Privacy policy
Effective date: 28 October 2026
This policy explains what personal data the Pakka COD Shopify app and the pakkacod.com website process, why, for how long, who else is involved, and how to use your rights. It describes what the app actually does today.
1. Who we are and how to contact us
- Service
- Pakka COD, an app for Shopify stores, and the website pakkacod.com
- Operator
- Pakka COD, a sole proprietorship based in Bengaluru, India
- Privacy and grievances
- Grievance Officer, Pakka COD — [email protected]
- General support
- [email protected]
“We”, “us” and “Pakka COD” mean the operator above. “Merchant” means a Shopify store that installs the app. “Buyer” means a person who places an order in a merchant's store. We have not appointed a Data Protection Officer; the grievance officer in section 15 answers questions about our processing.
2. Our role: processor for buyer data, controller for merchant data
- Buyer data. The merchant decides to use Pakka COD on their orders. For buyer data, the merchant is the controller (GDPR) and Data Fiduciary (India's Digital Personal Data Protection Act, 2023, “DPDP Act”). We are their processor / Data Processor and process buyer data only to provide the app to that merchant, on their instructions. Buyers should contact the store they ordered from first; see your rights.
- Merchant data. For the merchant's own account details, settings, billing status and support messages, we are the controller / Data Fiduciary.
- Website visitors and people who email us. We are the controller / Data Fiduciary.
Our data processing summary describes the processor terms for merchants.
3. What data we process
3.1 From Shopify, when a merchant installs the app
The app asks Shopify for one permission: to read and edit orders. It needs this to be told about new orders and to add tags and notes to them. It does not request access to customer accounts or to orders older than Shopify's default window.
| Data | Why |
|---|---|
| Store address (for example yourstore.myshopify.com) and the access key Shopify gives the app | To work with that store in Shopify: adding tags and notes, and billing. |
| Plan, Shopify subscription ID, install and uninstall dates | To apply your plan's limits and features. |
| Your app settings: confirmation policy, risk thresholds, nudge settings, default country, AI check on/off | To run the app the way you configured it. |
| Your WhatsApp Business details: phone number ID, template name and language, optional provider URL, and your access token and app secret | To send confirmations from your WhatsApp account and to check that incoming WhatsApp replies really come from Meta. The access token and app secret are encrypted (AES-256-GCM) before they are stored. |
| A random callback address and verify token created by the app | To receive and check WhatsApp replies for your store. |
3.2 About buyers, from each new order (processed for the merchant)
The app looks only at orders that use cash on delivery. Non-COD orders are ignored and nothing about them is stored.
| Data | What we do with it | Stored? |
|---|---|---|
| Phone number | Normalised to international format, checked, used to send the WhatsApp confirmation, and to link the buyer's earlier orders in the same store. | The number itself: yes, until it is erased (see retention). A keyed hash (a one-way code, different for every store) is kept for repeat-order history. |
| First name | Put into the confirmation message (“Hi Asha”). | Yes, until erased with the phone number. |
| Full name | Checked in memory for signs of a fake or missing name (one risk signal). | No, only the first name is stored. |
| Shipping address (address lines, city, state, postcode, country) | Checked for completeness and postcode format; used to spot duplicate orders. Optionally sent to the AI address check (section 8). | No. The address text is never saved. Only a keyed hash is stored. |
| Shopify order ID, order number, customer ID, order total, currency, item count | To track the order, apply value rules and link records for data requests. | Yes, except item count, which is used only in memory. |
| Risk score, level and reasons | Calculated by the app (section 6) and shown to the merchant. | Yes. |
| Confirmation status, number of attempts, timestamps, and a delivery outcome (Delivered or RTO) if the merchant marks one | To run the confirmation flow and improve future risk scores in that store. | Yes. |
| WhatsApp message metadata: direction, type (confirmation, reminder, reply, status), WhatsApp message ID, delivery status, error code | To run reminders and record the buyer's reply. | Yes. Message contents are never stored. |
| Buyer's WhatsApp reply (button press or short text) | Read once to decide “confirm”, “cancel”, “stop” or “start”. | No, only the metadata above. |
| WhatsApp opt-out list | Buyers who replied STOP, UNSUBSCRIBE, “band karo” or similar, or whom the merchant added, are not sent further messages by that store. | Yes, but only as the store's keyed hash of the phone number, with the date and whether the buyer or the merchant added it. Never the number itself. |
The app also writes to the merchant's Shopify store: order tags such as cod-risk-high or cod-confirmed, and a short order note with the risk summary and confirmation result. That information then lives in the merchant's Shopify store, under the merchant's control.
3.3 Data-request exports
When Shopify forwards a buyer's request to see their data, the app builds a copy of what it holds about that buyer in that store and shows it to the merchant on the app's Privacy page, so the merchant can send it to the buyer.
3.4 When you contact us
If you email us, we receive your email address, name and whatever you write, and use it to reply.
4. What we do not collect
- No buyer email addresses: the app does not request or read them.
- No payment card or bank details. Merchant billing is handled by Shopify.
- No storefront tracking: the app adds nothing to the merchant's online store or checkout.
