Privacy policy – KODMIL WhatsApp Automation

Last updated: 31 October 2026

This policy explains which data the KODMIL WhatsApp Automation Shopify app ("the app"), provided by KODMIL, processes when a merchant installs it, and why. The merchant is the controller of their customers' data; KODMIL processes it on the merchant's behalf only to provide the app.

What the app does

The app sends automated WhatsApp messages on behalf of your store through the WhatsApp Business Cloud API, using your own WhatsApp Business account: abandoned cart reminders, order confirmations and shipping notifications.

Data we store

• Your shop domain, shop name, primary domain and the Shopify access session needed to run the app.
• Your WhatsApp Business Cloud API credentials (phone number ID, business account ID, access token and app secret). The token and secret are stored encrypted (AES-256-GCM).
• For customers who reach checkout or order with a phone number: phone number, first name, Shopify customer ID, marketing consent state and whether they opted out of WhatsApp messages.
• For each automated message: the automation, the phone number, the values used in the message (first name, shop name, order number, order total, carrier, tracking number, checkout or order status link), and its delivery status reported by WhatsApp.
• An audit log of settings changes and of customer data requests received from Shopify.

Why we use it

• Phone number: to send the WhatsApp message the merchant turned on, and to honour opt-outs.
• First name: to address the customer in the message ("Hi Ayşe").
• Marketing consent: to send cart reminders only to customers whose Shopify marketing consent allows it.
• Order and fulfillment details: to fill in the order confirmation and shipping messages.

Data is not used for any other purpose, not sold, not used for advertising and not used to train AI models.

Data we do not store

Payment details, addresses, email addresses, cart contents or the text of messages customers send to you. Replies are only checked for opt-out keywords (STOP, DUR, İPTAL) and opt-in keywords (START, BAŞLA) and are not saved.

Shopify data access

The app requests read_orders, read_fulfillments and read_customers to receive checkout, order and fulfillment events and to read the customer's name, phone number and marketing consent for these messages. It does not change any data in your store.

Sharing and sub-processors

• Meta Platforms (WhatsApp Business Cloud API): recipient phone numbers and message contents, to deliver the messages through your WhatsApp Business account.
• Render (Frankfurt, Germany, EU): application hosting and PostgreSQL database.

All connections use HTTPS (TLS).

Consent

Marketing messages (cart reminders) are sent only to customers whose Shopify marketing consent allows it. Order and shipping messages are transactional. Customers can stop all messages at any time by replying STOP or DUR.

Retention and deletion

• Messages are deleted 180 days after they were created.
• Contacts without activity for 365 days are deleted. For customers who opted out, only the phone number and the opt-out are kept so that no further messages are sent.
• When Shopify sends a customers/redact request, the customer's contact and message records are deleted.
• When you uninstall the app, sessions are deleted and scheduled messages are cancelled immediately; all remaining shop data is deleted when Shopify sends the shop/redact request (48 hours after uninstall).

Customer requests

When a customer asks your store for their data, Shopify notifies the app. The request appears in the app under Contacts, where you can download everything the app stores about that customer and send it to them. You can also download any contact's data from the Contacts page at any time.

Contact

KODMIL – https://kodmil.com – support@kodmil.com