Privacy Policy

This policy explains how KHAALTI LLC ("we", "us"), the company behind COD PRO, handles information when a store uses the COD PRO app for Shopify, the COD PRO plugin for WordPress and WooCommerce, the COD PRO Agent API, or this website. Effective date: 26 September 2026.

1. Who is responsible for what

• Store data (the merchant's own account, settings and billing): we are the controller.
• Shopper data (the customers of a store): the store is the controller and decides why and how its customers are contacted. We process that data only on the store's instructions, to deliver the messages and features the store turned on. We act as the store's processor.

2. What we collect

• From the store: shop domain, store name, the owner's name, email and phone, app settings and message templates (including any voice audio or images the store uploads), support tickets, and billing records such as wallet top-ups, usage charges and plan status.
• About shoppers, from the store's orders: name, phone number, email, shipping address, order number, items and totals, and the payment method (to recognise cash-on-delivery orders).
• Created while the service runs: which messages and calls were sent, delivery and read receipts, the shopper's reply (for example "confirmed" or "cancelled", or the key pressed on a call), one-time verification codes used at the Cash on Delivery button, and timestamps. Stores see this as the order timeline.
• This website: we do not use advertising cookies or trackers. The site remembers your theme and language choice in your own browser. Our network provider processes technical data such as IP address to deliver and protect the site.

3. Why we use it

• To confirm, hold, follow up on and notify about orders exactly as the store configured (performance of our contract with the store).
• To bill the store, keep the wallet ledger and credit back messages that fail to deliver (contract and legal accounting duties).
• To keep the service secure and stop abuse, for example attempt limits and rate limits on messages and codes (legitimate interest).
• To answer support requests and send service emails to the store owner, such as low-balance alerts.

We do not sell personal data and do not use shopper data for our own marketing. Promotional messages such as campaigns are sent only for stores that turn them on, and only to shoppers who gave marketing consent in Shopify. Order confirmation and verification messages are transactional.

4. Who helps us deliver the service (sub-processors)

• Shopify: the platform the app runs in and bills through.
• Twilio: WhatsApp messages, SMS codes and automated voice calls.
• Twilio SendGrid: email delivery.
• Cloudflare: network security and this website.
• Groq: the in-app AI assistant. Only masked data without names, phone numbers or emails is sent to it.
• Our hosting provider: the application servers and database.
• Third-party address-search and mapping providers: suggest addresses while a shopper types their street in the COD form. Only the street text and the country are sent, never the shopper's name, phone number or cart, and we do not log what is typed. A list of these providers is available on request at info@codpro.app.

These providers may process data in the United States and other countries. Where the law requires it, transfers rely on appropriate safeguards such as standard contractual clauses.

5. How long we keep data

• While the app is installed: we keep the store's data so that order history, timelines and settings keep working.
• 30 days after uninstall: we delete the store's data, including shopper data, uploaded media, templates and support attachments. A reinstall before then cancels the deletion.
• What we keep after that: the financial records of charges, top-ups and credits, because accounting law requires them. If the store left an unspent prepaid balance, we also keep that balance and the store's basic account details, so the money can be returned or used on reinstall.
• Shopify privacy requests: we act on Shopify's customer data request, customer redact and shop redact webhooks. A redact request deletes the matching shopper's records, including their verification records.

6. Security

Data travels over encrypted connections. Access is limited to what each feature needs. Agent API keys are stored as hashes and can be revoked at any time. More detail is on our security page. No system is perfectly secure; if we learn of a breach that affects personal data, we will inform affected stores without undue delay.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to complain to a data protection authority.

• Store owners: email us and we will help directly.
• Shoppers: contact the store you ordered from first, since it controls your data. If you contact us, we will pass your request to that store and help it respond. Shopify also sends us the store's privacy requests automatically.

We offer a data processing agreement to stores that need one. Ask at info@codpro.app.

8. Children

COD PRO is a business tool for store owners. It is not directed at children.

9. Changes

If we change this policy, we will post the new version here with a new effective date. For important changes, we will also tell installed stores in the app or by email.

10. Contact

KHAALTI LLC, email info@codpro.app, WhatsApp or phone +1 813‑320‑9953.