Privacy

This website

This website sets no cookies, runs no analytics and loads no third-party scripts, fonts or trackers. It has no form that sends anything. If you write to us by email or WhatsApp, we receive what you send and nothing more.

What the app processes and why

Data	Why	Where it goes
Phone number	To place the order, to send the order confirmation and the optional after-order verification code, to find the buyer's earlier orders for the order page, and, when the merchant turns it on, to send one reminder about a checkout the buyer left without ordering.	The Shopify order and customer record; our database (a hashed copy for lookups, and an encrypted plain copy kept with the order for as long as the order exists in the store, removed on a customer data-deletion request, and deleted by the daily cleanup for a checkout that never became an order); the SMS provider the merchant configured.
Name, delivery address, pincode, email (optional)	To create the Shopify order and ship it. Email only when the merchant turns the field on.	The Shopify order; our database, encrypted and kept with the order for as long as the order exists in the store, removed on a customer data-deletion request and deleted by the daily cleanup for a checkout that never became an order.
Phone, name, delivery address, pincode, email (kept on the buyer's own device)	To fill in the next checkout on the same device. It is always on after an order, with no tick; the checkout shows a "Not you? Clear" link that wipes it and empties the form.	Only the buyer's own browser storage on that device (scrambled with a key kept on the device), for 180 days. It is not sent to us until the buyer uses it for an order.
Cancellation note (optional text typed on the order page)	To tell the merchant why the buyer wants to cancel.	Our database, encrypted and kept with the order; removed on a customer data-deletion request.
Order lines, totals, payment method, payment ids	To create the order, take online payment through the gateway the merchant made active (Razorpay, Cashfree or PayU), and show the order page.	Shopify; the merchant's active payment gateway (prepaid only); our database.
Name, phone number, email (prepaid only)	The active gateway's payment window needs them. Cashfree gets the name, phone, email when given and a one-way code made from the phone number. PayU gets the first name, the last 10 digits of the phone and the email (or the store's no-reply address when the buyer gave none).	Cashfree or PayU, only when the merchant made that gateway active.
IP address, user agent, pincode	COD risk scoring (whether to offer COD or ask for online payment) and abuse limits. The IP address is also shown on the order for the merchant's own fraud checks.	Our database, kept with the session; the IP address (not the user agent) also on the Shopify order's Additional details.
Click ids and UTM values (fbclid, gclid and similar), landing page address, storefront cart token	To report the purchase to the merchant's own Meta, Google Analytics 4 and Google Ads accounts, so ad spend is measured, and to show the merchant where the order came from.	The merchant's own pixel and conversion API accounts; the Shopify order's Additional details; our database for deduplication.

Every order Shopvia creates carries Additional details on the Shopify order (visible to anyone with access to the order in the Shopify admin and to apps the merchant allows to read orders), each only when it has a value: the order reference, full name, phone number, address, landmark, pincode, city, state, country, UTM values, click ids, cart token, landing page address, IP address, payment method, COD charge, and the app's own risk score, risk band, delivery range, variants, payment id and incentive applied. They stay on the Shopify order for as long as the merchant keeps the order; deleting the order in Shopify deletes them.

We process the minimum needed for these purposes. We never sell personal data, and we share it only with the services above that the merchant has configured: Shopify, the payment gateway, the SMS provider and the merchant's own ad and analytics accounts.

Decisions made by software

COD risk scoring changes which payment options are shown: cash on delivery, partial COD, or online payment only. By default only the high band is asked to pay online. A merchant can choose to block a band, and can override any decision from the Shopvia admin. Buyers who disagree can contact the merchant. No decision with legal or similarly significant effect is automated.

Consent

• Being built, not live yet: the storefront widget will read Shopify's customer privacy consent (analytics and marketing) on stores that show a consent banner, and fire no pixel or conversion call until consent is given. On stores without a banner, Shopify treats consent as given.
• The order confirmation and verification SMS are transactional messages about the buyer's own order, not marketing.
• The abandoned-checkout reminder is not transactional. It is off unless the merchant turns it on. It goes only to a number the buyer typed under the line that says so ("In case we need to contact you about your order, and for one reminder if you leave this page"), at most once per checkout and once per phone per store in 24 hours, never after an order or an online payment, and not between 21:00 and 09:00 IST. A reply of STOP stops it for that number at that store.
• A number that asked to stop is kept as a keyed hash only (no plain number), per store, also after a customer data-deletion request, so that the request to stop keeps being honoured. It is deleted with everything else on shop redaction.
• Customers' requests under Shopify's privacy webhooks are honoured: a data request is logged for the merchant to answer; a customer redaction deletes the customer's rows, contact and address data, cancellation notes, one-time order page links, OTP rows and tracking rows for that store, and takes that store's delivered and returned counts for the phone out of the shared risk history; a shop redaction deletes everything for an uninstalled store 48 hours after uninstall. The shared risk history keeps only a keyed hash of the phone and counts. Counts imported from a store's own Shopify order history or courier export have no per-order record and stay.

How long we keep it

A daily cleanup job enforces these periods.

• Checkout sessions that did not become an order, with their contact and address data: deleted 30 days after the last activity.
• Checkout sessions of an order, with their contact and address data: kept with the order for as long as the order exists in the store, and removed on a customer data-deletion request. The buyer's cancellation note follows the same rule.
• IP address, user agent and the storefront cart token: removed from every checkout session 7 days after it started.
• Orders: kept while the merchant uses the app, deleted on shop redaction.
• Requests to stop reminders (a keyed hash of the phone, per store): kept while the merchant uses the app, deleted on shop redaction.
• Message send log (a keyed hash of the phone, the template name, the status, the provider's message id and delivery status; no text, link or number): deleted 90 days after the attempt.
• Short links in messages hold an order id or a storefront page address and no personal data; they stop working 45 days after the order (7 days for a reminder) and are deleted 90 days after they were made.
• Details kept on the buyer's own device for the next checkout: 180 days, or until the buyer taps "Not you? Clear".
• Saved customer details (phone, name, the last few delivery addresses for prefill, delivered and returned counts for risk): deleted 1 year after the customer's last order or delivery outcome.
• OTP codes expire within minutes, and every OTP row is deleted 7 days after it was created.
• Widget telemetry (page pings, timings, fallbacks): 90 days.
• Tracking events: 180 days, then deleted.
• Audit log: 1 year, without personal data (phone numbers appear hashed or masked).
• One-time order page links (a sealed token valid for 60 seconds): deleted when used, and by the daily cleanup 1 day after they expire.

Security

• Every connection uses TLS (storefront to app, app to Shopify, the payment gateways and the SMS provider).
• Merchant credentials (gateway keys, SMS keys, pixel tokens) are encrypted with AES-256-GCM before they are stored and are never shown back in the admin.
• Phone numbers used for lookups are stored as keyed hashes.
• The database runs on managed, disk-encrypted storage in the hosting provider; backups inherit that encryption.
• Access to production is limited to the app owner; actions in the admin are written to an audit log with the actor.

More in the security note, including what we do not claim.

Contact

Data questions: OWNER_SUPPORT_EMAIL (the owner fills this in on data/contact.js). Security reports: the address in the app's security.txt.

The rules for using the app are in the Terms of Service.