NDA CRM is an operational tool for merchants who ship with cash on delivery. It reads orders from a merchant's store, asks couriers where each parcel is, and helps the merchant's team confirm orders by phone and message.
For personal data belonging to a merchant's customers, the merchant is the data controller and NDA CRM is the data processor. We process that data only to provide the service, on the merchant's instructions. We never sell it, never share it with advertisers, and never use it to train models.
For the merchant's own account data — the name and email of the people who log in — we are the controller.
| Data | Why | Kept for |
|---|---|---|
| Customer name | To address the customer on calls and messages, and to identify the parcel | 24 months |
| Phone number | To confirm the order by phone or SMS, and for the courier to reach the recipient | 24 months |
| Delivery address | To hand to the courier and to track the parcel | 24 months |
| Email address | Order notifications, and marketing campaigns only where the customer has opted in | 24 months |
| Order contents and totals | To reconcile the cash-on-delivery money against what the courier actually paid out | 24 months |
| Call records and notes | So the next agent knows what was already discussed | 12 months |
| Conversations (WhatsApp, SMS) | To continue the conversation with context | 12 months |
| Access log (who opened which record) | Security and audit | 12 months |
We ask the store for the smallest set of permissions the features need. We do not request access to order history older than 60 days unless a merchant needs long-range reconciliation, and we do not read products, themes or storefront data beyond what the order screens require.
NDA CRM runs on Cloudflare Workers, with the platform database (Cloudflare D1) in the Eastern Europe region and operational records in Cloudflare Workers KV. Data is encrypted in transit with TLS and at rest by the platform. Supplier credentials — store tokens, courier passwords, messaging keys — are additionally encrypted by us with AES-GCM, using a master key held separately from the database.
Each merchant's data is isolated: every stored record is namespaced to that merchant's workspace, and the server enforces the boundary on every request. Workspaces marked as test environments write under a separate namespace, so test data never mixes with real customer data.
Inside a merchant's own team, access is limited by role and by department: an agent in the call centre does not see financial reconciliation, and the server refuses the request rather than merely hiding the button. Reads of personal data are logged with the user, the route, the time and the IP address — the log records that access happened, not the content that was read.
On our side, access to production systems is limited to the people who operate the service, protected by strong passwords and the platform provider's own controls.
| Provider | What for |
|---|---|
| Cloudflare | Hosting, database, storage, network |
| Shopify | Source of orders, where the merchant uses Shopify |
| Courier APIs (DPD, Sameday, Cargus, FAN, GLS and others) | Parcel tracking; recipient details where the merchant issues labels |
| Meta (WhatsApp Business) | Messages, where the merchant enables it |
| SMS provider chosen by the merchant | Text messages |
| Resend | Email delivery, where the merchant enables it |
Each merchant chooses which of these to connect. Nothing is sent to a provider the merchant has not configured.
Marketing messages go only to customers who have given consent. The app separates customers who have opted in from those who have not, and sends the latter an invitation to opt in rather than an offer. A customer who has not agreed receives no campaign.
We do not sell personal data, so there is nothing to opt out of on that front.
The app shows a risk indicator for customers with a history of refused deliveries. It is advisory: it never cancels, blocks or refuses an order by itself. A person on the merchant's team decides, and can ignore it.
We honour Shopify's mandatory privacy webhooks. When a store owner requests customer data or a deletion, we receive the request, act on it, and keep a record of the request itself for 90 days.
A customer who wants their data accessed, corrected or deleted should contact the merchant they bought from — the merchant is the controller. If you contact us directly, we will pass the request to the merchant and support them in answering it.
When a merchant uninstalls the app, we delete their store's access token immediately. Their operational data is removed on request, and in any case falls under the retention periods above.
We keep a written incident response procedure. If personal data is affected by a breach, we notify affected merchants without undue delay and within 72 hours of becoming aware, with what we know, what we are doing, and what they should do.
If we change how we handle personal data, we update this page and change the date at the top. Material changes are announced to merchants by email before they take effect.
Written questions about this policy: [email protected].