- No WhatsApp message contents are stored.
- We do not sell personal data, use it for advertising, or share it between merchants. Hashes are different for every store, so a buyer's history in one store is never used in another.
- We do not use merchant or buyer data to train or improve AI or machine-learning models.
5. How we use data, and the legal basis
We use the data above only to provide the app to the merchant it belongs to: scoring and confirming COD orders, tagging orders, billing, handling data requests and deletions, keeping the service secure, and giving support.
- Buyer data: we act on the merchant's instructions. The merchant is responsible for having a lawful basis (GDPR) or lawful ground (DPDP Act) and for telling buyers about the processing, for example in the store's own privacy policy.
- Merchant account data: needed to perform our contract with you (GDPR Art. 6(1)(b)); security and abuse prevention under our legitimate interests (Art. 6(1)(f)); and compliance with legal obligations (Art. 6(1)(c)). Under the DPDP Act, merchant data is processed for the purpose you gave it to us for (section 7(a)).
- Support emails: to answer you (legitimate interests, or your request).
6. Risk scoring and automated decisions
The risk score is a fixed set of rules, not a black box. Each rule adds or subtracts points and shows its reason (for example “Postcode missing” or “2 previous orders returned to origin”). Repeat-buyer signals use only the merchant's own records in Pakka COD.
The app never cancels or refuses an order by itself. A high score or a buyer's “cancel” reply only adds a tag and a note; a person at the store decides what to do and can override the result. The score is not used to make decisions with legal or similarly significant effects without human review.
7. WhatsApp messages and buyer opt-in
Pakka COD has no WhatsApp sender of its own. Each merchant connects their own WhatsApp Business account (Meta's Cloud API, or a provider with a compatible API), and confirmations are sent from the merchant's number using the merchant's credentials and approved template. Meta (WhatsApp) or the merchant's provider processes those messages under the merchant's own agreement with them, not as our sub-processor.
The merchant is responsible for having the buyer's opt-in to receive WhatsApp messages, as required by the WhatsApp Business Messaging Policy, for template approval, and for honouring opt-out requests. The app does not send SMS. If a merchant also sends SMS in India through other tools, the merchant is responsible for TRAI's commercial-communication rules (DLT registration of headers and templates, and consent).
Opting out. A buyer who replies STOP, UNSUBSCRIBE, “band karo” or a similar word is added to that store's opt-out list, any confirmation still in progress is stopped, and they get one message confirming the opt-out. The app then sends them no more WhatsApp messages for that store. They can reply START to opt back in. Merchants can also add or remove a buyer by order or phone number in the app. The opt-out applies only to the store it was given to.
8. Optional AI address check (Google Gemini)
The AI address check is off by default. It runs only if we have made it available in the app and the merchant switches it on in Settings. When it runs, the app sends only the address lines, city, state, postcode and country of the shipping address to Google's Gemini API and gets back a quality score and short list of issues. It never sends the buyer's name, phone number or email. If the check fails or times out, the order is scored without it.
Gemini is asked to return only a score and issue codes from a fixed list (for example “landmark missing”). Any other text it returns is discarded: nothing Gemini writes in its own words is stored, shown to the merchant, or added to Shopify order notes.
We use the Gemini API only through a paid Google Cloud account, and the app is built so that it will not call Gemini unless it is set up with that paid account. Under Google's Gemini API Additional Terms, Google does not use prompts or responses from paid services to improve its products; it processes them under its data processing terms and may log them for a limited time for abuse detection.
9. Service providers (sub-processors)
| Provider | What they do for us | Data involved |
|---|---|---|
| Fly.io, Inc. (USA) | Runs the app's servers. Our configuration uses Fly.io's Mumbai, India region. | All app data passes through it; server logs. |
| Supabase, Inc. (USA) | Hosts the app's PostgreSQL database. | All stored app data listed in section 3. |
| Google LLC (Gemini API) | Optional AI address check, only when switched on (section 8). | Address lines, city, state, postcode, country. |
| Cloudflare, Inc. (USA) | Hosts this website (pakkacod.com). Not used by the app. | Website request data (IP address, browser), processed by Cloudflare to deliver and protect the site. |
Not our sub-processors: Shopify (the platform the merchant chose; it sends us order data and bills you), and Meta/WhatsApp or the merchant's WhatsApp provider (the merchant's own provider; see section 7).
We will update this list before adding a new sub-processor. Merchants who want notice of changes can ask at [email protected].
10. International transfers
We are based in India. The providers above are US companies and may process data in India, the USA or other countries where they operate. Under the DPDP Act, transfers outside India are allowed except to countries the Government of India restricts; we will follow any such restriction. For personal data from the European Economic Area, UK or Switzerland, we rely on the Standard Contractual Clauses (or the UK addendum) in our providers' data processing terms, and we will sign Standard Contractual Clauses with a merchant who needs them. Ask at [email protected].
