Privacy Policy

1. Who We Are

PakkOrder ("we", "our", "us") is Pakistan's first automated COD order verification SaaS, accessible at pakkorder.com. We help Pakistani ecommerce merchants automatically verify Cash on Delivery orders via WhatsApp and Email before dispatch.

We are based in Karachi, Pakistan and were founded in 2026.

2. Information We Collect

When a merchant connects PakkOrder to Shopify or another supported store, the merchant instructs us to process the following customer data for COD order verification and transactional order updates:

• Buyer name — to personalise the verification message.
• Buyer phone number — to send one WhatsApp confirmation per order.
• Buyer email address — to send one Email confirmation per order.
• Delivery address — to confirm order details in the verification message.
• Order details — items, amount, and order ID provided by the merchant's store.

We do not collect payment card details, passwords, or any sensitive financial information from buyers.

3. How We Use Buyer Data

Buyer data is used only to verify a COD order, deliver transactional confirmation or delivery updates requested by the merchant, prevent duplicate or abusive orders, and report the resulting order status to that merchant. Merchants can review this processing before connecting their store through this policy and our Terms of Service. We do not:

• Send marketing messages to buyers.
• Track buyers outside merchants and orders connected to PakkOrder.
• Use buyer data to train AI models.

4. Data Sharing

We do not sell, rent, or trade buyer data. We share data only with the following third-party service providers that are strictly necessary to operate PakkOrder:

• Meta (WhatsApp Cloud API) — to deliver the WhatsApp order confirmation message.
• Resend — to deliver the email order confirmation message.
• Google Firebase — to store order records and merchant account data securely.
• The merchant (store owner) — order confirmation and cancellation status is shared back with the merchant whose store generated the order.

Each provider processes data only as instructed and is bound by their own privacy commitments.

5. Data Retention

Direct customer identifiers and order contents (name, phone, email, address, product details, and linked Shopify order identifier) are automatically redacted after 90 days from the date the order was created. Non-identifying operational fields, such as status, timestamps, amount, and delivery metrics, may be retained for merchant reporting and service integrity.

Merchant account data is retained for the duration of the active subscription and deleted within 30 days after account cancellation.

6. Data Security

• All data is transmitted over HTTPS/TLS encryption.
• Firebase security rules restrict access so each merchant can only read their own order data.
• Phone numbers are masked in server logs (e.g., +92 3XX XXXXXXX).
• Access to unmasked order details and exports is authenticated and recorded in an access log.
• Customer identifiers are automatically redacted according to the retention period above.
• We do not store payment card information — billing is handled by third-party payment processors.

7. Merchant Instructions and Data Processing

For customer data supplied through a connected store, the merchant is the controller and PakkOrder acts as its service provider or processor. We process that data only to provide the documented PakkOrder functionality, follow the merchant's lawful instructions, protect the service, and meet legal obligations.

Our Data Processing Terms form part of every merchant's agreement with PakkOrder. Shopify privacy webhooks are supported for customer data access, customer redaction, and shop redaction requests.

8. Your Rights (Buyers)

If you are a buyer whose data was collected as part of a COD order verification, you have the right to:

• Request a copy of your personal data we hold.
• Request correction of inaccurate data.
• Request deletion of your data before the 90-day automatic expiry.

To exercise any of these rights, contact us at the details below. We will respond within 7 business days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of PakkOrder after changes are posted constitutes acceptance of the updated policy.

10. Contact Us

For any privacy-related questions, data deletion requests, or concerns: