This policy describes how Skode Technologies Private Limited ("SkedX," "we," "us," or "our"), a private limited company incorporated in India with registered office at Thirumangalath, Chelavur, Kozhikode – 673571, Kerala, India, handles data when a merchant installs the SkedX for Shopify app (the "App"). The App connects a Shopify store to SkedX so the merchant can send order, cash-on-delivery, delivery and abandoned-cart messages on WhatsApp and email, answer customers from one inbox, and offer "Track my order" and a chat button on their store.
The merchant is the data controller for their customers’ data. SkedX is the merchant’s data processor and handles that data only to provide the App, on the merchant’s instructions and under our Data Processing Agreement. SkedX does not sell store data, does not use it for advertising, and does not use it for SkedX’s own marketing. For the merchant’s own account data (the people who sign in to SkedX), our main Privacy Policy applies.
1Data the app receives from your store
When a merchant installs the App and links it to their SkedX account, SkedX receives the following from Shopify, through the permissions the merchant approves at install:
| Data | What is kept | Why |
|---|---|---|
| Customers | Name, phone number, email address, and their marketing consent for each channel | To send each customer messages about their own orders and to respect their consent |
| Orders | Order number, status, fulfilment status, currency, totals, items (title, SKU, quantity, price), the order’s contact phone and email, the shipping address, and whether payment is cash on delivery or prepaid | Order confirmations, cash-on-delivery checks, "Where is my order?" answers and delivery |
| Deliveries | Courier, tracking number and link, and a timeline of short status notes from the courier or the merchant’s own delivery riders | Shipped, out-for-delivery, delivered and failed-delivery updates |
| Abandoned checkouts | Contact phone or email, items, total and the checkout recovery link | Abandoned-cart reminders, if the merchant switches them on |
| Products | Title, description, images, link, price, variants and stock (no personal data) | So the merchant’s SkedX AI assistant can answer product and stock questions |
| Store | Store name, domain, and the store owner’s name and email | To link the store to the right SkedX account and contact the merchant |
On the first connection, the App reads the last 90 days of orders. The App does not store billing addresses, order notes, customer notes, or the shopper’s IP address or browser details.
2Data the app never receives
- Payment details. SkedX never receives card numbers or other payment details. It reads only the name of the payment method, to tell cash-on-delivery orders from prepaid ones.
- Message text in store records. The messages a merchant sends and receives are kept in the merchant’s SkedX inbox, like any other conversation, and not in the store records described in § 1.
3The merchant decides what reaches their customers
- Every automatic message (order confirmed, payment received, cash-on-delivery check, shipped, out for delivery, delivered, delivery failed, cancelled, refunded, review request, abandoned cart and "Where is my order?") has its own switch and is off until the merchant turns it on. The merchant chooses the channel (WhatsApp or email) and writes the wording in SkedX.
- Marketing needs consent. A marketing message is sent only to a customer who has given marketing consent for that channel. Messages about a customer’s own order are sent because of that order.
- Opt-outs go back to Shopify. When a customer opts out in SkedX (for example by replying STOP or by unsubscribing from an email), SkedX records it and updates that customer’s marketing status in Shopify to unsubscribed.
- Thank-you page opt-in. If the merchant shows SkedX’s box on the order thank-you page, its checkboxes start unticked. The marketing checkbox appears only if the merchant turns it on. A customer’s choice is recorded in SkedX and, for a customer with a Shopify account, also in Shopify.
4Features on the merchant’s store
4.1Track my order
A shopper enters their mobile number and receives a 6-digit code on WhatsApp. After entering the code, they see up to 10 of their orders from that store: order number, date, status, items, total and the latest delivery status with its tracking link and timeline. Their name, email and address are not shown. Code requests are rate-limited.
4.2Chat button
If the merchant adds it, the chat button opens WhatsApp or SkedX web chat, as the merchant chooses. SkedX web chat is covered by our Widget Privacy Notice.
4.3Store analytics (SkedX Signal)
The App includes a Shopify web pixel that sends store activity to SkedX Signal, SkedX’s analytics service. It stays off until the merchant explicitly turns it on. It runs inside Shopify’s pixel sandbox and follows the shopper’s choices in Shopify’s customer privacy settings: it does not run without analytics permission, and advertising click identifiers are collected only with marketing permission.
When on, it records page views, products viewed, add-to-cart, checkout steps and completed purchases (product, price, currency, checkout and order identifiers), the page address and referrer, campaign (UTM) tags, and a random visitor and session identifier. It does not collect names, email addresses, phone numbers or addresses. It stores the visitor identifier in the browser’s local storage (skode-visitor-id) and the session identifier in session storage (skode-session-id).
