Effective Date: January 1, 2025 · Last Updated: May 2026
Sovor Technologies ("we", "us", "our") operates the Sovor RTO Guard Shopify app ("the App"). This Privacy Policy explains how we collect, use, store, and share information when you install and use the App.
When you install the App, we collect and process the following data from your Shopify store:
• Order data — order ID, order value, payment method, order tags, created date
• Customer phone numbers — used solely for sending WhatsApp verification messages
• Shipping addresses — city, state, PIN code used for risk scoring and label generation
• PIN code risk data — aggregated and anonymised cancellation rates per PIN code contributed to and read from the shared network index. No customer PII is stored in this index.
• Shop configuration — WhatsApp configuration data, billing preferences, and app settings
To power our fraud detection service, we aggregate anonymised cancellation and RTO patterns at the PIN code level across our merchant network. This means:
• No individual customer PII (name, phone, email) is ever stored in this network index
• Only aggregate statistics per PIN code (e.g. cancellation rate, order volume) are shared across merchants
• Merchants who opt into Network Protection contribute to and benefit from this shared index
• You may opt out of the network at any time from Settings → Network Protection
• Sending WhatsApp COD verification messages to your customers on your behalf
• Calculating RTO risk scores for orders and PIN codes to power the COD checkout blocker
• Free RTO Audit on install — when you install the app, we process up to 60 days of your historical order data to calculate your store's RTO rate, estimated losses, and high-risk PIN codes. This runs automatically on install and the results are displayed on your dashboard.
• Displaying analytics and reporting on your dashboard
• Managing your billing subscription via Shopify
Merchant as Data Controller; Sovor as Data Processor: When you install the Sovor COD app, you (the merchant) act as the Data Controller for your customers' personal data. Sovor Technologies acts as the Data Processor, processing end-customer data strictly on your instructions and solely for the purpose of providing the app's services.
As a merchant, you are responsible for:
• Ensuring your customers are informed that COD orders may be subject to WhatsApp verification
• Maintaining a valid legal basis for processing your customers' personal data
• Complying with applicable data protection laws in your jurisdiction
Sovor will never use your customers' data for any purpose beyond delivering the contracted service.
• All data is stored on enterprise-grade Google Cloud infrastructure with SOC 2 compliant data handling
• Sensitive configuration data is encrypted at rest where applicable
• All data in transit is protected by TLS/HTTPS encryption
• We do not sell or rent your data or your customers' data to any third party
To deliver the Sovor COD app, we rely on the following third-party service providers. By using the app, you acknowledge that data may be processed by these providers under their respective privacy policies:
• Shopify — App platform & billing — Store info, order data via OAuth
• Gadget.dev — App hosting & infrastructure — All app data (Google Cloud, US)
• Meta (WhatsApp Business API) — Message delivery — Customer phone number, order details
• Microsoft Azure OpenAI — AI-powered features — Query text only, no PII
• Groq — AI-powered features — Query text only, no PII
All data is hosted on Google Cloud infrastructure in the United States. If you are subject to data residency requirements, please contact us before installing.
• Meta WhatsApp Business API — customer phone numbers are transmitted to Meta solely for message delivery. Subject to Meta's Privacy Policy.
• Shopify — order and customer data is synced via the official Shopify API under your store's OAuth consent.
Applicable Laws: We are committed to compliance with:
• GDPR (General Data Protection Regulation) — for users in the European Economic Area
• India's Digital Personal Data Protection Act 2023 (DPDP Act) — for users in India
• Saudi Arabia's Personal Data Protection Law (PDPL) — for merchants and customers in the Kingdom of Saudi Arabia
• UAE Federal Decree-Law No. 45 of 2021 — for merchants and customers in the United Arab Emirates
• Other applicable local data protection laws
Your Rights (Merchants & EEA/India Users):
• Right to Access — request a copy of data we hold about your store
• Right to Erasure — request deletion of all your store's data
• Right to Rectification — request correction of inaccurate data
• Right to Portability — request your data in a machine-readable format
• Right to Restrict Processing — request we limit how we use your data
• Right to Object — object to processing based on legitimate interests
To exercise any right, email [email protected] with subject line "Data Rights Request". We will respond within 30 days.
Data Protection Officer: Arvind, Sovor Technologies — [email protected]
The Sovor COD app embedded within Shopify Admin does not use third-party tracking cookies or advertising pixels.
Our app may use strictly necessary session cookies to maintain your authenticated state within the Shopify embedded interface. These cookies are essential for the app to function and cannot be disabled.
The sovor.store website may use Shopify's standard analytics to measure store traffic. No cross-site advertising tracking is used.
Security Measures: We implement the following technical and organisational measures to protect your data:
• All data in transit is encrypted via TLS 1.2+
• Sensitive configuration data is encrypted at rest using industry-standard protections
• Access to production data is restricted to authorised personnel only
• All significant data access events are logged in an immutable audit trail
• We conduct periodic security reviews of our infrastructure and code
• Order data is retained for 12 months from the order date
• Customer risk profiles are anonymised after 24 months — only aggregate PIN-level data is retained
• On app uninstall, your shop data is deleted within 30 days upon written request to [email protected]
• You may request a full export or deletion of your store's data at any time by emailing [email protected]
• Customer data deletion requests received via Shopify's GDPR webhooks are processed automatically within 30 days
• You may update or disable supported app features at any time from the Settings page
For any privacy-related questions or data requests, contact us at:
🏢 Sovor Technologies, India
© 2026 Sovor Technologies. All rights reserved. · Last Updated: May 2026