Privacy policy
Last updated: October 17, 2026
Plug : Order Confirmation sends a merchant's customers a WhatsApp message asking them to confirm their Cash on Delivery orders before they ship. This page explains what the app stores, why, who it is shared with, and how to have it erased.
In short: to confirm an order we need the customer's name, phone number, order number, order total and delivery city, and we send them to WhatsApp to deliver the message. We use them for nothing else — no marketing, no advertising, no tracking — and we never sell data to anyone.
Who we are
The app is built and run by Plug Software. In this policy, “we” means Plug Software, “you” means the merchant who installed the app, and “customers” means the people who place orders in your store.
What the app does
When a new order is paid by Cash on Delivery, the app sends the customer a WhatsApp message with the order's details and buttons to confirm or cancel it. Their answer is recorded on the order in your Shopify admin — as a tag, and, if you turn it on, by releasing or keeping a hold on the order's fulfillment.
What we store about your store
- Your shop's address (for example your-store.myshopify.com) and the access token Shopify issues when you install the app, so the app can act on your behalf.
- Your settings, such as which payment methods count as Cash on Delivery and whether orders are held until confirmed.
- Basic account state, such as whether setup is finished, which plan your shop is on and how many confirmations it has used.
- Your store owner's name and email addresses, as Shopify provides them, so we can send you a welcome email with setup tips after you install the app. We never share them or use them for advertising.
What we store about your customers
Only for orders paid by Cash on Delivery, and only what's needed to confirm them:
- Name and phone number, to address and send the WhatsApp message. Phone numbers are encrypted in our database.
- Order number, order total and delivery city, which appear in the message so the customer recognises the order.
- The confirmation itself: when the message was sent, whether it was delivered and read, and whether the customer confirmed or cancelled.
We do not store payment details, full addresses beyond the city, or what the customer bought. We never message customers about anything except confirming their own order.
The Shopify permissions we ask for
- Orders — to see new orders, tell which are Cash on Delivery, and tag them with the customer's answer.
- Fulfillment orders — to hold an order until it's confirmed and release it afterwards, whether you ship it yourself or through a fulfillment service.
- Customer name, phone and address — Shopify's protected customer data, needed to message the customer. We request these fields only.
We ask for nothing else. If a future feature needs another permission, Shopify will ask you to approve it before it takes effect.
Who else sees it
Messages are sent through the WhatsApp Business Platform, run by Meta, from Plug Software's verified business number. To deliver a message, Meta receives the customer's phone number and the message text. Meta handles that data under its own WhatsApp Business terms.
Apart from that, we do not sell, rent or share your data or your customers' data, and we use no advertising or analytics services inside the app. The only other parties involved are Shopify itself and the hosting and database providers that run our servers on our instructions.
Where data is kept
Data is stored in our database, on servers we control, and reached only over encrypted connections.
How long we keep it, and how to have it erased
- While the app is installed, we keep confirmation records so you can see each order's history in the app.
- When you uninstall, we stop using your data straight away and delete the access token. Shopify then asks us to erase the shop 48 hours later, and at that point your settings, your shop record and all of your customers' confirmation records are deleted from our database for good.
- When Shopify passes on a customer's request to see or erase their data, we answer it: we send you what we hold about that customer, or delete it.
- You can ask us to erase everything sooner, at any time, by emailing help.zainabfatima@gmail.com.
Security
All traffic runs over HTTPS. Customer phone numbers are encrypted at rest. The app signs into Shopify with short-lived session tokens rather than cookies, access tokens are stored server-side only, and every request from Shopify and from WhatsApp is verified before it is acted on.
Your rights
Depending on where you are, you may have the right to see, correct, export or erase the data we hold about you, or to object to how we use it. Email us and we will act on it within 30 days at the latest.
Changes to this policy
If we change how the app handles data, we will update this page and the date at the top. Meaningful changes are also announced in the app.
Contact
Questions, requests or concerns: help.zainabfatima@gmail.com.