The App sets no cookies, either on the store or inside the Shopify admin.
5Who the data is shared with
- SkedX’s own products that the merchant uses: SkedX CRM (where the store connection lives), SkedX Flow (inbox, messaging, AI assistant and Products & Services), SkedX Automate (the automations that send the merchant’s messages) and SkedX Signal (store analytics, if switched on).
- Shopify, to write back consent changes, order tags, delivery updates and orders the merchant creates from a chat.
- Meta (WhatsApp Business Platform) and Amazon Web Services (hosting and Amazon SES email), only to deliver the messages the merchant sends.
- Integrations the merchant adds. If the merchant connects their own webhooks or tools (for example Zapier) to SkedX, store events, including the customer’s name, phone and email, are sent to them on the merchant’s instruction.
The full list of the services SkedX uses is on our Sub-Processors page. SkedX’s servers and databases are hosted by Amazon Web Services in India.
6How the data is protected
- Encryption at rest. In SkedX’s store records, customers’ names, phone numbers and email addresses, order contact details and shipping addresses are encrypted by the application before they are saved. Saving fails if encryption is not available. Lookups by phone or email use keyed hashes, not the plain values. All databases are also encrypted at rest.
- Encryption in transit. Calls to and from Shopify, and store events sent to other services, use HTTPS.
- Access log. Reads of customer data from the App’s pages, the storefront and SkedX’s own services are logged with the service, the purpose and, inside the Shopify admin, the Shopify staff user.
- Copies kept for troubleshooting. When SkedX keeps a copy of a store event (for example in delivery logs or failed-delivery records), customer names, phone numbers and email addresses are removed from that copy.
- Access. Store data is available to the merchant’s own team and to the automations and integrations the merchant sets up. SkedX staff access it only when needed to operate, secure or support the service.
7Retention and deletion
- While the store is linked, the data in § 1 is kept so the App can work.
- When the merchant uninstalls the App, SkedX stops receiving store data immediately and erases its access credentials for the store.
- Shop deletion. About 48 hours after uninstall, Shopify sends SkedX a shop deletion request. SkedX then deletes the store’s customers, orders, deliveries, checkouts, products and riders from its store records, and removes contacts that the App created and nothing else uses. It also deletes the products the App copied into SkedX’s Products & Services (products the merchant had added themselves stay, as ordinary products), the store’s reviews, the automation history of the store’s events, and the store analytics recorded on the store’s own web addresses. The merchant’s SkedX inbox stays: it is the merchant’s own account data, which the merchant can delete in SkedX.
- Customer deletion. When Shopify sends a customer deletion request, SkedX erases that customer’s name, phone number, email address and shipping address from their customer record, their orders (including guest orders matched by phone or email) and their abandoned checkouts. A contact that the App created and nothing else uses is deleted; otherwise the store-supplied details are removed from it. The same request is passed on to the rest of SkedX, which deletes everything it holds about that customer for the merchant: inbox contacts, conversations and messages, "Track my order" codes, notes the AI assistant learned from their conversations, their store reviews, the history of automations that ran for them (any message still waiting to be sent to them is cancelled), and their store analytics, including the browsing behind their orders and checkouts. Chat orders keep their items and amount for the merchant’s records but lose the customer’s details.
- Data requests. When Shopify sends a customer data request, the App shows it to the merchant with a due date 30 days after it arrived, and lets the merchant download the customer’s data to send to them.
- What a deletion request keeps. Opt-out records (that the customer replied STOP or unsubscribed) are kept so the customer is never messaged again. Store analytics events older than their retention period that have been moved to archive storage are not reached by a deletion request, and nor is data already delivered, on the merchant’s instruction, to Meta for ad measurement (as hashed identifiers) or to integrations the merchant connected. For any of these, write to [email protected]. Our Data Deletion Policy describes how account-level deletion works.
8Shoppers’ privacy rights
Depending on where they live, shoppers may have the right to access, correct or delete their personal data, or to object to its use, under laws such as the GDPR, UK GDPR, the California CCPA/CPRA and India’s Digital Personal Data Protection Act 2023. Because the merchant is the controller, shoppers should send requests to the store they bought from. Requests made through Shopify reach SkedX as described in § 7. If a shopper cannot reach the store, they can write to [email protected] and we will pass the request to the right merchant.
9Children
The App is for businesses. SkedX does not knowingly process data about children except as part of a merchant’s ordinary orders, which the merchant controls.
10Changes to this policy
We will update this page when the App’s handling of data changes, and change the date at the top.
11Contact us
- Privacy questions and requests: [email protected]
- Grievance Officer (India): Grievance Officer page
- Main policy: SkedX Privacy Policy
Write to [email protected]. A person answers.