Last updated: November 2026
Tous Connect is operated by Grid IT Solutions. Questions? Email connect@thetous.com.
This policy explains what personal information Tous Connect (operated by Grid IT Solutions) collects, how we use it, and the choices you have. It covers our business customers (the people who sign up and use the platform) and explains how we handle the data those businesses process about their own customers.
We do not sell your data, and we do not sell or share your contacts with third parties for their own marketing. We do not use the content of your customer conversations to train AI models.
Data is stored in Supabase (PostgreSQL), hosted in the Singapore region. The application is hosted on Vercel. Data is encrypted in transit (TLS) and at rest. Access is restricted to authorised personnel and segregated per tenant using row-level security, so one business can never read another’s data.
When you connect a WhatsApp Business number, messages pass through Meta’s WhatsApp Business Platform. We process those messages on behalf of your business — you are the data controller for your conversations and we act as your processor.
For the end consumers your business messages, Meta’s own privacy policy and the WhatsApp terms apply to the handling of their data inside WhatsApp. We do not control Meta’s processing. If a consumer wants their data removed from your records, contact us or manage it directly from your contacts page.
Instagram and Facebook Messenger (only for a business that connects them). If your business connects its Instagram professional account or Facebook Page, the messages people send to that account, and your team’s replies, pass through Meta’s Instagram and Messenger platforms and appear in the same inbox. We store each message, the sender’s Instagram- or Page-scoped ID, and their name and username as Meta provides them; photos and files they send are kept for 90 days. The account’s access tokens are encrypted and used only by our servers. We never post, comment, or read the account’s feed or ads data, and a reply is only ever sent by a person on your team, inside an open chat. Disconnecting the account in Settings, or removing Tous Connect in Instagram or Facebook settings, deletes the tokens and stops new messages being stored; the chat history stays your business’s record while your Tous Connect account is open, and you can delete it at any time (section 10). If you also ask for your data to be deleted when you remove Tous Connect (Meta then sends us a data-deletion request), we delete that account’s chats, messages and files at once.
If you choose to connect your Google Business Profile, you sign in with Google and grant us access to manage that profile on your behalf. We ask for a single Google permission, Manage your Business Profile on Google, which is the narrowest scope Google offers for reading reviews and replying to them — there is no read-only or reviews-only alternative.
What we access. Your business locations and their names; the reviews customers leave on your profile, including the reviewer’s display name, photo, star rating and text; your replies; and the direct “write a review” link Google provides for your business.
What we do with it. We show your reviews in Tous Connect so you can read and reply to them, and we use your review link to help you ask customers for reviews. Reply text is sent to Google and published under your business name — nothing is ever posted without you approving it first. Where we suggest reply wording, the suggestion is generated by Groq from the review text and is always editable before you send it.
What we store. Your Google access and refresh tokens, encrypted; your location identifiers; and a copy of your reviews and replies so the page loads without calling Google on every view. We do not use Google user data to train AI models, we do not sell it, and we do not share it with anyone except the processors named in this policy.
Disconnecting. You can disconnect Google at any time from your settings. That revokes our access immediately and deletes the stored tokens and the cached reviews. You can also revoke access directly from your Google Account permissions page.
Tous Connect’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Tous Connect is not affiliated with, sponsored by, or endorsed by Google.
If you connect your Shopify store, you install our app and grant it these permissions: read and write orders, read customers, read fulfillments, read checkouts and read products. Shopify then notifies us when an order, checkout or fulfillment changes. We process this data on behalf of your business: you are the controller for your store’s customers and we act as your processor.
What we read. For orders: the order number, items, amounts, payment and fulfilment status, tracking details, and your customer’s name, phone number, email and shipping address. For abandoned checkouts: the customer’s name, phone number, email and cart. For customers, only when you choose to import them: name, phone number, email, tags, SMS marketing consent and, for online stores, their order count and total spend. For products, only when you pick one to send: its title, price, image and link.
What we do with it. We send the WhatsApp messages you set up (order confirmations, shipping updates, cart reminders, cash-on-delivery confirmations), show your orders and carts in Tous Connect, and keep your contact list up to date. We use the write permission for orders only to add or remove a tag on an order when your customer confirms or cancels a cash-on-delivery order.
How long we keep it. Order, checkout and customer data is kept while your account is open, as part of your order and conversation history. Delivery-tracking updates from Shopify are deleted after 30 days. When you uninstall the app, our access to your store is removed straight away; Shopify then asks us to erase your store’s data, and we do so within 30 days of that request. Closed accounts follow the retention rules below.
