Privacy Policy

CODConfirm is a multi-tenant Software-as-a-Service platform that helps merchants confirm Cash-on-Delivery (COD) orders and run automated customer-engagement flows over WhatsApp, voice calls, and SMS. Our registered address is Casablanca, Morocco.

Our role under data-protection law depends on the context:

• Data controller — for personal data of our merchant customers (account holders, their team members, and visitors to our marketing site).
• Data processor — for personal data of our merchant customers’ end-users (e.g., contacts they upload to confirm orders or message via WhatsApp). The merchant is the controller of that data; we process it on their behalf under our Data Processing Agreement.

2.1 Data merchants provide about themselves

• Account information: full name, email address, password hash, role, business name, country, time zone.
• Billing information: plan, invoices, payment method tokens (we do not store full card numbers — payments are processed by our payment providers).
• Integration credentials: encrypted API tokens for WhatsApp Business, telephony, AI voice, and other providers the merchant connects.
• Support communications: messages you send us via email, in-app chat, or support tickets.

2.2 Data merchants upload about their end-users

• Contact records: name, phone number, email, language, address, custom attributes, opt-in status, source, and timestamp.
• Order information for COD confirmation: order id, items, amount, delivery address, status.
• Audience and segmentation data created by the merchant.

2.3 Data generated through use of the Service

• Message content and metadata for WhatsApp, SMS, and voice interactions (delivery status, read receipts, call duration, recordings if enabled).
• Inbound media sent by end-users (images, voice notes, documents) routed through the WhatsApp Business Platform or our telephony providers.
• Flow execution logs, AI-assistant transcripts and outputs, audit logs.
• Technical data: IP address, browser type, device identifiers, pages viewed, timestamps, cookies and similar technologies.

CODConfirm is a Meta Tech Provider. When a merchant connects their WhatsApp Business Account to our Service via Meta’s Embedded Signup, we receive and process the following on the merchant’s behalf:

• WhatsApp Business Account (WABA) identifier, business display name, business verification status, and the list of phone numbers attached to the WABA.
• Per-number metadata: display name, verified name, quality rating, messaging tier, throughput level, and code-verification status.
• Message templates (content, language, category, approval status) and WhatsApp Flows (form specifications) that the merchant creates.
• Inbound and outbound messages sent through the merchant’s WABA, including text, media (images, video, audio, voice notes, documents), interactive replies (button and list selections), and Flow form responses.
• Delivery status events, read receipts, and conversation analytics scoped to the merchant’s own WABA.
• Encrypted access tokens that authorize calls to the WhatsApp Cloud API on the merchant’s behalf.

We use this data only to deliver the Service to the merchant who connected the WABA. We do not message end-users on our own behalf, do not use WhatsApp data for advertising, do not sell or rent it, and do not aggregate it across merchants in any way that could re-identify an individual.

End-users can opt out of WhatsApp messages from a merchant at any time by replying with the keyword STOP. Our system processes STOP replies automatically at the webhook layer and blocks all further outbound messages to that number from the merchant.

We use personal data to:

• Provide, operate, and maintain the Service (account creation, authentication, billing, support).
• Execute the merchant’s automation flows — sending confirmation requests, follow-ups, reminders, and processing replies on their behalf.
• Show merchants delivery, cost, and quality analytics scoped to their own account and WABA.
• Detect and prevent abuse, fraud, spam, and violations of our Acceptable Use Policy and Meta’s WhatsApp Business Messaging Policy.
• Comply with legal obligations and enforce our agreements.
• Communicate with merchants about service updates, security alerts, and (with consent where required) product news.

Where the GDPR, the Moroccan Law 09-08, or similar regimes apply, we rely on the following legal bases:

• Performance of a contract — to provide the Service to our merchants.
• Legitimate interests — to secure the Service, prevent abuse, and improve our product, balanced against the rights of data subjects.
• Consent — where required (for example, marketing emails, certain cookies, or end-user opt-in to WhatsApp messaging, which the merchant is responsible for collecting).
• Legal obligation — to comply with applicable laws, court orders, or lawful requests from public authorities.

We do not sell personal data. We share data only with:

• Sub-processors we rely on to deliver the Service, including:
  • Meta Platforms Ireland Ltd. — WhatsApp Business Platform (messaging delivery and media storage).
  • Telnyx and Twilio — voice and SMS delivery.
  • Retell AI and Vapi — AI voice agent orchestration.
  • Google (Gemini) and ElevenLabs — AI text/voice generation for chat assistants.
  • BunnyCDN — media asset storage and delivery.
  • Self-hosted infrastructure providers for compute, database hosting, and backups.
  • Payment processors for billing.
• Authorities when required by law, regulation, legal process, or governmental request.
• Successors in the context of a merger, acquisition, or sale of assets, subject to equivalent protections.

Each sub-processor is bound by contractual obligations of confidentiality and data protection consistent with this Policy.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy:

• Merchant account data: for the duration of the account and up to 24 months after closure for legal, billing, and audit purposes.
• Contact records and message history processed on a merchant’s behalf: until the merchant deletes them or closes their account, after which they are deleted within 30 days (subject to backup cycles of up to 90 days).
• Inbound WhatsApp media: cached for up to 90 days to allow merchants to view historical conversations, then deleted.
• Audit logs and security logs: up to 12 months.
• Billing and tax records: as required by applicable tax law (typically up to 10 years).

We implement technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including:

• Encryption in transit (TLS 1.2 or higher) and at rest for sensitive fields, including AES-256-GCM encryption of provider tokens with a server-side master key.
• Strict tenant isolation — every data access is scoped to the requesting tenant’s identifier at the application and database query layer.
• Role-based access controls and least-privilege access for our personnel.
• Webhook signature verification (X-Hub-Signature-256 for Meta webhooks).
• Logging, monitoring, and regular security reviews.

No security measure is perfect; we encourage merchants to use strong unique passwords, enable multi-factor authentication where available, and report suspicious activity to support@codconfirm.com.

Subject to applicable law, you have the right to access, correct, delete, restrict processing, object to processing, and obtain a portable copy of your personal data, as well as the right to withdraw consent where processing is based on consent.

For merchants and account holders: you can exercise most of these rights directly in your account settings, or by contacting us at privacy@codconfirm.com.

For end-users (recipients of messages): because we process your data on behalf of the merchant who sent you a message, your first point of contact is that merchant. You can also:

• Reply STOP to any WhatsApp or SMS message from the merchant to opt out of further messages from that merchant.
• Block the merchant’s number directly from within WhatsApp.
• Contact us at privacy@codconfirm.com and we will route your request to the merchant and assist with resolution.

You also have the right to lodge a complaint with the data-protection authority of your country (in Morocco: the CNDP).

Our infrastructure is primarily hosted in the European Union and Morocco. Some sub-processors (notably Meta, Twilio, Google, and ElevenLabs) may process personal data in the United States or other jurisdictions. When we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms.

The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@codconfirm.com and we will delete it.

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, legal requirements, or for other operational reasons. When we do, we will revise the “Effective date” at the top of this page and, for material changes, notify merchants by email or in-app notice before the change takes effect.

If you have questions, requests, or complaints about this Policy or our processing of personal data, please contact us:

• CODConfirm — Casablanca, Morocco
• General privacy enquiries: privacy@codconfirm.com
• Data Protection Officer: dpo@codconfirm.com
• Support: support@codconfirm.com
• Website: https://codconfirm.com