1. Who we are
UpOMS ("we", "us") is an order management system for COD (cash-on-delivery) sellers in Pakistan, operated by Muhammad Sheraz, Udhowali, District Gujranwala, Punjab 52250, Pakistan. Contact: upomssupport@gmail.com.
UpOMS is business software. Businesses ("businesses", "sellers") use UpOMS to manage their own orders, customers, couriers and money. When a business enters its customers' information into UpOMS, that business is responsible for having a lawful basis to share it with us, and we process it only to provide the service to that business.
2. Information we collect
2.1 Account and business information
When a business creates an account we collect the business name, the account owner's name, email address, phone number, business address, plan and subscription details, and the login credentials the account owner sets (passwords are stored hashed, never in readable form). We also collect the platform settings the business chooses, such as its branding, payment receiving accounts and courier accounts.
2.2 Order and customer information entered by businesses
Businesses enter their own order records into UpOMS: customer names, phone numbers, delivery addresses, cities, products, quantities, COD amounts, order notes and order history. Orders may also arrive automatically from a connected Shopify store (through Shopify's webhooks and API) or from WhatsApp orders pushed through the UpOMS bridge. This information belongs to the business that entered it; we do not use one business's customer data for any other business.
2.3 WhatsApp Business data (through Meta's API)
When a business connects its WhatsApp Business account to UpOMS, or uses the UpOMS platform WhatsApp number, UpOMS accesses the following data through Meta's WhatsApp Business Platform API:
- WhatsApp Business account details: business account ID, phone number ID, display name and phone number.
- Message templates: the names, content, language and approval status of the business's approved message templates.
- Messages sent: template messages sent to the business's customers (order confirmations, tracking updates, delivery and feedback messages), including the recipient phone number, the template used and the delivery/read status returned by Meta.
- Messages received: customer replies to those messages, including text replies, button taps (for example Confirm / Cancel, star ratings and rider-contact answers), media the customer sends, and the message status updates Meta delivers through the webhook.
Customer replies are shown only to the business whose message the customer answered. They are never shown to any other business.
2.4 Courier, tracking and money records
We collect tracking numbers, courier names, delivery statuses and tracking events for parcels booked through UpOMS; courier rate cards, cheque and COD payment records, weight-dispute and claim records, expenses and profit reports that the business creates or that are generated from its orders.
2.5 Usage, logs and cookies
We collect technical logs needed to run and protect the service: login sessions, actions taken in the app (for the activity log), error logs, device and browser information, and IP addresses in server logs. The web app uses a session cookie to keep a signed-in user signed in; it does not use advertising cookies and does not track users across other websites.
3. How we use the information
- To provide the service: storing and showing orders, booking couriers, printing labels, tracking parcels, keeping COD and payment records, and running the reports the business asks for.
- To send confirmations and updates: order-confirmation, tracking, delivery and feedback messages by WhatsApp, SMS or voice call, only to the business's own customers and only where the business has switched the channel on.
- To receive and route replies: customer replies, confirmations, ratings and rider-contact answers are delivered to the business that sent the message, so the business can act on them.
- To support and protect the service: answering support requests, detecting abuse and unauthorised access, keeping audit logs, and improving reliability.
- To meet legal obligations: keeping the financial and tax records the law requires.
We do not use customer order or message data for advertising, and we do not sell personal data to anyone.
4. How information is shared
We share data only as needed to provide the service:
- Couriers: the delivery details of a booked parcel (customer name, phone, address, parcel weight and COD amount) are shared with the courier the business books, so the parcel can be delivered.
- Meta (WhatsApp Business Platform): when a message is sent through WhatsApp, the recipient number and the approved template content are sent to Meta for delivery, and Meta returns delivery/read status and customer replies through the webhook.
- Voice and SMS provider (PakSender): when a business uses voice calls or SMS, the recipient number and the message content are sent to the provider for delivery.
- Shopify: when a business connects its Shopify store, order and fulfilment data is exchanged with Shopify as described in section 2.2.
- Payment processing: subscription payments are handled by the payment provider the business uses; we store only the payment references and masked account details needed for receipts and reconciliation.
- Legal requirements: we disclose information if required by law or by a lawful order of a court or regulator.
We do not share one business's orders, customers or messages with any other business. Service providers listed above receive only the data needed for their part of the service and may not use it for their own purposes.
5. Data retention
Order, customer, message and money records are kept while the business account is active, and afterwards for as long as needed for tax, accounting and legal record-keeping. Server and security logs are kept for a limited period and then deleted. When a business account is closed, its data is deleted on request under section 6, except for records we must keep by law.
6. Your rights and data deletion
If you are a business account owner, you can review and correct your business and account information inside UpOMS, and you can ask us to export or delete your business's data by emailing upomssupport@gmail.com from the email address on the account. We will confirm the request and complete it within 30 days, except for records we must keep by law.
If you are a customer of a business that uses UpOMS (for example, you placed an order with that business and received a WhatsApp message about it), your order details are held by that business. You can ask the business to correct or delete your details, or you can contact us at the same email address and we will pass the request to the business and confirm once it is done.
If you no longer wish to receive WhatsApp messages from a business, reply to the business or contact the business directly; UpOMS also honours opt-out and do-not-disturb settings recorded for a number.
7. Security
We protect data with encryption in transit (HTTPS), hashed passwords, per-business access separation (each business sees only its own data), member permissions set by the business admin, optional two-factor authentication, and server access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we keep improving the measures above and we act on reported vulnerabilities.
8. Children's privacy
UpOMS is business software and is not directed at children under 18. Businesses must not enter children's personal data into UpOMS except where it is genuinely needed for a delivery (for example, a recipient name and phone number for a parcel) and with the consent of a parent or guardian.
9. International transfers
UpOMS is operated from Pakistan and its servers are hosted in the European Union (OVH). Data you enter may therefore be stored and processed in the EU. Data sent to Meta for WhatsApp delivery and to couriers and other providers listed in section 4 is processed under those providers' own terms and locations.
10. Changes to this policy
We may update this policy when the service or the law changes. The "Last updated" date at the top will change, and we will notify account owners of material changes through the app or by email. Continued use of UpOMS after a change means you accept the updated policy.
11. Contact
For any question about this policy, or to request access, correction, export or deletion of data, contact: upomssupport@gmail.com · UpOMS, Udhowali, District Gujranwala, Punjab 52250, Pakistan · Website: upoms.com.