Legal

Privacy Policy

Last updated: 6 October 2026

1. Who We Are

PAKKA is a WhatsApp-based Cash on Delivery (COD) order confirmation service operated by Akash Murugan (sole proprietorship), trading as PAKKA, located at 14-1-115(2), Anna Nagar, Surandai, Tamil Nadu 627859, India. References to "PAKKA", "we", "us", or "our" in this policy refer to Akash Murugan operating under the PAKKA brand.

Our website is https://pakkaapp.app and you can contact us at hello@pakkaapp.app.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when merchants use our service or when we process customer data on behalf of merchants. It is written in compliance with India's Digital Personal Data Protection Act, 2023 (DPDPA).

2. Scope of This Policy

This policy applies to:

  • Merchants — individuals or businesses that sign up to use the PAKKA service.
  • End customers — individuals who have placed a COD order on a merchant's Shopify store and whose data is processed by PAKKA to send order confirmation messages on the merchant's behalf.
  • Visitors to https://pakkaapp.app.

3. Data We Collect

3.1 Merchant Account Data

When a merchant registers or connects their store to PAKKA, we collect:

  • Full name and business name
  • Email address
  • Phone number
  • Shopify store URL and credentials (access token provided via Shopify's OAuth flow)
  • Billing information (for subscription or usage-based payments, processed through a third-party payment processor)

3.2 Shopify Store and Order Data

To operate the service, PAKKA reads order data from a merchant's Shopify store via Shopify's API and webhooks. This includes:

  • Order IDs, order numbers, and order status
  • Ordered products (names and quantities)
  • Order total amount and currency
  • Shipping address (used to confirm order details with the customer)

3.3 Customer Data (Processed on Behalf of Merchants)

When a customer places a COD order on a merchant's Shopify store, PAKKA processes on the merchant's behalf:

  • Customer name
  • Customer phone number (WhatsApp-capable mobile number)
  • Order details as described in 3.2

PAKKA acts as a data processor for this customer data. The merchant is the data fiduciary (controller) and is responsible for obtaining lawful consent from their customers before using PAKKA to process their data.

3.4 Website Usage Data

We may collect standard server log data when you visit https://pakkaapp.app, including IP address, browser type, pages visited, and timestamps. This data is used solely for security and operational purposes.

4. How We Use Your Data

  • Sending order confirmation messages: Using the customer's phone number and order details to send a WhatsApp message asking them to confirm or cancel their COD order.
  • Receiving and processing responses: Reading the customer's WhatsApp reply and using it to update the order status in the merchant's Shopify store.
  • Merchant account management: Creating and maintaining merchant accounts, processing payments, and providing support.
  • Service improvement: Analysing aggregated, anonymised usage data to improve the reliability and quality of the service.
  • Communications: Sending merchants transactional emails related to their account, such as billing notices and service updates.
  • Legal compliance: Complying with applicable laws and lawful requests from government authorities.

5. WhatsApp and Meta as a Data Processor

PAKKA uses the Meta WhatsApp Business Cloud API — the official messaging API provided by Meta Platforms, Inc. — to send and receive WhatsApp messages. When we transmit a customer's name and phone number through this API to deliver a confirmation message, Meta processes that data as a sub-processor subject to Meta's own privacy policies and the applicable Data Processing Terms.

By using PAKKA, merchants acknowledge that order confirmation messages are delivered through Meta's WhatsApp infrastructure and agree to comply with WhatsApp's Business Policy and Commerce Policy when using PAKKA.

PAKKA is an independent software product and is not affiliated with, endorsed by, or a certified partner of Meta Platforms, Inc.

6. Legal Basis and Consent

Under the Digital Personal Data Protection Act, 2023, we rely on the following bases for processing personal data:

  • Consent: Merchants consent to our processing of their account data when they sign up to use PAKKA.
  • Legitimate uses (contractual necessity): Processing customer order data is necessary to deliver the service contracted by the merchant.
  • Legal compliance: Where required by law.

Merchants are responsible, as data fiduciaries, for obtaining valid consent from their end customers before directing PAKKA to send WhatsApp messages to those customers' phone numbers, in accordance with applicable WhatsApp policies and the DPDPA.

7. Data Sharing

We do not sell personal data. We share data only in the following limited circumstances:

  • Meta (WhatsApp Business Cloud API): Customer name and phone number are transmitted to Meta's API infrastructure to deliver WhatsApp messages.
  • Shopify: We read from and write to a merchant's Shopify store via the Shopify API (e.g., updating order status).
  • Hosting providers: Our infrastructure providers (such as cloud hosting and database services) may process data on our behalf under data processing agreements.
  • Payment processors: Billing data is shared with our third-party payment processor for subscription management.
  • Legal requirements: We may disclose data if required to do so by law, court order, or government authority.

8. Data Retention

We retain personal data only for as long as necessary to provide the service and meet our legal obligations:

  • Merchant account data: Retained for the duration of the merchant's subscription and for a period of up to two years after account closure for legal and audit purposes.
  • Order and customer data: Retained for up to 12 months from the date of the order confirmation message, or as agreed with the merchant.
  • Website logs: Retained for up to 90 days.

9. Data Security

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or alteration. These include:

  • Encryption of data in transit using TLS/HTTPS
  • Access controls limiting data access to authorised personnel only
  • Secure storage of API credentials using environment-based secrets management

No method of transmission over the internet is completely secure. If you believe your data has been compromised, contact us immediately at hello@pakkaapp.app.

10. Your Rights

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

  • Access: Request confirmation of whether we hold your personal data and obtain a copy of it.
  • Correction: Request that inaccurate or incomplete personal data be corrected.
  • Erasure: Request deletion of your personal data, subject to our legal obligations to retain certain records.
  • Withdrawal of consent: Withdraw consent for processing at any time (this will not affect the lawfulness of processing prior to withdrawal).
  • Grievance redressal: Lodge a complaint with us or, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, please email us at hello@pakkaapp.app with the subject line "Data Rights Request". We will respond within a reasonable timeframe in accordance with applicable law.

11. Children's Privacy

PAKKA's service is intended for use by businesses and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hello@pakkaapp.app and we will delete it promptly.

12. Cookies

Our website (https://pakkaapp.app) may use essential session cookies for basic functionality. We do not currently use tracking cookies, advertising cookies, or third-party analytics cookies. If this changes, we will update this policy and, where required, obtain your consent.

13. International Data Transfers

Customer data transmitted through the WhatsApp Business Cloud API may be processed on Meta's infrastructure, which may be located outside India. By using PAKKA, merchants acknowledge and agree to this transfer as part of the WhatsApp Business Cloud API service.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. If changes are significant, we will notify active merchants by email. We encourage you to review this policy periodically. Continued use of PAKKA after changes constitutes acceptance of the updated policy.

15. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact:

  • Name: Akash Murugan (operating as PAKKA)
  • Address: 14-1-115(2), Anna Nagar, Surandai, Tamil Nadu 627859, India
  • Email: hello@pakkaapp.app
  • Phone: +91 94898 33104