OrderSay Privacy Policy
Last updated: 6 November 2026
This policy explains what personal data OrderSay processes, how and why it is processed, who receives it, how long it is kept, and how you can ask for it to be deleted.
1. Who we are
OrderSay is a Shopify app that gives online stores a WhatsApp support inbox on the store's own WhatsApp number. OrderSay is operated by CHATINBOX YAZILIM ARGE VE TEKNOLOJI LIMITED SIRKETI, with its registered office in Istanbul, Türkiye, Turkish tax number 2091959267 ("OrderSay", "we", "us").
Privacy enquiries: privacy@ordersay.com.
2. Our two roles
- Processor for store data. When a store ("merchant") installs OrderSay, the merchant decides why and how the data in its inbox is used. We act as a processor for the customer and staff personal data that we process on the merchant's behalf to provide the messaging and order-support service, and we process it only on the merchant's instructions, under our Data Processing Agreement (DPA). If you are a customer of a store that uses OrderSay, please contact that store first about your data.
- Controller for our own business. We act as a controller for our own business account administration, billing, website enquiries (including the pilot form) and customer relationship management. Merchant customer data included in support materials remains subject to the DPA where we handle it on the merchant's behalf.
3. What data we process
3.1 Data we receive through Shopify's APIs
OrderSay asks Shopify only for read access to orders and customers (read_orders, read_customers). It never writes to the store.
- Store details: store domain, country, currency and time zone, and the language of the Shopify admin of the staff member using the app.
- Order data: order number and date, order status, items, totals, payment and fulfilment status, cancellation, refunds, shipping carrier, tracking number, tracking link and tracking status, estimated and actual delivery dates, return status.
- Customer data linked to an order: name and phone number, including the phone number stored on the order's shipping or billing address, and the customer's number of orders and total amount spent with the store. Our requests to Shopify do not ask for customer email addresses or the text of the postal address. Shopify's notifications to us can contain email addresses (order updates, uninstall notices and privacy requests) and postal addresses (order updates and uninstall notices); from those notifications we read only the identifiers, store domain and phone numbers we need, and we do not store the email addresses or postal addresses.
We use this data to match an incoming WhatsApp message to the right customer and order, and to show the order, shipping and return details next to the conversation.
3.2 Data we receive through WhatsApp (Meta Cloud API)
Messages arrive on the merchant's own WhatsApp Business number, which stays in the merchant's own Meta account.
- The customer's WhatsApp phone number and WhatsApp profile name.
- Message content and attachments sent by the customer (images and documents) or by the store (images). For every message we receive, we also store the message details that Meta sends with it, such as a shared location, a contact card, a reaction, a caption or a button reply. Attachment files are not downloaded or stored yet (section 6); once attachment storage is switched on, only image and document files will be downloaded, not audio or video files. A customer may include other details, such as an email address, in a message.
- If the store keeps using the WhatsApp Business app on the same number: the replies its staff send from the phone and, if the merchant agrees to share them when Meta asks on the phone, the past chats stored on the phone, including chats from before OrderSay was installed, with the same message details (files in past chats are not downloaded). We do not store the phone's contact list.
- Message metadata: message identifiers, timestamps, and delivery and read status.
- Records of a customer's opt-out, when a customer writes STOP, BAJA or ALTO. An opt-out blocks every template message to that customer, not only marketing ones.
- Identifiers of the merchant's WhatsApp Business account and phone number, and the access credentials that Meta issues for them. We store these credentials encrypted.
3.3 Data we receive from merchants and their staff
- Staff members' Shopify user identifiers, the role each has in the app, and when each staff member first and last used the app.
- Data that staff create in the app: replies, notes, task assignments, labels and corrections.
- Support requests and correspondence with us.
- Billing status. Subscriptions are charged through Shopify Billing; we never receive card numbers or bank details.
3.4 Data generated automatically
- Security and audit logs: which staff account did what and when (for example who opened an order card, assigned a conversation or changed its status).
- Server logs and error records, in which phone numbers are masked and access credentials never appear.
Product analytics are not enabled. We will update this policy before enabling an additional monitoring or analytics provider, and will follow the DPA's sub-processor notice procedure where it applies.
OrderSay has no storefront component. It places no cookies or trackers on the store's website and does not track how shoppers browse a store.
3.5 Visits to ordersay.com
This website sets no cookies, runs no analytics and loads nothing from other sites; its fonts and images come from ordersay.com itself. The website is hosted on Cloudflare Pages. Cloudflare processes standard request data (IP address, time, page requested, browser type) to deliver and secure the site. If you write to us by email or with the pilot form (your name, email, store address and note), the pilot form, which runs on Cloudflare Workers, sends your message through Cloudflare Email Sending to our Microsoft 365 mailbox, and we use what you send only to answer you.
4. Why we process it
We use the data only to provide the OrderSay service:
- Receive and send WhatsApp messages on the merchant's number and show them in a shared inbox.
- Match a message to the right Shopify customer and order, and show order, shipping and return information.
