Privacy Policy
Last updated:
This Privacy Policy explains how Ravka Labs handles personal information when providing Ravka COD Form, a cash on delivery form app for Shopify, and when you visit this website or contact us.
1. Who we are
Ravka Labs provides Ravka COD Form. We handle merchant account, support and service administration information to operate our business. For customer information processed on behalf of a merchant, we generally act as a processor or service provider following that merchant?s lawful instructions. The merchant is responsible for its storefront privacy notices and customer relationship. Contact us at hello@ravkalabs.com.
2. Information we process
Depending on permissions and enabled features, we process store identifiers and settings; product, variant, inventory, language and market information; relevant current and historical order information; authentication sessions; form settings and translations; subscription and usage information; and support messages. Customer form submissions may contain names, phone numbers, email addresses, delivery addresses, products, quantities, order values and other fields configured by the merchant. We may also process timestamps, submission identifiers, security signals, consent preferences, session and event identifiers, attribution parameters and advertising click identifiers. Hashes and pseudonymous identifiers may still be personal information. We do not collect payment card details to take cash on delivery payments.
3. How we use information
We use information to display and customize forms, validate submissions, create and reconcile COD orders in Shopify, provide translations and service analytics, operate security and abuse controls, manage usage and subscriptions, troubleshoot errors and respond to support requests. We do not sell customer lists or use customer order information for unrelated Ravka Labs advertising.
4. Optional integrations
If a merchant enables advertising measurement, eligible conversion data may be shared with connected services such as Meta, TikTok, Google Ads or Pinterest. Depending on the provider, this can include event time, order value and currency, product or order references, click identifiers and hashed contact information. Sending events depends on consent, configuration, available identifiers and provider rules. If WhatsApp verification is enabled, phone numbers, message or template metadata and verification results are processed through the configured WhatsApp Business provider, currently Gupshup and Meta?s WhatsApp infrastructure. Merchants are responsible for required notices, consent, account permissions and respecting customer opt-outs. These integrations are optional and subject to provider availability and terms.
5. Sharing and international processing
Information is shared with Shopify where needed to authenticate access and manage orders, and with hosting, database, email and support providers needed to operate the service. The app?s current implementation uses Google Cloud hosting, PostgreSQL with Supabase operational tooling, and Resend for configured transactional email. Merchant-enabled integration providers receive data relevant to their features and apply their own terms and privacy policies. This website is intended to be hosted on Netlify, which may process technical request information to deliver and secure it. Providers may process information outside your country; applicable transfer protections are required where law provides for them. We may also disclose information to meet legal obligations or protect rights and security. Contact us for details relevant to your service.
6. Retention and deletion
We retain store configuration and service information while needed for the active installation and the purposes described here. The app schedules app-owned store data for cleanup after uninstall, targeting approximately 48 hours through scheduled processing, subject to legal preservation requirements and successful cleanup operations. Temporary operational records have purpose-specific expiry: successful order-processing attempts are generally eligible for cleanup after 7 days, failed attempts after 2 days, unresolved attempts after 30 days, and advertising events after 35 days. Deletion is processed in batches. These periods do not mean every backup or third-party copy is erased at the same time. Orders already created in Shopify, merchant exports, provider records, infrastructure logs and backups have separate retention arrangements. Support messages are retained as needed to handle the request and related service or legal obligations. Contact us about a particular record or retention requirement.
7. This website and cookies
This static website does not require an account, use advertising or analytics scripts, set cookies or collect form submissions. The order-form illustration is not interactive and does not create orders or transmit customer information. Our hosting provider may process IP addresses, browser information, requested URLs and timestamps for delivery and security. Emailing us provides your email address, message and any information you include. Avoid sending unnecessary customer or sensitive information. Links to external websites are governed by those websites? policies. App storefront features may separately use browser identifiers, storage or Shopify web pixels according to enabled features and applicable consent requirements.
8. Your privacy rights
Depending on applicable law, you may have rights to access, correct, delete or receive a copy of personal information; restrict or object to processing; withdraw consent; or opt out of certain advertising uses. Contact hello@ravkalabs.com to make a request. Store customers should normally contact the merchant first so requests can be verified and associated with the correct store. We support Shopify customer data request, customer redaction and shop redaction workflows and assist merchants with valid requests. Identity verification and lawful exceptions may apply. You may complain to your competent privacy authority and exercise applicable rights without unlawful discrimination.
9. Legal grounds, security and children
Where a legal basis is required, account administration and support may rely on contract, legitimate interests in providing and securing the service, legal obligations or consent where applicable. Customer processing follows the merchant?s lawful instructions. We use access controls, authenticated requests and encryption for sensitive integration credentials, but no service can guarantee absolute security. Required incident notifications will be provided under applicable law. The app is a business tool and is not directed to children; merchants remain responsible for age-related obligations in their stores.
10. Updates and contact
We may update this policy to reflect changes in the service or legal requirements. We will update the date and communicate material changes where required. For privacy questions or requests, email hello@ravkalabs.com.