Privacy Policy

CallYo ("CallYo", "we", "us") provides a call center CRM that helps Shopify merchants confirm cash-on-delivery (COD) orders by phone before they ship them. This policy explains what data we process, why, how we protect it, and the rights you and your customers have. We act as a data processor on behalf of the merchants who install CallYo, and the merchant is the data controller of their customers' personal data.

Data controller / operator: CallYo
Contact email: contact@callyo.ro

When a merchant connects their Shopify store, CallYo receives order data through the Shopify API, including:

• Customer name
• Customer phone number
• Customer shipping / billing address
• Customer email address
• Order details (products, quantities, totals, order number, status)

We only request the minimum data needed to let a call center agent contact the customer and confirm the order. We do not collect payment card data, and we do not track customer behaviour on the merchant's storefront.

The sole purpose of processing this data is to allow a human call center agent to phone the customer and confirm, reschedule, or cancel a cash-on-delivery order before the merchant ships it. This reduces refused parcels and return-shipping costs. We do not use this data for any other purpose, and we never sell it.

CallYo does not perform automated decision-making with legal or similarly significant effects. Every order decision is made by a human agent during a phone call.

We process personal data on behalf of merchants based on their legitimate interest in fulfilling and confirming orders their customers have placed, and to perform the order contract. Merchants are responsible for informing their customers and obtaining any consent required under applicable law (including the GDPR).

• All data is encrypted in transit (HTTPS/TLS) and at rest.
• Access is restricted to the merchant's own team (agents and firm administrators) through authenticated accounts and row-level security.
• Data is hosted on secure, industry-standard cloud infrastructure (Supabase / Vercel).
• Shopify API access tokens are stored securely and used only to sync the merchant's own orders.

We keep order and customer data only as long as needed to provide the service to the merchant. CallYo implements Shopify's mandatory compliance (GDPR) webhooks:

• customers/data_request— we help the merchant respond to a customer's request for their data.
• customers/redact— we erase or anonymize a specific customer's personal data from our records.
• shop/redact — when a merchant uninstalls the app, we delete their store and order data.

A merchant or customer can also request deletion at any time by emailing contact@callyo.ro.

We do not sell personal data and we do not share it with third parties for advertising. Data is only accessible to the merchant's own authorized agents and to the infrastructure providers strictly needed to run the service (hosting and database). We respect and apply customers' consent and opt-out decisions as communicated by the merchant.

Under the GDPR and similar laws, data subjects have the right to access, correct, delete, restrict, or object to the processing of their personal data, and the right to data portability. Requests are handled through the merchant (as controller); you can also contact us at contact@callyo.ro and we will assist the merchant in fulfilling the request.

We may update this policy from time to time. Material changes will be reflected here with an updated date.

For any questions about this policy or your data, contact us at contact@callyo.ro.