Privacy Policy

1. Introduction

RabbitROI ("we", "our", "us") is a Shopify application that provides a customizable Cash on Delivery (COD) checkout form, order and profit analytics, fulfillment tracking, and advertising attribution for Meta, TikTok, and Google Ads, including reporting which orders were delivered or returned back to your own ad pixels, and optional WhatsApp order messages to your customers. This policy explains what data we collect, why we collect it, and how it's handled — for both the merchants who install the app and the customers who submit orders through it.

RabbitROI is operated by Areez Mahmood, sole proprietor, trading as RabbitROI, who is the data controller responsible for the data described in this policy. RabbitROI is a product of Tele Sky Shop.

By installing or using RabbitROI, you agree to the practices described here.

2. Data We Collect From Your Store

To operate the app's features, we access the following via the Shopify Admin API:

• Orders, draft orders, and fulfillments — to build analytics (expected revenue, cash collections, net profit, return rate) and to track which orders are fulfilled, in transit, delivered, or returned.
• The customer on each order — name, email, phone number, and shipping address — to show repeat-customer and delivery analytics, to match courier results to orders, and for the conversion reporting you switch on (Section 10).
• Products and variants — to display product details in the COD form builder's live preview and to fetch real-time pricing when a customer submits an order.
• Theme files (read-only) — specifically your active theme's config/settings_data.json, so the "Auto" color option in the Form Builder can match the COD form to your store's own color scheme.
• Shop details — domain, currency, time zone, contact email, and access token, to maintain your authenticated session, report in your own time zone and currency, and email you about your account.
• UTM parameters on orders — for campaign attribution when reporting on ad performance.

3. Data Collected From Your Customers

When a customer submits the COD form on your storefront, we process the fields your form is configured to collect — typically name, phone number, email, delivery address, city, and any order notes — to create a real Shopify order on your behalf, marked with a pending/unpaid financial status appropriate for Cash on Delivery.

Around that order we also keep:

• Unfinished forms — if you turn on abandoned-form recovery, what a customer typed into a form they did not submit, so it can become a draft order you can follow up. Deleted when the customer asks, or with your store's data.
• A submission log — each form submission as it was typed, kept for 48 hours so an order that Shopify created with missing details can be repaired. A submission the form refused (a merchant's blocking rule, or a duplicate of an order already placed) is kept for 30 days, with its items and the buyer's IP address, so an order refused by mistake can be recovered.
• The buyer's IP address on each form order — saved as a hidden order detail (_buyer_ip) in your store, so you can find and block a buyer who places fake orders.
• Your block lists — the phone numbers, emails and IP addresses you choose to block or always allow in Fraud Prevention. Kept until you remove them, or, for a phone number or email, until that customer asks for their data to be erased.
• Orders held past your plan's limit — kept until they are released to your store, then emptied.
• Browser signals for your pixels — only if you add an ad-platform pixel to the form: the customer's IP address, browser user agent, and that platform's cookies and click ids. Nothing is collected for this purpose from a customer who declined marketing tracking (see Section 10).

This customer data is used only for the order and for the features described in this policy. It is never sold, and it is sent to an advertising platform only when you add your own pixel to the COD form, and then only to that pixel.

4. Courier Data

If you connect a courier account, we store the API credentials you enter and send that courier the tracking numbers of your orders, to fetch each shipment's delivery status and destination city. The courier receives nothing about your customers beyond what it already holds for the shipment. Credentials are used only for your store and are deleted when you remove the courier or uninstall the app.

5. Support and Account Emails

Messages you send through in-app support chat are stored so our team can answer them. We email your store's contact address about your account — installation, plan changes, and order-limit notices. We do not send marketing email to your customers.

6. How We Use Data

• Render and operate the COD form on your storefront (via a storefront script).
• Create real Shopify orders from COD form submissions.
• Compute analytics dashboards: revenue, cash collections, profit, returns, and delivery rates by courier and city.
• Track fulfillment and delivery status and surface orders that may need attention.
• Match the COD form's "Auto" colors to your theme.
• Report ad spend and performance when you connect Meta, TikTok, or Google Ads accounts (see Section 10).
• Report orders, and whether each was delivered or returned, to the ad-platform pixels you add (see Section 10).
• Answer support requests and email you about your account.
• Diagnose technical issues and maintain the reliability of the app.

We do not sell or rent your store's or customers' data, and we do not use it for our own marketing or share it with other merchants. The only sharing with advertising platforms is the reporting you switch on for your own pixels and ad accounts.

7. Data Storage and Security

Data is stored on Amazon Web Services (AWS) infrastructure in the ap-south-1 (Mumbai) region, behind services that enforce:

• Encrypted connections (HTTPS/TLS) for all data in transit.
• Encrypted storage for databases at rest.
• Access tokens and API credentials kept server-side, encrypted, and never sent to the browser.
• Access limited to the infrastructure and personnel required to operate the app.

AWS hosts and stores all app data. Content delivery and certificate services run from AWS's us-east-1 (United States) region, so data may be processed in India and the United States. Two other processors handle a narrow slice of it:

• SendGrid (Twilio) delivers the emails we send you about your account. It receives your store's contact email address and the content of those emails, and nothing about your customers.
• Cloudflare runs a relay that fetches delivery statuses from couriers whose systems block requests from AWS. It passes the courier's reply to our servers without storing it.

No other vendor, contractor, or affiliate has access to your data.

8. Data Retention

We retain your store's data for as long as RabbitROI remains installed. Upon uninstallation, your store's data is deleted within 30 days, except where retention is required to comply with a legal obligation. Some data is kept for much less:

• The COD form submission log — 48 hours; 30 days for a submission that was refused or merged as a duplicate.
• Browser signals kept for delivery reporting — until the delivery outcome is reported, and never longer than 45 days.
• Ad-platform and courier credentials — until you disconnect them.
• Fraud Prevention block lists — until you remove the entries.
• WhatsApp verification codes — 24 hours, stored only as a hash.

