Privacy policy

Last updated: 4 November 2026

OrderPing: WhatsApp Alerts ("OrderPing", "we") is a Shopify app operated by Appspedia. It sends WhatsApp messages about orders on behalf of the Shopify merchants who install it. This policy explains what data the app uses and why.

Data we collect from merchants

• Your store domain and the Shopify access token Shopify gives the app on install.
• Your app settings: which messages are on, message texts, language and country choices, the WhatsApp number you connect and, for the Business Platform option, your Meta phone number ID, account ID and access token (stored encrypted).
• Your plan and monthly message count, for billing through Shopify.

Data we process about your customers

To send order messages, the app receives order details from Shopify (order number, total, items, first name, phone number, language, shipping status). We store only what is needed to send and show the message log:

• The recipient phone number, order number, message type, send status and a short preview of the message.
• For Cash on Delivery confirmation: the order ID, phone number and whether the customer confirmed or cancelled.

Message logs and send records are deleted automatically after 90 days. We do not sell data, show ads, or use customer data for marketing.

Who processes the data

• WhatsApp messages are delivered either through our own WhatsApp gateway server (QR option) or through Meta's WhatsApp Business Platform (official option), depending on the merchant's choice.
• The app and its database run on our own servers (Contabo).
• Billing is handled by Shopify.

Your rights and deletion

OrderPing supports Shopify's privacy webhooks. When a customer asks a merchant to delete their data, we delete that customer's message records. When a merchant uninstalls the app, the connected WhatsApp session is removed at once, and all of the store's data is deleted when Shopify sends the shop deletion request (48 hours after uninstall).

Security

Data is sent over HTTPS. Access tokens for Meta are encrypted at rest. Access to the servers is limited to the app's operators.