WHATCOM BY OREXOR · LEGAL

Privacy Policy

Effective date: 5 November 2026

This policy explains what information WHATCOM handles, why it is handled, where it is stored, and the choices available to merchants, staff and affected individuals.

1. Who we are and what this policy covers

WHATCOM is a software service operated under the OREXOR brand. In this policy, “WHATCOM”, “OREXOR”, “we”, “us” and “our” refer to the operator of the WHATCOM service. This policy applies to the WHATCOM website, merchant dashboard, Chrome extension, and the Shopify and WhatsApp Web functionality made available through them.

2. Our role and the merchant's role

We act as the controller of information relating to merchant account registration, authentication, subscriptions, service security and our direct communications with account holders. When a merchant connects a Shopify store, the merchant decides which store and staff members may use WHATCOM. For personal data about the merchant's customers that we access from Shopify to provide the service, the merchant generally remains the controller and WHATCOM processes that information on the merchant's behalf and on the merchant's instructions. The merchant is responsible for providing its customers with appropriate notices and having a lawful basis for using their information.

3. Information we handle

A. Merchant and team account information

We handle the business or store name, owner email address, owner contact number, staff email addresses, account roles and access settings. We store password hashes with individual salts rather than plain-text passwords. We also handle email-verification and password-reset token records, session identifiers and expiry/revocation information.

B. Shopify store and order information

When the owner connects a Shopify store, we handle the store domain and store identifier, the permissions (scopes) granted to WHATCOM, and the merchant-created Shopify app credentials needed to obtain access tokens. Shopify client credentials and access tokens are encrypted before being stored.

When a user requests a lookup or an order action, WHATCOM may retrieve from Shopify and display information needed for that request, including customer names, email addresses, telephone numbers, order numbers, order dates, shipping addresses, item names, SKUs, quantities, order tags, order totals and currency, financial and fulfilment statuses, fulfilment holds, shipping methods and tracking information. We use this information to display customer and order details and to carry out actions the authorised user requests, such as updating eligible shipping addresses, managing eligible fulfilment holds, or changing order tags.

WHATCOM is designed to retrieve Shopify customer and order details when needed for a feature; it does not intentionally maintain a separate long-term database of full Shopify customer records or order contents. The service may process those details temporarily in memory and in the browser to complete the requested operation. Limited operational audit records may record that an action was attempted and whether it succeeded, without recording the full order contents.

C. WhatsApp Web information processed by the extension

When WhatsApp Web is open, the extension reads information visible in the currently open conversation so that it can identify the customer and support the order-management interface. The extension may read the visible chat name or phone number and the most recent visible message, including its sender, displayed time and a short text preview (up to 360 characters). It may also record simple visible states such as “no messages” or “not available”.

Local message preview storage: the latest WhatsApp message preview and related chat metadata are saved in Chrome's local extension storage on that browser profile, with a limit of up to 3,000 chat records. Under the current extension design, the message text and preview records are not uploaded to WHATCOM's servers. The customer phone number or email may, however, be sent securely to WHATCOM's service when it is needed to search the connected Shopify store.

D. Subscription and payment administration

We handle the selected plan, trial eligibility and dates, subscription status, payment amount, payment reference supplied by the merchant, and payment approval status. WHATCOM currently uses manual payment confirmation; it does not collect card numbers or bank login credentials through the service.

E. Technical, security and support information

Our infrastructure provider may process IP addresses, request timestamps, browser or network metadata and security logs. WHATCOM uses IP-derived identifiers and account details for rate limiting and abuse prevention. We also keep limited audit events such as account registration, staff access changes, Shopify connection events, payment requests and the success or failure of certain Shopify operations. If you contact support, we handle the information you choose to provide in that communication.

4. How we use information

To create and administer merchant and staff accounts, authenticate users and enforce the access permissions set by the merchant owner.
To connect to the Shopify store selected by the merchant, retrieve the requested customer and order information, and carry out authorised order-management actions.
To store the local WhatsApp message preview feature on the user's Chrome browser and match a currently open conversation to a Shopify customer when the user uses the service.
To send essential account emails, including email verification and password-reset messages.
To administer plans, trials, manual payments and subscription access.
To secure the service, detect and prevent fraud or misuse, troubleshoot faults, maintain reliability and enforce our Terms & Conditions.
To comply with applicable legal obligations and respond to lawful requests.

5. Where information is stored

Merchant account records, subscription records, Shopify connection metadata, encrypted Shopify credentials, authentication records and limited audit events are stored in the WHATCOM database hosted on Cloudflare infrastructure. Shopify customer and order details are retrieved from Shopify when a feature is used and are not intentionally stored as a separate long-term order database by WHATCOM.

The extension stores its authentication token, account email, interface preferences and WhatsApp message previews in Chrome's local extension storage. The merchant dashboard uses browser session storage for its signed-in session. Local extension data remains on the browser profile until it is overwritten or the user clears the extension's stored data or removes the extension. Users should protect access to the computer and Chrome profile on which WHATCOM is installed.

