Privacy Policy
Last updated: October 26, 2026
This Privacy Policy explains how DigiFist BV (BE 0769.399.149), Ellermanstraat 14, 2000 Antwerpen, Belgium (“DigiFist”, “Galantis”, “we”, “us”, or “our”) collects and processes personal data in relation to Galantis and its related services, including Galantis Connect, Galantis WhatsApp, Galantis Marketing and associated websites, applications and features (together, the “Services”).
This Privacy Policy is intended to provide transparency about what personal data we process, why we process it, how it may be shared, how long we retain it, and the rights available to individuals.
Important: Galantis enables business customers to communicate with, manage and automate interactions with their own customers and contacts, including through Meta’s WhatsApp Business Platform. In these situations, DigiFist generally processes personal data on behalf of the relevant business customer.
1. WHO THIS POLICY APPLIES TO
1.1 Business Users / Authorized Users
Individuals who create, administer or use a Galantis account on behalf of a business customer.
1.2 End Recipients
Individuals whose personal data is uploaded, synchronized, generated or otherwise processed within Galantis by our business customers, including individuals who receive WhatsApp or other communications from those customers.
1.3 Website Visitors and Support Contacts
Individuals who visit our websites, request a demo, contact support, submit forms or otherwise communicate with us regarding the Services.
2. CONTROLLER VS PROCESSOR (GDPR ROLES)
2.1 When DigiFist acts as a controller
We generally act as a controller for personal data relating to:
account creation and administration;
business contact information;
contracts and billing;
support communications;
website usage;
security and access logs;
product and website analytics;
sales and business communications; and
our own legal, operational and security obligations.
2.2 When DigiFist acts as a processor
We generally act as a processor when our business customers use Galantis to process personal data relating to their customers, prospects or other End Recipients.
This Customer Data may include, for example:
phone numbers;
names;
email addresses;
customer identifiers;
audience attributes;
tags and segments;
order or e-commerce information;
opt-in and opt-out information;
WhatsApp message content;
message templates;
conversation information;
automation data; and
delivery and interaction metadata.
In these situations, the Galantis customer generally acts as the controller and determines the purposes and legal basis for processing.
If you are an End Recipient wishing to exercise rights relating to data processed by one of our customers, you should normally contact the relevant business directly. We will assist our customer with such requests where required under applicable law and our contractual obligations.
3. PERSONAL DATA WE COLLECT
3.1 Data provided by Business Users and Customers
We may collect:
name;
business email address;
telephone number;
job title;
company name;
account information;
authentication information;
roles and permissions;
billing and invoicing information;
transaction references;
support communications;
attachments;
configuration information; and
other information voluntarily provided to us.
3.2 Customer Data processed through the Services
Depending on how a customer configures and uses Galantis, Customer Data may include:
End Recipient contact details;
phone numbers and customer identifiers;
customer attributes and segmentation data;
e-commerce and order-related data;
WhatsApp message content;
message templates;
timestamps;
delivery and interaction information;
conversation metadata;
opt-in and opt-out information;
suppression lists;
automation and workflow data; and
other information submitted, synchronized or generated through integrations enabled by the customer.
Clicks on tracked links in messages are recorded per contact by redirect only, without a pixel or a cookie.
Depending on the features a customer uses, Customer Data may also include: WhatsApp message media (images, documents, audio and video); responses to WhatsApp Flows (forms inside WhatsApp); records of opt-in and opt-out per topic (for example marketing, order updates and legally required notices), including the source and time of each record and, where a customer imports consent, the customer's own declaration for that import; submissions to a customer's public opt-in forms together with proof of the submission; product reviews collected for a customer's review provider; back-in-stock requests; and events from a customer's online store used to measure the results of the customer's messaging.
3.3 Usage, device and analytics data
When you use our websites or Services, we may automatically collect technical and usage information, such as:
IP address;
browser type and version;
operating system;
device information;
pages and screens viewed;
actions performed;
session information;
timestamps;
error and diagnostic information;
performance data;
approximate geographic information; and
cookie or similar identifiers.
