Privacy Policy
Transparent data practices designed to safeguard your merchant business and protect your end-customers' privacy.
1. Overview & Data Roles
OrdersPilot ("OrdersPilot", "we", "us", or "our") operates an enterprise Order Management System (OMS) purpose-built for high-volume D2C e-commerce brands running on Shopify. This Privacy Policy governs the processing of personal data collected through our website (https://orderspilot.com), our Shopify App application, and our integrated platform services.
As a Data Processor
When processing end-customer order details, shipping addresses, telephone numbers, and COD verification logs on behalf of connected Shopify merchants, OrdersPilot acts strictly as a Data Processor(Data Fiduciary's processor under DPDP Act).
As a Data Fiduciary
For direct merchant account signups, business contact details, platform usage metrics, and subscription billing information, OrdersPilot acts as the Data Fiduciary (Data Controller).
2. Information We Collect
We collect only the minimum necessary information required to operate a high-reliability OMS, execute automated COD verification workflows, sync multi-store inventories, and route courier orders.
A. Merchant Account Information
Collected when you register or install the OrdersPilot Shopify App:
- Full Name, business email address, phone number, and store domain URLs.
- Company registration details, GSTIN/Tax ID (where applicable in India), and billing contact address.
- OAuth access tokens granted by Shopify for store administrative scope.
B. Connected Store & End-Customer Data
Synced automatically via official Shopify Webhooks and APIs:
- Order Details: Order ID, transaction value, line items, SKU variants, discount codes, and payment status (COD vs Prepaid).
- Customer Identifiers: End-customer name, shipping address, billing address, phone number, pincode, and city.
- Fulfillment & Logistics Data: Air Waybill (AWB) numbers, courier assignments, pincode serviceability check results, and RTO status.
C. COD Verification & Communication Logs
- Automated WhatsApp message logs, customer confirmation/cancellation responses, and timestamp history.
- Calling team operation logs: Agent IDs, call duration, alternate phone numbers collected, and confirmation status updates.
D. Technical & Telemetry Information
- IP addresses, browser type, operating system, API request headers, and performance audit logs.
- Essential session cookies for merchant authentication and portal security.
3. Purpose of Processing
We process your data strictly for legitimate operational purposes under lawful business bases:
- COD Verification & RTO Reduction: Dispatching automated WhatsApp confirmation flows and queueing unconfirmed orders to your staff calling team to eliminate fake or invalid orders before shipping.
- Multi-Store Inventory Synchronization: Syncing stock levels in sub-second intervals across 2+ connected Shopify storefronts to prevent stockouts and overselling.
- Courier Intelligence & Label Printing: Validating pincode serviceability, matching orders with optimal logistics carriers (e.g., Delhivery, Shiprocket, DTDC, Bluedart), and batch-generating shipping labels.
- Analytics & Contribution Margin Tracking: Calculating order unit economics, calling team KPIs, and courier performance scorecards.
- Security & Regulatory Compliance: Detecting fraud, preventing security threats, enforcing audit trails, and adhering to Indian tax and privacy statutes.
4. Sub-Processors & Data Sharing
We NEVER sell, rent, trade, or monetize merchant data or customer personal information. Data is shared only with trusted sub-processors strictly necessary to execute our core services:
| Sub-Processor Category | Entity / Partners | Purpose |
|---|---|---|
| Cloud Hosting & Infrastructure | Amazon Web Services (AWS) / Vercel Inc. | Encrypted database storage, API servers, and web application hosting. |
| E-Commerce Platform API | Shopify Inc. | Order sync, inventory updates, and billing reconciliation via Shopify Partner API. |
| Messaging Gateways | Meta (WhatsApp Business API Service Providers) | Transmitting automated order confirmation and tracking notification messages. |
| Logistics & Courier APIs | Delhivery, Shiprocket, DTDC, Bluedart | Generating Air Waybills (AWBs), pincode serviceability checks, and shipping status tracking. |
5. Data Security & Safeguards
OrdersPilot implements multi-layered security controls designed to safeguard commercial and personal data:
6. Data Principal Rights & Deletion
In compliance with India's Digital Personal Data Protection (DPDP) Act 2023/2026 and international privacy standards, merchants and end-customers possess the following rights:
- Right to Access & Summarization: Request a copy of all personal data held under your merchant account.
- Right to Correction & Erasure: Request correction of inaccurate data or deletion of stored personal records.
- Automated App Uninstallation Deletion: When a merchant uninstalls the OrdersPilot app from Shopify, an automated 30-day purge cycle initiates to permanently delete cached customer store data, unless retention is legally mandated.
- Shopify Data Redact Webhooks: OrdersPilot automatically honors Shopify's
customers/redactandshop/redactmandatory GDPR/DPDP webhooks within 48 hours.
7. Grievance Officer & Contact Details
In accordance with the Indian Information Technology Act 2000 and DPDP Rules, if you have questions, concerns, or grievances regarding our data practices or wish to exercise your data rights, please contact our designated Grievance Officer:
Grievance & Privacy Officer: OrdersPilot Privacy Desk
Company: OrdersPilot
Jurisdiction: India
Privacy Email: orderspilot@gmail.com
Response SLA: Acknowledgement within 24 hours; resolution within 15 business days.