Privacy Policy

ScanMonk (“we,” “us,” or “our”) operates DOPE, a Customer Intelligence Dashboard that helps brands collect, analyse, and act on customer feedback. This Privacy Policy explains how data is collected, stored, used, and protected across the DOPE platform, for both the brands (“Clients”) who subscribe to DOPE and the end customers (“Respondents”) whose feedback is collected through it.

From Brands (Clients)

• Business name, contact details, and authorised user information
• Subscription and billing information (billing itself is handled by Shopify)
• Configuration preferences (feedback categories, review parameters, dashboard settings)
• Integration credentials for communication channels (where applicable), stored encrypted — see “WhatsApp & Meta data”

From End Customers (Respondents), on behalf of Brands

• Contact information (name, phone number, email address)
• Order data synced read-only from the Brand’s Shopify store: order details and amounts, and billing and shipping address where present
• Feedback responses collected via WhatsApp or email
• Experience ratings across categories such as quality, delivery, packaging, and service
• Open-text comments customers choose to write with their rating

DOPE does not use SMS as a collection channel. Any reference you may see to SMS elsewhere is not an active channel.

From Website Visitors

If you request a demo or submit a form on our website, we store the name, contact details and message you provide, and your IP address, so we can respond to you. We keep this information until you ask us to delete it by emailing tech@scanmonk.com.

All customer data collected through the DOPE platform belongs entirely to the Brand. This is not a technicality: it is the foundation of how DOPE is built.

• The Brand owns all raw feedback, customer contact information, response data, and any derived reports generated within their account.
• ScanMonk does not claim ownership over any Brand’s customer data. For that data the Brand is the controller (data fiduciary) and ScanMonk acts as its processor, handling it only on the Brand’s instructions and for the purposes below (see also “Data Protection & Processing” in our Terms of Service).
• Records are stored in a shared, access-controlled managed cloud database and are scoped to your Brand. We do not operate physically separate per-Brand environments.
• You can export your data at any time from within the app. On uninstall or a deletion request, data is deleted or anonymised as described in “Data Retention” and “Deletion & Uninstall” below.

ScanMonk accesses Brand data only to the extent necessary to:

• Operate, maintain, and improve the DOPE platform
• Provide analysis, dashboards, alerts, and reports within your account
• Show the recurring reasons behind low ratings, and their trends, within your account
• Diagnose technical issues and ensure service reliability
• Comply with legal obligations

Access to personal data within ScanMonk is role-restricted and logged. We do not sell your data, and we do not use your customers’ data to train our own AI models.

DOPE relies on the following third-party sub-processors to deliver its functionality. For each we list where it is located, what it does, and the data we share with it. We share only the minimum data each service needs to perform its function.

• Shopify (United States): the source of the customer and order records that DOPE syncs read-only. Data shared: customer name, email, phone, billing and shipping addresses, and order details.
• Google Cloud (United States, us-east1): application hosting and compute. Data processed: all platform data while the service runs.
• MongoDB Atlas (United States): managed database hosting. Data stored: all platform records.
• Resend (United States): delivery of email — feedback requests to customers, low-rating alerts to the Brand, and data-rights verification codes. Data shared: recipient email address and message content.
• Google LLC — Gmail SMTP (United States): sends our compliance emails, including the compiled Shopify data-request report to the store owner. Data shared: email content and the report attachment.
• Cloudinary (United States): storage and delivery of uploaded review photos and videos. Data shared: uploaded media files.
• Meta — WhatsApp Business Cloud API (United States): WhatsApp message delivery when a Brand connects WhatsApp. Messages are sent from the Brand’s own WhatsApp Business account; data-rights verification codes are sent from DOPE’s own WhatsApp number. Data shared: customer phone number and message content. Where a Brand instead configures a WhatsApp Business Solution Provider, that provider is chosen and contracted by the Brand, may be located in India or elsewhere, and delivers messages using credentials the Brand supplies.

DOPE is operated from India by ScanMonk Infomedia Pvt. Ltd. To deliver the service, data about Brands and their customers, including customers located in India, is processed and stored in the United States. Our application runs on Google Cloud (us-east1), our records are stored in MongoDB Atlas, and the ScanMonk-contracted sub-processors listed above are located in the United States. WhatsApp Business Solution Providers configured by a Brand may be located in India or elsewhere.

We protect this data in transit and at rest. All network traffic is encrypted with TLS, stored data is encrypted at rest (with field-level AES-256-GCM encryption applied to the sensitive fields described in Data Security), and access to personal data is role-restricted and logged.

We take security seriously because your customers’ trust, and yours, depends on it.

• Data is encrypted in transit (TLS) and all stored data is encrypted at rest at the storage layer. On top of that we apply field-level encryption (AES-256-GCM) to sensitive customer fields: phone numbers, email addresses, city and postcode, billing and shipping street addresses, company and regions, order notes, and open-text feedback. In the Shopify customer and order mirror synced from your store, contact fields and names are field-level encrypted. Customer names used for display on your dashboard and in tickets, and the recipient phone number kept in message delivery logs, are stored readable (protected by storage-layer encryption and role-based access) so you can recognise your own customers and so delivery problems can be traced.
• The remaining, non-identifying parts of the customer and order records synced read-only from your Shopify store (order totals, status, and marketing attribution) are protected by encryption at rest at the storage layer together with role-based access controls. Cart recovery and storefront visitor tracking have been discontinued for all stores: the tracking script (which set a first-party visitor identifier cookie, sm_vid, on the storefront) has been removed, and no new abandoned-cart or visitor-event data is collected; data stored previously is deleted by a scheduled job.
• Access to personal data within ScanMonk is role-restricted and logged, with anomaly checks on bulk data exports.
• We run an automated verification suite over the codebase and conduct security reviews.
• DOPE’s infrastructure is hosted on Google Cloud (United States).
• In the event of a data breach that affects your account, we will notify you promptly, within 72 hours of confirmed discovery where feasible.