On our websites, we use Google Analytics to understand how visitors use the websites, measure their performance and improve them. Google Analytics may process information such as browser and device information, page views, session information, approximate location information and pseudonymous identifiers stored through cookies or similar technologies. We do not use Google Analytics in the Galantis app. Product analytics in the Galantis app is described in section 3.6, and the cookies and similar technologies the app uses are listed in section 15.
3.4 Data received from third parties
We may receive information from third-party services where necessary to provide the Services, including:
Meta and the WhatsApp Business Platform;
Shopify and other e-commerce platforms;
CRM systems;
ERP systems;
marketing platforms;
integration providers; and
other services enabled by a customer.
For example, Meta may provide message delivery status, conversation events and other information required to provide WhatsApp functionality.
3.5 Data processed through AI-powered features
Certain Galantis features use artificial intelligence to help customers create, analyse, classify, evaluate or automate content and workflows.
Where a customer uses these features, information submitted to or required by the relevant AI functionality may be processed by our AI service providers. Depending on the feature, this may include prompts, instructions, message content, conversation context, customer information or other Customer Data selected or made available by the customer.
We use OpenAI as a subprocessor for certain AI-powered functionality. Where Customer Data is processed by OpenAI on our behalf, such processing is performed for the purpose of providing the relevant AI functionality and is subject to applicable contractual data protection obligations, including a Data Processing Agreement (“DPA”).
Where DigiFist processes Customer Data as a processor, OpenAI acts as a subprocessor in relation to such processing.
3.6 Product analytics in the Galantis app
With your consent, we measure how members use the Galantis app, in order to improve it, fix problems, keep it secure and support you. We ask for this consent per member and per workspace. Nothing is measured before you allow it, and you can change your choice at any time from your user menu. When Galantis staff access your workspace in a support session, nothing is measured.
If you allow it, we may measure:
the pages and screens you open and how you move between them, including the page address and the page you came from;
the features you use;
your progress in setting up Galantis;
how you use search and filters, without the text you type;
how fast pages load and the errors you run into in the app;
your device type, operating system, browser, screen size, language and time zone, and the app version.
What we measure at any given moment is listed in the app, under "What is collected", with a version number. If we want to measure more than that list, we first update the list and its version and ask for your consent again.
How it works:
Events are linked to your member id and your workspace, never to your name or e-mail address.
We do not currently run a product analytics tool inside the Services. If we introduce one, we will ask for your consent first and update this section. We do not pass your IP address on to PostHog.
We keep a record of each choice you make (what you chose, when, and which version of the explanation you saw) as proof of your consent.
PostHog keeps the events it receives no longer than needed for these purposes.
We do not sell this data and do not use it for advertising.
Session recording: we do not record your screen or your sessions in the Galantis app. If we ever want to, we will ask for your separate consent first and update this policy.
Legal basis: your consent (section 5.4). Withdrawing your consent does not affect measurement that took place before you withdrew it.
3.7 Support chat (Intercom)
In the Galantis app you can chat with our support team through Help → Chat with us. The chat is provided by Intercom, Inc. (United States), which processes this data on our behalf. The chat only loads when you open it yourself while you are signed in. It does not load before that, and it never loads during a support session in which Galantis staff access your workspace.
When you open the chat, we send Intercom your member id, your e-mail address, your name (if you entered one) and the language of the app, signed by us so that nobody else can chat in your name. Intercom also receives what you write and attach in the chat, and the technical data your browser sends when it connects to Intercom, such as your IP address and browser type.
We use this to answer your questions and to keep the history of your conversations with us.
Legal basis: performance of our contract with you, and our legitimate interest in helping you use Galantis.
Intercom hosts this data in the United States (see section 7). When you sign out, we remove the chat's cookies and browser storage from your browser.
Please only share your customers' personal data in the chat when it is needed to help you. Where you do, we process that data on your behalf as your processor, and Intercom acts as our subprocessor.