- Help staff answer "where is my order?" questions from verified order and tracking data. Order-status replies are sent automatically only when the merchant switches on automatic answers outside business hours.
- Assign conversations to staff; once AI-assisted features are available (section 4.1), group and prioritise conversations as tasks with an explainable score.
- Keep the service secure: authentication, abuse prevention, audit logs, error records.
- Provide support, run billing through Shopify, and meet legal obligations.
We do not sell personal data. We do not use it for advertising, and we do not combine data from different stores. Each store's data is kept separate from every other store's data.
Marketing messages: the merchant is responsible for collecting opt-in consent before sending WhatsApp marketing templates. OrderSay blocks marketing templates to customers without a recorded opt-in, and every template to a customer who has opted out (section 3.2).
4.1 AI-assisted features
AI-assisted features are not available yet, and no conversation content is sent to an AI provider. Before AI processing becomes available, we will update this policy and the sub-processor list to identify the enabled models, recipients, processing locations and applicable retention exceptions, with the notice period set out in the DPA. AI processing will run only for a merchant that turns it on.
5. Legal basis
5.1 EU and UK (GDPR)
- As a processor, we act on the merchant's instructions under the DPA (GDPR Article 28). The merchant determines the legal basis for processing its customers' and staff's data in the inbox.
- For our controller processing, Article 6(1)(b) applies where processing is necessary for a contract with the individual, or for steps the individual asked for before a contract (for example a pilot request).
- We rely on Article 6(1)(f) (legitimate interests) for business-contact administration, answering enquiries and keeping the service secure; we are documenting the balancing assessment for this. You can object to this processing (section 9).
- Record-keeping that Turkish law requires of us is assessed under Article 6(1)(f).
5.2 Türkiye (KVKK, Law No. 6698)
For our own controller activities, we rely on Article 5(2)(c) for processing necessary for a contract with the individual, Article 5(2)(ç) for applicable legal record-keeping duties, and Article 5(2)(f) for necessary business-contact, enquiry and security processing that does not override individuals' fundamental rights and freedoms.
6. Where the data is stored and who receives it
Our application, database and queue are hosted by Render in Frankfurt, Germany. Message attachments are not stored yet; before we start storing them, we will add the storage provider and its location to this policy and to the sub-processor list, with the notice set out in the DPA. Other providers process data in the locations shown below.
Providers that process store data on our behalf (sub-processors). Each must be bound by a data processing agreement with us before it processes store data:
| Provider | Purpose | Location |
|---|---|---|
| Render | Application hosting: web service with its background jobs, PostgreSQL database and Key Value store (queue) | EU (Frankfurt, Germany) |
| Microsoft (Microsoft 365) | Company email, when a merchant's support request contains store data | Microsoft data centres; we are confirming the region of our account |
Providers under the merchant's own agreements. The merchant uses Shopify and the WhatsApp Business Platform under its own agreements with them. They process data under those agreements, not as our sub-processors:
| Provider | Purpose | Location |
|---|---|---|
| Shopify | App platform, store and order data, billing | As described in Shopify's own privacy terms |
| WhatsApp Ireland Limited or the other WhatsApp company named in the merchant's agreement (WhatsApp Business Platform) | Sending and receiving WhatsApp messages on the store's own number | EU / USA |
Providers for our own business (we are the controller).
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. (Pages, Workers, Email Sending) | Hosting ordersay.com; running the pilot form and passing its messages to our mailbox | Cloudflare's global network |
| Microsoft (Microsoft 365) | Company email: service and billing emails to merchants, privacy and support requests | Microsoft data centres; we are confirming the region of our account |
Render, Cloudflare and Microsoft belong to groups headquartered in the USA. Our team works from Türkiye, so authorised staff may access data from outside the EU, and WhatsApp and other Meta group companies may process WhatsApp data in the USA.
The applicable transfer mechanism for each recipient and processing activity is being documented with our lawyer. Transfers that require safeguards will not begin until those safeguards are in place. Where Turkish law (KVKK) applies to a transfer abroad, the mechanism required by Article 9 of Law No. 6698 must be in place before the transfer begins; EU Standard Contractual Clauses do not replace Turkish requirements. You can ask for a copy of the applicable safeguards at privacy@ordersay.com; we may redact commercial terms.
The same list of sub-processors, with the notice period for changes, is on our sub-processor page. We will update both before we add a new sub-processor.
We disclose data to authorities only when the law requires it.