DOPE collects feedback from your customers on your behalf. As a Brand, you are responsible for ensuring your customers are informed that their feedback is being collected and for maintaining appropriate consent records.

ScanMonk supports Respondent rights requests (access, correction, deletion) routed through the Brand. If a Respondent contacts us directly, we will direct them to the relevant Brand unless legally required to respond otherwise. For Shopify stores, we also honour Shopify’s mandatory privacy requests as described in “Deletion & Uninstall.”

Data is purged automatically by a daily job according to these windows:

• Feedback and review records: personal data (name, contact, address, free-text, media) removed after 365 days; the numeric rating is kept for analytics.
• Survey responses: personal data removed after 365 days.
• Support tickets: deleted 365 days after closure.
• Message delivery logs (WhatsApp and email: recipient, template, delivery status) and inbound provider messages: deleted after 180 days.
• Feedback-request sequence records and channel attempts: deleted after 365 days.
• Customer-directory entries with no activity for 365 days: identity anonymised.

Website form submissions are not removed by this daily job. We keep them until you ask us to delete them by emailing tech@scanmonk.com.

After these windows, only de-identified aggregates that contain no personal data (e.g. numeric ratings) may be retained.

WhatsApp is optional. A Brand connects its own WhatsApp Business account (through Meta’s Embedded Signup, by entering its own Meta Cloud API credentials, or through a WhatsApp Business Solution Provider it contracts). Before WhatsApp feedback can be switched on, the Brand confirms that its customers have agreed to receive WhatsApp messages from it and that it will honour opt-outs; we record the date of that confirmation.

What we store

• The Brand’s WhatsApp Business Account ID, phone number ID and business ID, and the names and approval status of its message templates.
• The Brand’s WhatsApp access token or provider API key, and a per-Brand webhook token — always encrypted (AES-256-GCM). These are never shown back in the app.
• Message delivery logs: the customer’s phone number, the template used and the delivery status (sent, delivered, read, failed).
• Opt-outs: when a customer replies STOP (or a similar keyword), we record a do-not-contact flag for that Brand and send no further WhatsApp feedback requests to that customer.

How a Brand disconnects WhatsApp

• In DOPE: Settings → Setup → WhatsApp → “Disconnect WhatsApp”. This immediately deletes the stored access token, WhatsApp account IDs, template list and any provider credentials and webhook token, removes DOPE’s webhook subscription from the WhatsApp Business Account where possible, and stops all WhatsApp messages (feedback requests then go by email).
• In Meta: a Brand can also remove DOPE’s access at any time in Meta Business Settings (remove the DOPE / ScanMonk app from the business’s connected apps or system users).

How WhatsApp data is deleted

• Tokens and account IDs: deleted at once by “Disconnect WhatsApp”; for an account created by the Shopify install, also deleted with the account on Shopify “shop/redact” (sent by Shopify about 48 hours after uninstall).
• Message delivery logs: deleted automatically after 180 days, or earlier on request.
• To ask for deletion of any WhatsApp-related data, email tech@scanmonk.com.

Anyone — a Brand, or a customer of a Brand — can ask to access or delete their data by emailing tech@scanmonk.com. We verify the request and act on it; for a customer of a Brand we carry it out for, and inform, the relevant Brand.

• Uninstalling the app stops all outreach and marks your store disconnected; in-flight feedback requests are cancelled.
• Shopify “customers/redact” request: that customer’s personal data is anonymised across our records (including the Shopify-synced mirror).
• Shopify “shop/redact” request: your store’s customer data is fully erased, including uploaded review photos and videos. If your DOPE account was created by the Shopify install (and is not used for any other store or a direct DOPE sign-up), the account, its logins and settings are erased too; reinstalling later creates a fresh account. Billing and usage records are retained as required for financial record-keeping.
• Shopify “customers/data_request”: we compile the data we hold for that customer and email it to the Brand’s DOPE account email (or the store owner email Shopify gave us at install) so you can fulfil the request within the 30 days Shopify requires.
• For every erasure and data-request we carry out we keep a minimal compliance audit record — the date, the action taken, and a one-way hashed (irreversible) form of the customer identifier — as the legally-required proof the request was honoured. This record never stores raw contact details (no name, email, or phone).

We will notify active Clients via email and in-dashboard notice at least 14 days before any material change to this Privacy Policy takes effect. Continued use of DOPE after that date constitutes acceptance of the updated terms.

For privacy-related questions, data requests, or concerns:

tech@scanmonk.com

Company: SCANMONK INFOMEDIA PRIVATE LIMITED, 10th Floor, Awfis, Paras Trinity, Sector 63, Gurugram, Haryana 122102, India