3.8 Setup and onboarding data
To provide the Services and help you get started, we record in your workspace how far its setup has progressed:
which setup steps are completed (for example connecting WhatsApp or your Shopify store) and when the setup guide was opened;
each attempt to connect a channel such as WhatsApp: who started it, which steps it went through and how it ended, including the reason when a connection failed.
This is service data, not product analytics. We need it to show your setup guide, to connect your channels and to help you when a step fails, and we use it to improve the setup process.
Legal basis: performance of our contract with you, and our legitimate interest in supporting merchants through setup and improving it.
This data is kept for as long as your workspace exists. When your workspace is deleted, it is deleted with it, except records that we must keep for security or legal reasons.
4. WHY WE USE PERSONAL DATA (PURPOSES)
We process personal data for:
4.1 Providing and operating the Services (account provisioning, authentication, delivering features).
4.2 Customer relationship management (contracting, onboarding, billing, support).
4.3 Security and abuse prevention (fraud detection, rate limiting, enforcing policies).
4.4 Compliance with legal obligations (accounting, tax, responding to lawful requests).
4.5 Improving our Services (analytics, debugging, product performance, feature planning).
4.6 Marketing to business contacts (where permitted): informing customers/prospects about DigiFist/Galantis updates and offerings, consistent with applicable law and opt-out rights.
5. LEGAL BASES (GDPR)
Where DigiFist is a controller, we rely on:
5.1 Contract performance: to provide the Services and support.
5.2 Legitimate interests: to secure, operate, and improve our business and Services (balanced against your rights).
5.3 Legal obligations: accounting/tax and compliance obligations.
5.4 Consent: for product analytics in the Galantis app (section 3.6), for certain marketing communications, and for non-essential cookies on our websites where required. You can withdraw your consent at any time: for product analytics, from your user menu in the app.
Where DigiFist is a processor, processing is based on the customer’s instructions and their legal basis as controller.
6. HOW WE SHARE PERSONAL DATA
We do not sell personal data.
We may disclose or make personal data available only where necessary for the purposes described in this Privacy Policy.
6.1 DigiFist affiliates and corporate successors
Data may be shared within the DigiFist corporate structure where necessary for administration, operations, security or delivery of the Services.
In the event of a merger, acquisition, restructuring, financing or sale of all or part of our business, personal data may be transferred as part of that transaction subject to applicable law.
6.2 Service providers and subprocessors
We use service providers to host, secure and operate the Services. Where they process Customer Data on our behalf, they act as our subprocessors. Where appropriate, such providers are subject to contractual confidentiality, security and data protection obligations.
Key providers include:
Laravel Cloud: Hosting of the Galantis app's servers (its API and background processing), database, cache and file storage, in the European Union; Laravel Cloud's own network also delivers the API and the Web SDK used on customers' storefronts
Cloudflare: Hosting of our web front ends, such as the pages of the Galantis app, with their encryption certificates, on Cloudflare's global network. Cloudflare processes request data, such as IP address and browser details, of people who load these pages. It does not carry the traffic of the Galantis API or of the Web SDK
Meta / WhatsApp Business Platform: WhatsApp messaging, message delivery, templates, WhatsApp Flows, conversation events and related platform functionality
OpenAI: AI-powered functionality, including content generation, analysis, classification, evaluation and automation features, only where AI features are enabled; data from the European Economic Area is processed by OpenAI Ireland Limited
Mailtrap: Delivery of service emails, such as sign-in links, invitations, account and service notifications, service alerts and payment notices, and of the export that answers a Shopify customer data request; hosted in the United States (see section 7)
Stripe: Payment processing for customers who subscribe directly with us
Shopify: Billing for customers who subscribe through the Shopify App Store
Intercom: Support chat in the Galantis app (member id, e-mail address, name, app language and chat messages), hosted in the United States
PostHog: Product analytics in the Galantis app, only with your consent, hosted in the European Union; your IP address is not passed on
Customer-enabled integration providers: E-commerce, review, measurement and other integrations activated by the customer (see section 6.4)
Payments. If you subscribe directly with us, you enter your card and billing details on a payment page hosted by Stripe. We do not receive or store your full card details. We share with Stripe only internal references to your organization and workspace. If you subscribe through the Shopify App Store, Shopify bills you for the Galantis app under its own terms.
