Exreelia Privacy Policy

Effective date: 26 August 2026

Provided by: ExactWhy Solutions Private Limited SY-103/ 1 TO 6, PLOT-93 1ST FLOOR, MOHAN DEEP H. SOCIETY, VED ROAD, Dabholi, Surat, Surat City, Gujarat, India, 395004

Contact: hello@exactwhy.com

What Exreelia does

Exreelia connects a Shopify store to an Instagram account and shows that account's posts on the storefront. It checks Instagram once an hour and copies new posts to storage we control, so that the images keep working after Instagram's own links expire.

What we collect

From your Shopify store

  • Your store's domain (example.myshopify.com), used to keep each store's data separate.
  • A Shopify access token, so the app can act on your behalf.
  • Your published languages, so the app can offer them for translation.
  • Whether your feed block is placed in your published theme, read from your theme's JSON templates.
  • Your subscription status, cached so your storefront does not have to ask Shopify on every page view.
  • Product handles and titles for any products you attach to a post. No prices, no inventory, no variants.

From your Instagram account

  • Your Instagram username and account ID.
  • An access token, stored encrypted.
  • Your posts: the media files, captions, permalinks and post types, and copies of the images and videos on storage we control.

From your storefront

  • Counts only. How many times the feed was seen, which posts were tapped, how many shoppers reached a product, and how many added one to a cart.

Nothing here identifies a shopper. No names, no email addresses, no IP addresses, no cookies, no device identifiers, no profiles. We count events, not people. There is nothing in this data that could be traced back to an individual, which is why Exreelia sets no cookies on your storefront and needs no consent banner of its own.

What we never collect

Customer names, email addresses, phone numbers, shipping addresses, order contents, payment details, and browsing behaviour. Exreelia does not request Shopify's protected customer data scopes and holds no customer records of any kind.

Why we hold it

To run the service you installed the app for, and for nothing else. We do not sell data. We do not share it with advertisers. We do not use it to train models. We do not build audiences from it.

Who else sees it

  • Meta (Instagram). We call Instagram's API to read your posts. Your use of Instagram is governed by Meta's own terms and privacy policy.
  • Our infrastructure providers. Hosting, database and file storage, operating on our instructions and holding data only to run the service.

Data is stored in the United States, on infrastructure in Virginia. We are established in India, so your data is transferred internationally in the course of running the service. It is held under contract by providers acting only on our instructions.

How long we keep it

  • While the app is installed: as long as you keep using it.
  • When you uninstall: your synced posts, the files behind them, your Instagram connection and token, your settings, your storefront wording, your counts and your session are all deleted.
  • When Shopify sends a shop/redact request, 48 hours after uninstall: the same deletion runs again, so anything that survived the first pass is removed.
  • If you disconnect Instagram without uninstalling: your posts and the token go immediately. Your settings and wording stay, so reconnecting does not make you set the app up again.

Your rights

You can:

  • See what we hold. Email us and we will tell you.
  • Have it deleted. Uninstall the app, and it is deleted. Or email us and we will do it without waiting for the uninstall.
  • Correct it. Most of it is your own settings, editable in the app.
  • Take it with you. Email us and we will export it.

If you are in the UK or EU, you also have the right to complain to your data protection authority. If you are in India, where we are established, the Digital Personal Data Protection Act 2023 gives you equivalent rights, and you may raise a grievance with us at the address above before approaching the Data Protection Board.

Shopify's own customer privacy requests (customers/data_request, customers/redact) reach us and are answered. They return no customer data, because we hold none.

Security

Instagram access tokens are encrypted before they are stored. All traffic uses HTTPS. Access to production data is limited to people who need it to operate the service.

Children

Exreelia is a tool for merchants and is not directed at children.

Changes

If this policy changes materially we will update the effective date and tell merchants in the app before the change takes effect.

Contact

Email hello@exactwhy.com and a person will answer, usually within one working day.