Privacy Policy

Signal is a digital product operated by ONX ("Signal", "we", "us") that helps online merchants ("Merchant", "you") identify customers with a history of frequent delivery refusals — for example, repeatedly refusing a cash-on-delivery package or causing a customer-caused return to origin (RTO) — so the Merchant can decide whether to fulfil an order before it ships. Signal looks only at a customer's own recorded delivery outcomes, and specifically distinguishes outcomes the customer caused (refusal, customer-caused RTO) from outcomes caused by the courier or the Merchant, which do not count against the customer. Signal does not accuse anyone of fraud and does not run fraud, identity, or credit checks. This Privacy Policy explains what personal data we process, why, and what rights are available to the people the data is about.

Signal is operated by ONX, a sole proprietorship registered in Pakistan, with a registered business address at Karachi, Pakistan. The proprietor's full legal name is available on request by emailing privacy@onx.digital, which is also where you can reach us for any privacy question or request.

1. Two kinds of people this policy covers

Signal sits between two groups of people, and we act differently for each:

• Merchants and their staff (people with a Signal login) — for this group, Signal is the data controller. We decide why and how account, billing, and usage data is processed.
• A Merchant's end customers (the shoppers whose phone numbers and orders are checked) — for this group, the Merchant is the data controller and Signal is a data processor / service provider acting only on the Merchant's instructions, as set out in our Terms and any Data Processing Addendum executed with the Merchant. If you are a shopper and have a question about how your data was used, you should generally contact the merchant you placed the order with; Signal will also respond to direct requests as described in Section 8.

2. What we collect

a. Merchant account data (Signal is the controller)

• Name, work email address, business name, country, timezone, and default currency, provided at signup.
• Password (stored only as a salted hash, never in plain text).
• Billing and plan information: plan tier, credit usage, and invoicing details for your subscription.
• API integration credentials you generate (e.g. Shopify connector tokens), which are stored hashed/encrypted, not in plain text.
• Support correspondence you send us.

b. End-customer order data (the Merchant is the controller; Signal processes it on their behalf)

• Phone number — the primary identifier Signal uses to build a customer's own delivery-history record. It is encrypted at rest; the dashboard only ever displays a masked version (e.g. +92 3●● ●●● 210). A one-way lookup token (not the phone number itself) is used to match repeat orders without exposing the underlying number to application code that doesn't need it.
• Order metadata: amount, currency, order status, payment method (e.g. cash-on-delivery vs. prepaid), and an external order reference from the Merchant's store platform.
• The final delivery outcome for each order, classified as one of: successful delivery, customer-refused delivery, customer-caused return to origin, post-dispatch cancellation, merchant cancellation, courier failure, merchant fault, ordinary return, mixed outcome, or unknown. Only the customer-caused outcomes (refusal, customer-caused RTO) count against a customer; courier- and merchant-caused outcomes are recorded but do not.
• The resulting score, band, and the reasons/evidence behind it, generated from the above — reflecting that customer's own recorded delivery outcomes, not an accusation of wrongdoing.

c. Technical data

• A single first-party authentication session cookie (see our Cookie Policy) and standard server access logs (IP address, timestamp, request path) kept for security purposes.

We do not collect payment card numbers — Signal subscriptions are currently billed by offline invoice, not card, so no cardholder data passes through Signal's systems today.

3. Why we process this data, and on what legal basis

Pakistan does not currently have a regulator that requires a single fixed list of "legal bases" the way the EU's GDPR does, but we apply an equivalent discipline as a matter of policy: we only process personal data where we can point to one of the grounds below.

4. "Network mode" — cross-merchant history sharing

Merchants can optionally switch their workspace from Private mode (scoring uses only that Merchant's own order history) to Network mode (eligible order outcomes are contributed to an aggregated pool, so a customer's delivery/return history with one merchant can also inform another merchant who has never received an order from that phone number before). Key facts about how this works today:

• Network mode is off by default and requires the Merchant to explicitly opt in and accept the current network policy version.
• Individual orders, amounts, and Merchant identities are not exposed to other Merchants — only aggregated history signal tied to the phone-number token is shared, gated behind a minimum-contribution threshold before it becomes usable.
• A Merchant can opt back out to Private mode; switching modes is subject to a 24-hour cooldown, and withdrawal removes that Merchant's contributed history from future aggregate calculations going forward.
• Merchant responsibility: because the underlying data belongs to the Merchant's own customers, the Merchant — not Signal — is responsible for ensuring its own privacy notice and applicable Pakistani law permit sharing that data into a cross-merchant history network before turning Network mode on.