Service emails. We send service emails (sign-in links, invitations, account and service notifications, service alerts and payment notices) through Mailtrap. One service email carries Customer Data: the export that answers a Shopify customer data request, which we send to the users of the workspace who manage its members. We do not use Mailtrap for marketing emails.
6.3 Meta / WhatsApp
Where customers use WhatsApp functionality, information is shared with Meta, the WhatsApp Business Platform and relevant infrastructure providers as necessary to deliver messages and provide the requested WhatsApp functionality.
The use of WhatsApp is also subject to Meta’s and WhatsApp’s applicable terms, privacy policies and data processing arrangements.
6.4 Customer-enabled integrations
Where a customer enables an external integration, information may be transmitted to or received from that integration according to the customer’s instructions.
Examples include: a customer's Shopify store, from which the Services synchronise products, inventory, customers, orders, fulfillments, checkouts and WhatsApp marketing opt-ins; a customer's Judge.me account, to which reviews collected in WhatsApp are posted; and a Meta measurement destination that a customer configures, to which the Services send conversion events. Conversion events are sent to such a destination only where the End Recipient's recorded marketing consent allows it, and the identifiers sent with them are not stored by the Services. Each integration is activated and directed by the customer.
6.5 Legal disclosures
We may disclose information where reasonably necessary to:
comply with applicable law;
comply with a valid court order or governmental request;
enforce our agreements;
protect our rights, users or systems;
investigate fraud, abuse or security incidents; or
protect the safety of individuals.
6.6 At your direction
We may also share information where you or our customer has expressly instructed or authorised us to do so.
7. INTERNATIONAL TRANSFERS
Galantis, its customers and its service providers may operate in different countries.
Our hosting platform, Laravel Cloud, stores the data of the Galantis app, including its database and file storage, in the European Union. Some of our service providers, listed in section 6.2, may process personal data outside the European Economic Area.
As a result, personal data may be processed outside Belgium or the European Economic Area.
Where personal data is transferred to a country that has not been recognised as providing an adequate level of data protection, we use appropriate safeguards where required under applicable law. These may include contractual safeguards such as the European Commission’s Standard Contractual Clauses or another legally recognised transfer mechanism.
Support chat (Intercom): Intercom hosts the data of our support chat in the United States. Intercom, Inc. is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. Our data processing agreement with Intercom provides for the European Commission's Standard Contractual Clauses if that framework no longer applies.
Service emails (Mailtrap): Mailtrap processes our service emails in the United States. These transfers rely on the EU-U.S. Data Privacy Framework. Our data processing agreement with Mailtrap provides for the European Commission's Standard Contractual Clauses and the UK Addendum if that framework no longer applies.
Product analytics (PostHog): PostHog hosts our product analytics data in the European Union (Frankfurt).
Our service providers may also maintain their own international processing infrastructure and subprocessors subject to their respective contractual data protection arrangements.
8. RETENTION
8.1 General principle
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.
After the applicable retention period, data is deleted, anonymised or otherwise rendered inaccessible in accordance with our technical and legal obligations.
8.2 Account, contract and billing information
Account, contractual and billing information may be retained throughout the customer relationship and afterwards where necessary for accounting, tax, legal, dispute resolution or compliance purposes.
8.3 Customer Data
Customer Data is generally retained according to:
the customer agreement;
customer configuration;
functionality of the relevant Service;
deletion instructions from the customer;
technical backup cycles; and
applicable legal requirements.