6. Who we share information with

We do not sell or rent personal data. We share or make information available only where reasonably necessary to operate WHATCOM, provide a feature requested by the merchant, protect the service, or comply with law. The relevant providers and recipients include:

Cloudflare: provides the hosting, Worker execution, database and related network/security infrastructure used by WHATCOM. Cloudflare may process technical request information, including IP and security metadata.
Resend: delivers transactional verification and password-reset emails. It receives the recipient email address and the email content/link required to deliver those messages.
Shopify: provides the connected store's API and receives requests to retrieve store data or carry out actions authorised by the merchant. Shopify handles its platform data under its own terms and privacy information.
The merchant and its authorised team: Shopify customer and order information is made available within the merchant's WHATCOM account according to the roles and permissions assigned by the owner.
Authorities or professional advisers: where disclosure is required by law, needed to protect rights or safety, or reasonably necessary to investigate fraud, security incidents or misuse.
A successor to our business: in a merger, restructuring or sale of the relevant business or assets, subject to appropriate confidentiality and legal safeguards.

WhatsApp/Meta and Google Chrome are separate third-party services. WHATCOM is not owned, operated, sponsored or endorsed by WhatsApp, Meta, Shopify or Google. WhatsApp Web and Chrome may process information under their own terms and privacy policies. WHATCOM does not send the locally stored WhatsApp message preview to Meta or Google.

7. Limited use, advertising and human access

Chrome Web Store Limited Use statement: WHATCOM collects, uses and transfers information accessed through its Chrome extension permissions only as necessary to provide the extension's disclosed single purpose: helping an authorised merchant and its staff retrieve and manage that merchant's Shopify customer and order information from within WhatsApp Web, together with related account security and service reliability. Our use and transfer of this information comply with the Chrome Web Store User Data Policy, including the Limited Use requirements.

We do not sell extension data, use it for personalised or interest-based advertising, provide it to data brokers, use it for creditworthiness or lending decisions, or use it for unrelated profiling or marketing. We do not routinely allow staff to read WhatsApp message previews or Shopify customer content. Access by authorised personnel is limited to cases where the user specifically requests support and authorises inspection of relevant information, where necessary to investigate a security incident or abuse, or where required by law.

8. Security

We use safeguards designed to protect information, including HTTPS for service communications, salted PBKDF2 password hashing, hashed server-side session tokens, access controls, rate limiting and AES-GCM encryption for stored Shopify app credentials and access tokens. No online service, browser, device or transmission method can be guaranteed to be completely secure. Merchants must keep passwords and Shopify credentials confidential, use trusted devices, and promptly disable staff accounts that no longer need access.

9. Retention and deletion

We retain merchant account and subscription information while the account is active and for as long as reasonably necessary afterwards for account administration, payment records, dispute resolution, security, fraud prevention and legal compliance. Limited audit and authentication records are retained for operational and security purposes. Certain store and trial-history identifiers and dates may be retained to enforce one-time trial eligibility and prevent abuse.

When a merchant disconnects Shopify, WHATCOM clears the stored access token and removes the stored Shopify client credentials; limited store metadata and audit history may remain. WhatsApp message previews remain in local Chrome storage until overwritten or cleared by the user. A user may clear local extension data through Chrome's extension controls or remove the extension.

WHATCOM does not currently provide an automated account-deletion control. To request account closure or deletion, contact us using the details below. We will assess the request and delete or anonymise information where reasonably possible, subject to legal obligations, security requirements, payment and dispute records, and the limited trial-history records described above. For Shopify customer data held by the merchant, the merchant should receive and handle the customer's request; we will provide reasonable assistance where required by law or an applicable data-processing agreement.

10. International processing

Our infrastructure and service providers may process information in countries other than the country where the merchant or its customers are located. Where applicable law requires safeguards for an international transfer, we will use an appropriate lawful transfer mechanism or other required safeguard.

11. Your privacy rights

Depending on your location and the applicable law, you may have rights to request access to, correction of, deletion of, restriction of or objection to the processing of your personal information, and data portability. You may also withdraw consent where processing is based on consent. To exercise a right, contact us through WhatsApp at +92 311 3871524. We may need to verify your identity and may retain information where the law permits or requires us to do so.

If the information relates to a merchant's Shopify customers, please contact the merchant first because the merchant determines why and how that customer data is used. We will assist the merchant with a valid request where required by law or contract.

12. Children

WHATCOM is a business service and is not intended for use by children under 18. We do not knowingly seek to collect children's personal information.

13. Changes to this policy

We may update this policy to reflect changes to WHATCOM, our providers, security practices or legal requirements. The updated version will be published at this URL with a revised effective date. If a change materially affects how we use information, we will provide an appropriate notice through the service or another reasonable channel where required.

14. Contact

For support or questions about this Privacy Policy, contact OREXOR through WhatsApp at +92 311 3871524.