This policy covers the StoreTalk platform — the web dashboard, the StoreTalk Business mobile app, and the StoreTalk USA website (us.storetalk.app).

StoreTalk LLC, a New Jersey limited liability company ("StoreTalk", "we", "our", or "us"), operates StoreTalk in the United States — a WhatsApp and web-chat customer messaging platform for businesses. StoreTalk is a Citymapia product. Our affiliate, CityMapia (Kochi, India), provides engineering and support services to us and may access data as needed to operate and support the Service, under our instructions and confidentiality obligations. This Privacy Policy explains what we collect, how we use and share it, and the choices you have. By using StoreTalk you agree to this policy. If you do not agree, please do not use the Service.

StoreTalk has two kinds of users: • Business customers (you): the businesses that sign up for StoreTalk. For your account, billing and usage information, we decide how the data is used, so StoreTalk is the "business" or "controller". • Your customers and website visitors: people who message your business or use the chat on your website. For their messages and contact details, you decide why and how the data is used and we process it on your behalf as your "service provider" or "processor". If you are a customer of a business that uses StoreTalk and want to access or delete your information, please contact that business first. You can also contact us at hello@storetalk.app and we will help route your request.

3.1 Business account information • Name, business name, email address, phone number and password (stored hashed) • WhatsApp Business Account (WABA) ID, Phone Number ID and Meta Business Manager ID • Billing details. Card and bank details are collected and held by our payment processors, not by us. • API access tokens, encrypted at rest 3.2 WhatsApp and web-chat data (processed for your business) • Customer phone numbers and names that interact with your WhatsApp number or your website chat • Message content (text, voice notes, images, documents), delivery and read status • For web chat: the page the visitor was on, and the name or phone number they choose to give • Message template submission and approval status We process this data only to operate the Service for you. We do not use customer message content for advertising or profiling, and we do not sell it. 3.3 Usage and device data • Login activity, session information, IP address, browser and device type • Feature usage (templates created, flows built, messages sent) 3.4 Website and chat-widget data When you visit our site or a site that uses the StoreTalk chat widget, we set a first-party cookie containing a random anonymous visitor ID and record page views so the chat can recognise the same visitor across pages. It does not identify you by name unless you start a chat and give your details. 3.5 Mobile app data See Section 13.

• Provide and operate the Service: send and receive WhatsApp and web-chat messages, run flows and automations you configure, manage templates and your WhatsApp Business Account through Meta's API • Show you analytics such as delivery, read rates and conversation volume • Bill you and calculate usage • Provide support and diagnose technical issues • Send service notices and, for the mobile app, push notifications about new messages • Secure the Service, prevent fraud and abuse, and comply with law • Improve the Service using aggregated or de-identified usage data We do not sell personal information and we do not "share" it for cross-context behavioural advertising.

If your business turns on AI features — AI replies, voice transcription or translation — the relevant message content is sent to our AI providers to generate the result. AI providers receive only the content needed to produce a response and process it under business API terms that do not allow them to use it to train their models. Message content is not sent to AI providers unless your business has turned on an AI feature. AI replies can be wrong. Businesses are responsible for how they configure and supervise AI features. If you are chatting with a business that uses StoreTalk AI, you may ask to speak with a person.

We share information only with the following, and only as needed to operate the Service: • Meta Platforms, Inc.: WhatsApp Business API, the underlying messaging platform • Payment processors (such as Stripe): subscription billing and payments • Hetzner Online GmbH: server infrastructure in data centers in Germany and Finland • Cloudflare, Inc.: CDN, DNS, file storage and AI inference • Apple Inc.: push notifications for the iOS app • Google LLC, OpenAI, L.L.C. and Anthropic, PBC: AI models, used only when your business turns on AI features • CityMapia, our affiliate: engineering and support • Professional advisers, and authorities where required by law, or in connection with a merger, financing or sale of our business (with notice to you where required) We do not sell personal information. In the last 12 months we have not sold or shared personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

StoreTalk is operated from the United States but our infrastructure is hosted in the European Union and our affiliate team is in India. By using the Service you understand that your information may be processed and stored in countries other than your own, including the EU, India and the United States, and we apply the safeguards described in this policy wherever it is processed.

• Conversation logs: retained for 90 days (Starter) or 1 year (Growth and Pro), or as configured for Enterprise • Account data: retained while your subscription is active and for 30 days after cancellation • Billing and tax records: retained for as long as required by applicable tax and accounting laws • After retention periods, data is permanently deleted When you disconnect StoreTalk from your WhatsApp Business Account, close your account, or ask us to delete your data, we delete the WhatsApp platform data we processed on your behalf within 90 days, except records we are legally required to keep. To request deletion, email hello@storetalk.app with the subject "Data Deletion Request". We will confirm completion within 30 days.

People who receive WhatsApp messages from a business using StoreTalk can opt out at any time by replying STOP. StoreTalk records and respects opt-outs. Businesses are responsible for honouring opt-outs and for not contacting people who have opted out.

Depending on where you live (including California, Colorado, Connecticut, Virginia, Texas, Utah and other US states with privacy laws), you may have the right to: • Know and access the personal information we hold about you • Correct inaccurate personal information • Delete your personal information, subject to legal exceptions • Opt out of the sale or sharing of personal information and of targeted advertising or profiling. We do none of these. • Not be discriminated against for exercising your rights To exercise a right, email hello@storetalk.app with the subject "Privacy Request". We may need to verify your identity, and you may use an authorised agent. We respond within 45 days, and may extend once by a further 45 days where permitted. If we deny a request you may appeal by replying to our response, and you may also contact your state attorney general. For information we process on behalf of a business customer, we will refer you to that business or act on its instructions.

• API tokens and sensitive credentials are encrypted at rest using AES-256 • Data in transit is encrypted using TLS 1.2 or higher • Access to production systems is limited to authorised personnel • We run regular security reviews and dependency audits No system is completely secure. If a breach affects your information we will notify you as required by applicable law.

We use essential cookies to keep you signed in and make the Service work, and a first-party anonymous visitor ID cookie for the chat widget and basic site activity. We do not use advertising cookies or cross-site tracking. Because we do not sell or share personal information, browser Do Not Track or Global Privacy Control signals do not change how we handle your data.

The StoreTalk Business app for iPhone and iPad lets you and your team use the Service on the go. It collects only what it needs to work: • Sign-in: your email address and password are sent to StoreTalk to sign you in. Session tokens are stored in the iOS Keychain on your device. • Push notifications: if you allow them, we store your device's push token to alert you to new messages through Apple Push Notification service. You can turn this off in iOS Settings. • Camera and photos: used only when you choose to take or attach a photo, video or file to send. • Microphone: used only while you record a voice note to send. • Phone contacts: used only when you pick a contact to share or save a customer to your phone. We never upload your address book. • Face ID / Touch ID: if you turn on App Lock, iOS checks your identity on the device. We never receive your biometric data. • On-device storage: recent conversations and contacts may be kept on your device for speed and are deleted if you uninstall the app. The app shows no ads, contains no third-party analytics, advertising or tracking SDKs, and does not track you across other companies' apps or websites. Account deletion: email hello@storetalk.app with the subject "Account Deletion Request" from your registered email address. We will confirm completion within 30 days, subject to Section 8.

StoreTalk is a business tool for people aged 18 and over. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 (or under 13 in any case, in line with COPPA). If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy from time to time. We will change the "Last updated" date above and notify registered users by email of material changes.

StoreTalk LLC, a New Jersey limited liability company A Citymapia product Email: hello@storetalk.app For privacy requests use the subject "Privacy Request". A mailing address is available on request at the email above.