Privacy
Draft. This text has not been legally reviewed yet and may change.
What we keep
Seller account data: mobile number, email if given, shop name and team members.
Shop data: products, settings, payment methods and policies.
On the seller's behalf: customers' DMs, orders, and the address and phone number a customer gives for delivery. This data belongs to the seller, and we process it only to provide the service to them.
Technical data: request IDs and a keyed hash of the IP address to prevent abuse. Message text, phone numbers and addresses are not written to technical logs.
Where we keep it
Pishkar's servers are in a data centre in Germany. Instagram connection tokens and other sensitive data are stored encrypted.
Who we share it with
Meta (Instagram) to receive and send messages.
OpenRouter and language model providers to write replies. Where the provider allows it, storage and training on the data are switched off, and phone numbers and addresses are not sent to the model when not needed.
Kavenegar to send login codes by SMS.
We do not sell data or use it for advertising.
How long we keep it
Current proposal: messages 12 months, AI decision records 6 months, security logs 24 months; orders and payments are kept as accounting records. Final periods: [to be decided].
Deleting data
A seller can disconnect Instagram from the panel; tokens are deleted at once. If you remove Pishkar in your Instagram settings, we receive a deletion request and you get a confirmation code to follow it.
Customers can ask the seller or us to delete their conversations and contact details. Accounting records of orders are kept as the law requires.
Security
Each seller's data is kept separate with restricted access, important actions are written to a tamper-evident log, and support access to your account is logged and time-limited.
Contact
For questions or requests about your data, message us from the contact page.