When Shopify tells us a customer has asked for their data to be erased, we delete their customer record, unfinished forms, submission log entries, held orders, browser signals, and WhatsApp message log, remove their phone number and email from your block lists, and remove their identity from the orders we keep for your accounting.

9. Third-Party Services

We rely on the following third parties to operate the app:

• Shopify — for authentication, order creation, and store data access.
• Amazon Web Services (AWS) — hosting and storage.
• SendGrid and Cloudflare — as described in Section 7.
• Courier companies you connect — to fetch delivery status (Section 4).
• Meta, TikTok, and Google Ads — only if you connect an account, as described in Section 10.
• Meta, TikTok, and Snapchat Conversions APIs — only for pixels you add, as described in Section 10.
• Meta (WhatsApp Business Platform) — only for WhatsApp messages a store turns on, as described in Section 11.

Each provider is governed by its own privacy policy in addition to this one.

10. Advertising Integrations

Every integration below is optional, works only for the accounts and pixels you choose, and uses data only to serve your own store. Ad platform data is never sold, never shared with other merchants, never used to build cross-merchant profiles, and never used to attempt re-identification of aggregated or de-identified information. Tokens are stored server-side, scoped to the single store that authorized them, and deleted when you disconnect or uninstall.

Ad spend reporting (Meta, TikTok, Google Ads)

When you connect an ad account, we read the campaign and ad-account identifiers and the daily spend and performance figures for the accounts you select, to show your return on ad spend inside your Shopify admin. On Meta this uses the ads_read permission. On Google Ads we request the adwords scope but only read reporting data. We do not post on your behalf and do not access personal profile data beyond what each platform exposes to identify your account.

RabbitROI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Conversion reporting to your own pixels

If you add a Meta, TikTok, or Snapchat pixel to the COD form, we send each order placed through the form to that pixel. Each event carries the order number, value, and currency; the customer's phone number, email, name, city, province, and country, hashed with SHA-256 before they leave our servers; and the customer's IP address, browser user agent, and the pixel's own cookies and click ids, which the platforms require to match the event and which are not hashed. Nothing is sent for a customer who declined marketing tracking.

For Meta pixels we also report each order's delivery outcome, as the events OrderDelivered and OrderReturned, once your courier reports it. To match the outcome to the original order, we keep that order's IP address, user agent, and Meta cookies and click ids until the outcome is sent, for no longer than 45 days. You can switch outcome reporting off under Pixels > Events.

You can give us a pixel's Conversions API token yourself, or connect your Meta business through Facebook Login for Business. Connecting grants a system-user token limited to the pixels you select, using the ads_read and business_management permissions only to find those pixels and send events to them.

We never change your ad accounts

RabbitROI does not request the ads_management permission. It never creates, edits, pauses, or deletes campaigns, ad sets, ads, audiences, custom conversions, budgets, bids, or creatives in any ad account. Choosing whether to optimise for delivered orders, and building any audience from returned orders, is done by you in your own Ads Manager.

11. WhatsApp Messaging

A store can choose to send its customers WhatsApp messages through RabbitROI. Every message type is off until the store turns it on, and messages are sent from RabbitROI's WhatsApp Business number on the store's behalf, naming the store in each message. We use the WhatsApp Business Platform provided by Meta Platforms, Inc.

The messages a store can turn on are:

• Verification codes — a one-time code sent to the phone number entered on the COD form, to confirm the number belongs to the person placing the order.
• Order confirmation — a summary of the order with buttons to confirm or cancel it. The reply is recorded on the order in the store's Shopify admin.
• Delivery updates — a message when the order is handed to the courier and when it is delivered.

We never send marketing or promotional messages over WhatsApp, and we never message a number that was not entered on that store's order.

What we process

• The customer's phone number, first name, order number, order total, store name, courier and tracking number — only the details the message needs.
• Verification codes, stored only as a one-way hash and deleted within 24 hours.
• A log of each message: the number it went to, its type, the order, and whether WhatsApp reports it delivered, read or failed.
• A customer's reply to an order confirmation (confirm or cancel). The text of any other message a customer sends is not stored.

Meta processes these messages as our WhatsApp provider under its own terms and privacy policy. Message content is encrypted between Meta's servers and the customer's phone.

Choices

A customer can block the number in WhatsApp, or reply STOP, and we will not message that number again for any store. A store can turn each message type off at any time. When a customer asks a store to erase their data, we delete their message log and verification codes along with the rest of their data (Section 8).

12. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access or export the data we hold about your store.
• Request deletion of your store's data.
• Withdraw consent at any time by disconnecting an integration or uninstalling the app.

Your customers' requests to access or erase their data reach us through Shopify, and we answer each one for the store it was made to.

To exercise these rights, contact us at areezmahmood7@gmail.com.

13. Government and Law Enforcement Requests

We have received no national security requests and no government requests for user data to date.

If we receive a request from any public authority for merchant or customer data, we will:

• Review its legality and require valid legal process before disclosing anything.
• Challenge or refuse requests that are unlawful, overbroad, or improperly served.
• Disclose only the minimum data strictly required by the request, never a full account or dataset.
• Record the request, our legal reasoning, our response, and everyone involved.

Where we are not legally prohibited from doing so, we will notify the affected merchant before disclosing their data.

14. Children's Privacy

RabbitROI is intended for use by Shopify merchants operating businesses. We do not knowingly collect data from individuals under 13 years of age.

15. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the app after a change constitutes acceptance of the revised policy.

16. Contact Us

Questions about this policy? Email areezmahmood7@gmail.com.