11. How long we keep data
These are the periods the app's code applies today.
| Data | Kept until |
|---|---|
| Buyer's raw phone number and first name | Erased automatically 30 days after the order's confirmation finishes (confirmed, cancelled, no response, failed or skipped). |
| WhatsApp message metadata (type, delivery status, message ID, time) | Deleted 90 days after it was recorded. |
| Order records: keyed hashes of phone and address, order IDs, customer ID, order number, amount, risk score and reasons, confirmation status, delivery outcome | Deleted 13 months after the order was received, so a year of repeat-buyer history works. Deleted earlier for a buyer when Shopify sends that buyer's erasure request, and for the whole store when Shopify sends the store erasure request. |
| Data-request exports | The phone number and first name inside an export are removed 30 days after the export is created; the rest of the export is deleted after 13 months, or earlier when Shopify sends an erasure request for that buyer (matched by customer ID or phone hash) or for the store. |
| WhatsApp opt-out list (keyed phone hash) | Kept while the merchant has the app installed, so the opt-out keeps being honoured. Deleted when the buyer opts back in, when Shopify sends that buyer's erasure request, or with all store data after uninstall. |
| Shopify access token (session) | Deleted immediately when the app is uninstalled. |
| WhatsApp access token and app secret | Deleted immediately when the app is uninstalled. |
| Everything else about the store (settings, orders, logs, exports, opt-out list) | Deleted when Shopify sends the store erasure request, 48 hours after uninstall. If that request never arrives, our own clean-up deletes it 25 days after uninstall, so it is always gone within 30 days. |
| Server logs | The app's log lines record store domains, order numbers and processing results. It does not deliberately log phone numbers, names or addresses. Logs stay with our hosting provider (Fly.io) for its standard log period; we do not copy them elsewhere. |
| Support emails | As long as needed to resolve your request and keep a record of it. |
Order tags and notes the app wrote into Shopify stay in the merchant's Shopify store until the merchant removes them.
12. Security
- All traffic to the app and website uses HTTPS (TLS).
- WhatsApp access tokens and app secrets are encrypted with AES-256-GCM before storage.
- Phone numbers and addresses used for history are stored as keyed HMAC-SHA256 hashes that differ for every store.
- Every message from Shopify is checked against Shopify's signature, and every message from WhatsApp against the merchant's Meta app secret. Anything that fails the check is rejected.
- Each store's data is kept separate, and staff access to production data is limited to the operator.
- Development and automated tests run against a separate local database, not the production database.
No system is perfectly secure. To report a vulnerability, email [email protected].
13. Personal data breaches
If we become aware of a breach affecting personal data we process, we will notify affected merchants without undue delay, and Shopify within 24 hours as Shopify's Partner Program Agreement requires, with what we know about the nature, scope and likely impact and what we are doing about it. We will help merchants meet their own duties, such as notifying a supervisory authority under the GDPR or the Data Protection Board of India and affected individuals under the DPDP Act and its Rules. Where we are the controller / Data Fiduciary, we will notify the authorities and affected people as the law requires.
14. Your rights (GDPR, DPDP Act and others)
If you are a buyer
The store you ordered from controls your data. The quickest way to see, correct or delete it is to ask that store. When a store owner handles your request in Shopify, Shopify tells our app automatically:
- Access: when the store requests your data in Shopify, the app prepares a copy of what it holds about you for the store to send to you.
- Erasure: when the store erases your data in Shopify, the app deletes your order records, message logs, earlier exports and opt-out entry for that store.
- Stop messages: reply STOP (or “band karo”) to the store's WhatsApp message at any time.
You can also email [email protected]. Tell us the store name and your order number or phone number. Because the store is the controller, we will pass your request to the store and help it respond, and we will tell you we have done so.
Rights you may have
- GDPR (EU/EEA, and similar UK law): access, rectification, erasure, restriction, data portability, objection, not to be subject to solely automated decisions with significant effects, and to complain to your data protection supervisory authority.
- DPDP Act, 2023 (India): to get a summary of your personal data and its processing, to correct, complete, update or erase it, to withdraw consent, to grievance redressal, and to nominate someone to act for you. You must use the grievance process (section 15) before complaining to the Data Protection Board of India.
If you are a merchant
You can see your settings in the app, change them, and delete everything by uninstalling (see uninstall and deletion). For a copy of your account data or any other request, email [email protected].
We will ask for enough information to confirm who you are and which store you mean. We do not charge for requests.
15. Grievance officer and complaints
- Contact
- Grievance Officer, Pakka COD
- [email protected]
We aim to acknowledge a grievance or rights request within 2 business days and to resolve it within 30 days. If a request is complex we will tell you why and how long it will take. If you are not satisfied you can complain to the Data Protection Board of India (for DPDP Act matters) or to your local data protection authority (for GDPR matters).
16. This website
pakkacod.com is a static website. It sets no cookies, runs no scripts, and uses no analytics, advertising or tracking tools, and no third-party fonts. It is served by Cloudflare, which processes technical request data (such as IP address and browser type) to deliver and protect the site. We do not receive a list of visitors.
17. Children
The app and website are for businesses. We do not knowingly collect data from children for our own purposes. Merchants are responsible for their own stores' rules on buyers' age.
18. Changes to this policy
If we change this policy we will update the effective date above. If a change materially affects how we handle merchant or buyer data, we will tell installed merchants in the app or by email before it takes effect.