8.4 Deleting a workspace
The owner of a Galantis workspace can ask us to delete it. The workspace stops working when the owner asks. Until the deletion starts, 30 days after the request, the owner can still keep the workspace. The deletion is finished within 90 days of the request. The deletion removes the workspace's data from the Services, including its Customer Data, or overwrites it so that no personal data remains, except for the records listed below. We keep these for the period stated, counted from the day the deletion is finished, except where an item states its own count, and then delete them:
records of opt-in and opt-out (consent records, suppression records and preference receipts): 5 years, so that we can answer a dispute or a regulator's question about a message sent through the Services. In these records we replace an End Recipient's phone number and other contact identifiers with keyed digests (one-way codes made with a secret key). A record can be found when a person gives us their number, but the numbers cannot be read back from the records;
the workspace's activity log (which actions were taken in the workspace, by which Authorized User, and when, including records of our staff's access to the workspace and their support notes): 5 years, for security and to resolve disputes;
billing history (the plan, subscription events, usage, charges and invoices, and partner attribution and commission records) and the record that the organization used its free trial: 10 years, counted to the end of the tenth calendar year after the year in which the deletion is finished. We keep billing history because Belgian accounting law requires it, and the trial record so that a free trial is given only once.
Some items cannot be deleted while a record that we keep unaltered still refers to them: campaigns (with their versions and send batches), message templates, connected messaging accounts, forms (with their versions), WhatsApp Flows (with their related records) and the delivery log of service emails. We keep these items and the media files they use, including the personal data they contain (for example, the email address a service email was sent to), for as long as such a record refers to them.
Store data imported from Shopify is retained in the merchant's Galantis account until the merchant deletes it (Connections → Delete all Shopify data now), deletes the workspace, or lets a retention window the merchant approved after an uninstall elapse; Shopify's shop/redact request is recorded; customer redaction requests are always carried out.
When a workspace is deleted, the Galantis account of its Owner is deleted too if it was the Owner's last workspace. The Galantis accounts of the other people who were Authorized Users of the workspace are not deleted. Their rights over their account data are described in sections 11 and 12.
Copies of deleted data can remain in our technical backups until the backup cycle overwrites them (see 8.3).
Deleting a workspace does not delete product analytics data about Authorized Users. That data is held under a pseudonymous identifier.
8.5 Specific retention periods
Unless a customer deletes the data earlier, the Services apply the following periods:
anonymous store-visit events used for measurement: 90 days, after which visitor identifiers are removed;
identifiers sent to a customer's measurement destination: not stored;
detailed records of automation steps: 90 days; summaries of automation runs: 365 days;
links to the preference centre: valid for 30 days;
proof of a submission to a public opt-in form: kept for as long as the consent record it supports;
database backups: overwritten when their 7-day recovery window passes;
platform logs (application, access and system logs): 7 days;
message media: kept for as long as the message exists.
9. SECURITY
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, misuse or unauthorised access.
These measures include: separation of each customer's data within our systems; encryption of data in transit; separate, encrypted storage of the credentials customers connect to the Services; verification of messages we receive from messaging, commerce and payment providers before we process them; server-side enforcement of user roles and permissions; recording of every support session in which our staff work inside a customer's workspace, with the staff member, the reason and the requests made; and removal of secrets and unnecessary customer content from our logs.
These measures may include access controls, authentication mechanisms, encryption, logging, monitoring, infrastructure security and internal organisational controls.
No method of transmission or storage can provide absolute security, and we cannot guarantee that all security incidents can be prevented.
10. CHILDREN / MINORS
The Services are intended for businesses and professional users and are not directed at children. We do not knowingly offer Galantis directly to individuals under 18 years of age.
11. YOUR RIGHTS
Subject to applicable data protection law, you may have rights including:
the right to be informed about how your personal data is processed;
the right to access personal data relating to you;
the right to request correction of inaccurate data;
the right to request deletion of personal data;
the right to restrict certain processing;
the right to data portability where applicable;
the right to object to processing based on legitimate interests;
the right to withdraw consent where processing is based on consent; and
the right to lodge a complaint with a competent data protection authority.
These rights may be subject to limitations and exceptions under applicable law.
