Akdly privacy notice

Updated 20 September 2026. This notice describes Akdly's current controlled pilot for Shopify order confirmation. The merchant data processing agreement sets out the merchant's instructions and Akdly's responsibilities; the store owner can record acceptance inside the app.

Our role and contact

Akdly is operated by Ahmed Mohamed. Akdly processes order and message data on the store merchant's instructions. The merchant determines the purposes of customer messaging and is responsible for its notices and permissions. Contact Akdly at [email protected] for privacy questions.

What we process and why

• Store identifiers and encrypted Shopify credentials to install and operate the app.
• Customer name and phone, order items, value, payment and fulfillment information to identify eligible COD orders and request confirmation.
• Delivery events, customer replies, requested address changes and consent or opt-out records to process the chosen flow and support merchant review.
• Message identifiers, usage counters and audit records to prevent duplicates, enforce plan limits and investigate errors.

This release handles order-related messaging and does not offer marketing campaigns. STOP suppresses future app messages to that customer.

Services involved

Data passes between the merchant's Shopify store, Akdly's application and database hosting, and WhatsApp. Cloudflare handles public HTTPS traffic to the app. The current server's IP allocation is registered to SpectraIP B.V.; public IP geolocation identifies Amsterdam, Netherlands. This describes the network location observed for the current pilot and may not identify every physical processing location. Akdly processes WhatsApp messages through its self-hosted gateway using the store's QR-linked WhatsApp session. Encrypted operational backups are restricted to the operator. We do not sell customer data. The final production transport and processor agreements must be confirmed before public release; request current pilot details by email.

Access, correction and deletion

Customers should contact the store where they ordered. Merchants can contact Akdly to request assistance. The app handles Shopify customer-data and store-deletion webhooks. Data exports require the authenticated store owner; expired exports cannot be downloaded. Customer redaction removes matching application content and requests gateway cleanup. Cleanup failures are recorded for follow-up.

Retention

Export downloads expire after seven days. An hourly cleanup removes expired export contents from the active database; request identifiers remain to prevent duplicate recreation. A customer deletion also invalidates existing store exports.

Operational order and conversation records remain while required for the merchant's active service. After a case is terminal and has had no activity for 90 days, the scheduled retention job erases customer fields, message content, webhook bodies, addresses and audit payloads. Immutable identifiers, idempotency and tombstone records, billing usage, the latest opt-out evidence and unresolved provider sends remain where needed to prevent duplicate sends, restore suppression and complete reconciliation. Active, pending, human-review, retry and unknown cases are excluded.

New operational backups are encrypted daily and retained for fourteen days. An encrypted copy is pulled to the operator's restricted workstation when it is online. Deletion from the active database does not instantly remove older backups. Restored backups must remain isolated from sending and access until deletions since the snapshot have been reapplied. Backup expiry and ordinary record retention are separate controls.

To enforce the once-per-store free trial, we retain a keyed fingerprint of the Shopify shop ID, the trial start and expiry dates, an aggregate accepted-message count and a revocation marker for as long as this offer is available. This minimal eligibility record survives uninstall and store erasure; it contains no shop domain, phone number, message content or credentials. Erasure ends any remaining trial entitlement. Contact us about this retention or your rights using the email above.

Protection

Akdly uses HTTPS, authenticated Shopify sessions, store isolation, restricted owner actions, signed webhook verification and encryption for stored credentials and export artifacts. Do not include secrets or customer records in support emails.

Changes

We will update this notice when data handling or production providers change. Material changes will be reflected here before the public release.

Agreement acceptance records include the store identifier, version, document fingerprint, accepting owner's identifier and time. They are used to evidence the merchant's instructions and are removed with the store's application record.