7. How long we keep it
| Data | Retention | Counted from |
|---|---|---|
| Message content and conversation history | 12 months | The date each message was received or sent |
| Message attachments (media), once storage is switched on (section 6) | 90 days | The date the attachment was received or sent |
| Incoming WhatsApp notifications that could not be processed (they can contain a phone number, a profile name and message text) | 7 days | The time processing finally failed |
| Tasks and task history | 12 months | The date of each task entry |
| Audit logs | 24 months; when a store's data is deleted, its entries lose the link to the store and are kept for the rest of that period; entries keep the identifiers they record, for example Shopify customer and order numbers, the WhatsApp number's Meta identifier, and the store's identifiers in the entries for the store deletion request and for the deletion itself | The date of each entry |
| Customer contact records (WhatsApp phone number, profile name and the matched Shopify customer identifier), opt-out records and order matches | No fixed period: kept while the store uses OrderSay; deleted when the store forwards that customer's deletion request (section 8), or with the rest of the store's data after uninstall | The deletion request the store forwards, or receipt of Shopify's store deletion request |
| Data of a deleted customer | Deleted on request (see section 8); audit log entries that refer to the customer only by identifiers (for example, that a staff member opened their order card) and a "deleted" entry are kept until their 24 months end; the customer's Shopify identifier is kept as a deletion marker, so that their data is not tied to a conversation again, until the store's data is deleted | The deletion request the store forwards |
| Store data after uninstall | Deleted within 30 days | Receipt of Shopify's store deletion request (see section 8) |
| Merchant account records | Until the store's data is deleted after uninstall | Uninstall |
| Support correspondence | As long as needed to handle the request and its follow-up; we are setting a fixed period | The date the request is closed |
| Pilot-form and website enquiries | As long as needed to answer you and follow up on the pilot; we are setting a fixed period | The date of the last contact |
| Server logs and error records | As long as our hosting provider keeps them; we are setting a fixed period | The date of each entry |
| Accounting records | The period that Turkish tax and commercial law requires | As set by that law |
Earlier deletion obligations and valid merchant instructions take precedence where they apply.
8. How to request deletion of your data
Store customers. Ask the store you bought from. When the store forwards the request through Shopify, we delete that person's contact record, messages, order matches and attachments; order details held briefly in the server's memory are no longer used after five minutes and are cleared from memory later, at the latest when the server restarts. You can also email us at privacy@ordersay.com with the store's name and the phone number you used on WhatsApp. We will forward the request to the store and act on the store's instructions.
Merchants. Uninstalling OrderSay disconnects your WhatsApp number from OrderSay. Your WhatsApp Business account and number stay in your own Meta account. Following uninstall, Shopify normally sends us a store deletion request 48 hours later. Authorised staff complete the deletion within 30 days after we receive that request, subject only to the legal-retention exceptions in section 7 and the DPA. Self-service data export is not available. You can ask for a copy of your store's data at privacy@ordersay.com before you uninstall or within 7 days after uninstalling; we send it within 14 days of the request and before the deletion is completed. Unless the store owner asks us to delete earlier, we do not start deleting a store's data before that 7-day window has ended or while a requested copy has not been sent. If we end your access (Terms of Service, section 9), you can ask for a copy within 30 days; we delete the data once the copy is sent or the 30 days pass without a request. To request deletion earlier, email privacy@ordersay.com; we confirm the request with the store before deleting.
Our own users. If you are a merchant's account contact or wrote to us through the website, you can request access to, correction of or deletion of your data at privacy@ordersay.com.
Where we act as controller under the GDPR, we respond without undue delay and within one month of receipt; if Article 12(3) allows an extension, we tell you within that first month. Requests under KVKK are answered within 30 days. When we act as processor, we pass the request to the store without undue delay; forwarding it does not extend the store's own deadline.
9. Your rights
Your rights depend on the law that applies to the processing concerned. Under the GDPR you may have the right to access, correct, delete or export your personal data, to restrict processing, and to withdraw consent. Mexico's LFPDPPP gives "ARCO" rights.
Right to object. You may object, on grounds relating to your particular situation, to processing based on our legitimate interests (section 5.1).
Under KVKK Article 11 you may also ask whether and how your data is processed, learn its purposes and recipients in Türkiye or abroad, ask for corrections or erasure and for those to be notified to recipients, object to a result against you that arises solely from automated analysis, and claim compensation for damage caused by unlawful processing.
If we process your data as a processor for a store, we pass your request to that store. You can also complain to your data protection authority. In Spain this is the Agencia Española de Protección de Datos (aepd.es); in Türkiye, the Kişisel Verileri Koruma Kurumu (kvkk.gov.tr).
10. Security
- Encryption in transit (TLS) and at rest. Store and WhatsApp access credentials are additionally encrypted at the application level.
- Every query is limited to one store's data, and automated tests check this separation.
- Every incoming Shopify and Meta webhook is verified by its signature.
- Access to our production systems is limited to the staff who need it, and we are switching on two-factor authentication for every production account.
- If a personal data breach affects a store's data, we notify the store without undue delay, and within 72 hours at the latest.
11. Children
OrderSay is a business tool. It is not directed at children.
12. Changes to this policy
We will publish any change on this page and update the date above. Before a material change takes effect, we will notify merchants in the app or by email.
13. Contact
CHATINBOX YAZILIM ARGE VE TEKNOLOJI LIMITED SIRKETI, Istanbul, Türkiye
Email: privacy@ordersay.com