If you are an End Recipient whose personal data is processed by one of our business customers through Galantis, the relevant business is normally the controller. Requests concerning such processing should therefore generally be directed to that business.
We will assist our customers in responding to valid data subject requests where required by applicable law and our contractual arrangements.
12. HOW TO EXERCISE RIGHTS / CONTACT
For privacy questions or requests relating to processing for which DigiFist is the controller, you may contact us at:
Please include “Galantis Privacy Request” in your request where applicable.
You may also contact us at:
DigiFist BV
BE 0769.399.149
Ellermanstraat 14
2000 Antwerpen
Belgium
We may request information reasonably necessary to verify your identity before fulfilling certain privacy requests.
13. LINKS TO OTHER WEBSITES / THIRD-PARTY SERVICES
Our Services may contain links to, integrate with or depend on third-party platforms and services.
Those third parties may process personal data under their own terms and privacy policies where they act independently from DigiFist.
We encourage users and customers to review the privacy information applicable to third-party services they choose to use or integrate with Galantis.
14. CHANGES TO THIS POLICY
We may update this Privacy Policy periodically to reflect changes to our Services, subprocessors, technology, business practices or applicable legal requirements.
Where changes are material, we may provide additional notice through the Services, our website, email or another appropriate channel.
The “Last updated” date at the top of this Privacy Policy indicates when it was most recently revised.
15. COOKIES AND SIMILAR TECHNOLOGIES IN THE GALANTIS APP
The Galantis app stores a small amount of information in your browser: cookies, local storage (kept until it is removed) and session storage (removed when you close the tab). The list below shows what is stored, by whom, why and for how long.
Strictly necessary items are needed to sign you in, keep you signed in and remember your choices, including your choice about product analytics. They do not need your consent.
Functional items belong to the support chat. They are only stored after you open the chat yourself, and we remove them when you sign out.
Analytics items are only stored after you allow product analytics. When you withdraw that consent, they are no longer used; you can remove them by clearing your browser data.
On our websites, a cookie banner asks for your consent for non-essential cookies such as Google Analytics.
What the Galantis app stores in your browser (in the names, [app id] is our Intercom app id and [project key] is our PostHog project key):
galantis.session_token(Galantis): Keeps you signed in to the Galantis app. Local storage, removed when you sign out. Strictly necessary.galantis.handed_session_token(Galantis): Holds a support session that Galantis staff opened, in that browser tab only. Session storage, removed when the tab closes. Strictly necessary.galantis.locale(Galantis): Remembers the language you chose for the app. Local storage, no fixed expiry. Strictly necessary.analytics-consent:…(Galantis): Remembers your choice about product analytics, per workspace and per version of the explanation. Local storage, no fixed expiry. Strictly necessary.Other Galantis entries (galantis.…, automationUpgradePrompt:…) (Galantis): Remember interface states, such as notices you dismissed and unsaved drafts. Local or session storage. Strictly necessary.
intercom-session-[app id](Intercom): Keeps your chat session and gives you access to earlier conversations. Cookie, 1 week; removed when you sign out. Functional (only after you open the chat).intercom-device-id-[app id](Intercom): Recognises the device that uses the chat, to prevent abuse. Cookie, 270 days, renewed while you use the chat; removed when you sign out. Functional (only after you open the chat).intercom-id-[app id](Intercom): Anonymous identifier of the chat visitor. Local storage, no fixed expiry; removed when you sign out. Functional (only after you open the chat).ph_[project key]_posthog(PostHog): Holds the identifiers and settings of product analytics in this browser. Local storage, no fixed expiry; stops being used when you withdraw consent, removed when you clear your browser data. Analytics (only with your consent).__ph_opt_in_out_[project key](PostHog): Remembers your product analytics choice in this browser. Local storage, no fixed expiry. Strictly necessary (remembers your choice).ph_[project key]_window_id,ph_[project key]_primary_window_exists(PostHog): Tell browser tabs apart within one analytics session. Session storage, removed when the tab closes. Analytics (only with your consent).