Your customers’ privacy requests. Shopify forwards your customers’ requests to us. If a customer asks for their data, we prepare a copy for you to send them. If a customer asks to be deleted, we delete their Shopify data (orders, shipments, checkout carts, and a contact created only from your store) within 30 days, and, if you choose, everything else about them in your account, including their WhatsApp conversation with your business. Customers can also write to us at connect@thetous.com.
We do not sell Shopify data or use it to train AI models. We never use it for our own advertising. If you turn on Meta Conversions (Business plan), we send your orders’ customer details, hashed, to your own Meta ad account on your behalf, to measure your ads. Tous Connect is not affiliated with, sponsored by, or endorsed by Shopify.
When you scan a business card, the image is sent to Groq for AI text extraction. Only the extracted fields (name, phone, email, company) are saved to your contacts. The image is not stored permanently after extraction. We do not use your scans to train models.
AI reply drafts and the AI assistant (optional, off by default). A business can switch on two AI features. With AI reply drafts, a team member asks for a suggested reply in a chat; the suggestion is shown only to the business's team, and a person decides whether to send it. With the AI assistant, the business lets it answer customers on its behalf: when a customer writes, the assistant may reply automatically, without a person checking each reply first. It answers only from the business's own product, order and store details, and when it can't answer it passes the chat to the business's team. A customer told about the assistant can always ask for a person.
For either feature, Tous Connect sends the chat's recent messages (up to the last 20), and the product, order and store details needed to answer, to our AI provider, Anthropic (Claude). The customer's phone number is not sent, though a number the customer typed into a message is part of that message. We keep a record of each request (which tools ran and the outcome, never a phone number) for 90 days. For the assistant's automatic replies we also keep the reply's text for 14 days, so the business can review what was sent; the reply itself also stays in the chat like any other message. Under Anthropic's commercial terms, data sent through its API is not used to train its models.
Photos you send while asking about an order. When you send a photo to a business's WhatsApp assistant while asking about an order, the photo may be sent to our AI provider (Anthropic) only to find an order number or a courier tracking number in it. Nothing else from the photo is used or kept. The photo itself is stored with your messages like any other photo you send (90 days).
We use session cookies for authentication — they keep you signed in and secure your session. Blocking these cookies will prevent you from signing in.
Site statistics (Google Analytics). On our public pages, such as the home page, pricing, the blog and the help centre, we use Google Analytics to understand how visitors use the site: which pages are visited and roughly where visits come from. It sets cookies with a random ID. It never runs inside the app, or on the signup, login, privacy and terms pages.
We remember your choice for 180 days. We never use these statistics for advertising: advertising cookies, Google signals and ad personalisation are all switched off. Google keeps these statistics for 14 months.
Our own visit counts (no cookies). On the home page, pricing, the blog, the help centre, our pages for online stores and dental clinics, and the signup page, we also count visits ourselves, without cookies and without sending anything to another company. For each page viewed we record only the date, the page, the website the visit came from (its name, such as google.com, not the page), any campaign tags in the link (utm_source, utm_medium, utm_campaign), the country (worked out by our host, Vercel, from the connection) and whether it is a phone or a computer. We don’t store your IP address, a cookie or any ID, so we don’t use these counts to identify anyone, and we keep them for 90 days. We don’t count visitors who are signed in to Tous Connect.
Where a new account came from. Your browser can remember, in that tab only and until the tab is closed, where your visit started (for example “google.com” or a campaign name). In the European Union, the European Economic Area, the United Kingdom and Switzerland it does this only after you press Accept; elsewhere, from your first visit, unless you press Turn off. If you then create an account, we save that starting point with your account so we know how people find us, and it is deleted with your account.
We do not use advertising cookies, third-party tracking pixels, or cross-site behavioural profiling.
You may, at any time:
To exercise any of these, email connect@thetous.com. We respond within 30 days. We may need to verify your identity before acting on a request.
We share data with these processors strictly to run the Service:
Each processes data under its own terms and applicable data-protection obligations.
We use TLS encryption, hashed credentials, row-level tenant isolation, scoped API keys, and signature verification on payment and webhook endpoints. No system is perfectly secure; if a breach affects your data we will notify you promptly and without undue delay.
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children.
We may update this policy. Material changes will be notified in-app or by email at least 14 days before taking effect, and the “last updated” date above will change.
For any privacy question or request: Grid IT Solutions — connect@thetous.com