ID and token, depending on which channels you connect via Meta’s OAuth and Embedded Signup flows.
Stripe connection data — the Stripe account ID you link; we never see your Stripe password or bank details.
Billing information handled by our payment processor.
Product, inventory, and pricing data you upload to your catalog.

Information we collect from customers

When customers interact with a merchant’s storefront or chat assistant on Messenger, Instagram, or WhatsApp, we process on behalf of that merchant:

Order details — items purchased, rental dates, customer name, email, phone, and delivery address.
DM conversation content from Messenger, Instagram, and WhatsApp, for the purpose of the AI assistant answering the conversation.
Payment outcome (status, last-4 of card) returned by Stripe — Botique does not store full card numbers.

The merchant is the data controller for this information. Botique acts as a data processor on their behalf.

How we use information

To provide the Botique service — running your storefront, bot, order flow, and dashboard.
To route payments via Stripe on your behalf.
To send transactional emails (order confirmations, payment instructions, account alerts).
To improve the product through aggregated, non-identifying usage analytics.
To comply with legal obligations when required by law.

We do not sell personal information to third parties. We do not use customer messages to train third-party AI models.

Third-party processors

Botique shares data with the following sub-processors, all subject to their own privacy terms:

Supabase — database and authentication hosting.
Stripe — card payment processing and payout to merchant Stripe accounts.
Meta (Facebook, Instagram, WhatsApp) — Messenger, Instagram Graph, and WhatsApp Business webhooks and APIs.
Google (Gemini) — AI model inference for the chat assistant. Messages sent to Gemini are not retained for model training per Google’s enterprise API terms.
Resend — transactional email delivery.
Vercel — application hosting.

Data retention

Merchant account data is retained while your account is active. When you cancel, we keep your data for 30 days to allow reactivation, then permanently delete it unless we are legally required to retain it (e.g. tax records). Customer order records are kept for 7 years to comply with accounting obligations.

Your rights

You can request access to, correction of, or deletion of your personal information at any time by emailing hello@botique.nz. If you are in a jurisdiction with data protection laws (GDPR, NZ Privacy Act 2020, CCPA), you have the rights granted under that legislation and we will honour them.

Contact

Questions about this policy? Email hello@botique.nz.