5. Automated order holds — and your right to human review

A Merchant may separately choose to enable automatic order holds: if an order's score crosses a threshold the Merchant sets, Signal instructs the Merchant's store to place that order's fulfillment on hold, pending the Merchant's manual review. This is optional, off unless the Merchant turns it on, and never cancels an order or refuses service by itself — it only pauses shipment until a person at the Merchant looks at it.

Because this is a form of automated decision-making, Signal is designed as a matter of policy so a human at the Merchant always reviews and makes the final call before an order is cancelled or refused — Signal itself only flags and pauses; it does not make the final decision on its own. If you believe an order of yours was held or affected by an automated score and want it reviewed by a person, contact the Merchant you ordered from, or contact us at privacy@onx.digital and we will pass your request to the responsible Merchant.

6. Who we share data with

• Merchants, who see the order and history data for their own store in their dashboard.
• Infrastructure and sub-processors that host and run the Service (cloud hosting, email delivery), bound by confidentiality and data-processing terms. A current sub-processor list is available on request.
• Shopify, to the extent a Merchant connects their Shopify store; Shopify's own privacy policy governs its handling of data within its platform.
• Professional advisors, regulators, or law enforcement where required by law or to protect Signal's or a Merchant's rights.
• A successor entity in the event of a merger, acquisition, or asset sale, subject to the same protections described here.

We do not sell personal data, and we do not share personal data with third parties for their own advertising purposes.

7. Retention and deletion

We retain Merchant account data for as long as the account is active and as needed to meet legal, tax, and dispute-resolution obligations after closure.

For end-customer phone/order data, Signal supports the standard Shopify data-protection webhooks:

• Customer data request — a Merchant (or, via Shopify, an end customer through the Merchant) can request the data Signal holds tied to a phone number; Signal compiles and delivers this to the Merchant's account owner(s), who remain responsible for further disclosure to their customer.
• Customer redact — on request, Signal pseudonymizes the identifying phone number (the encrypted number and its masked display form are erased) while retaining the non-identifying order and outcome history under that now-anonymous record, so a customer's legitimate delivery-history record isn't lost for future orders. If full deletion rather than pseudonymization is required in your jurisdiction, contact us at the address below.
• Shop redact — when a Merchant's store integration is removed, Shopify requests full redaction of that shop's data on a delay (currently processed after a short retention window, consistent with Shopify's own compliance timing).

These requests are processed automatically but not always instantly — please allow a short processing window (typically a few days) for a request to complete.

8. Security

Phone numbers are encrypted at rest; a separate, non-reversible lookup token is used for matching so that ordinary application logic never needs to decrypt the underlying number. Passwords are hashed, never stored or logged in plain text. Access to production data is limited to personnel who need it to operate the Service. No system is 100% secure, and we cannot guarantee absolute security of information transmitted to us.

9. Your rights

If you are in Pakistan

As of this policy's last review, Pakistan does not yet have a single comprehensive data-protection statute in force; a Personal Data Protection Bill has been under legislative development for several years and its status should be re-confirmed with local counsel, as it may have changed. In the meantime, data-related conduct is addressed in part by the Prevention of Electronic Crimes Act 2016 (unauthorized access, data breach, and related offences) and applicable sector rules. Regardless of what is strictly mandated, Signal voluntarily extends the following practical rights to individuals: you may ask us what data we hold about a phone number, ask for it to be corrected, ask for it to be pseudonymized/redacted per Section 7, and ask for human review of an automated hold per Section 5.

If Signal expands to other countries in the future

Signal currently serves merchants only in Pakistan. If that changes — for example, an expansion to the UAE or elsewhere — this Privacy Policy will be updated with jurisdiction-specific rights, a lawful basis for cross-border data transfer, and any local registration Signal needs, before that expansion goes live. Until then, if Signal ever processes data of someone located outside Pakistan, we will still honor a request to know what we hold, correct it, or have it pseudonymized/redacted, on the same terms as Section 7.

To exercise any of these rights, email privacy@onx.digital. If you are an end customer of a Merchant, we may direct your request to that Merchant, who is the controller of your data, unless you are exercising a right that Signal can fulfill directly (such as the Shopify redact/data-request pathways above).

10. International data transfers

Signal currently serves merchants in Pakistan only. Signal's hosting region has not yet been finalized, and it may end up processing or storing data in a country other than Pakistan even while only serving Pakistani merchants; Pakistan does not currently impose a formal cross-border transfer regime, but we apply reasonable safeguards (such as contractual confidentiality obligations with any hosting provider) as a matter of policy. [Update this section with the actual hosting region(s) once infrastructure is finalized.] If Signal later expands to serve merchants in other countries, this section will be updated with any transfer mechanism that expansion requires, as noted in Section 9.

11. Children's privacy

The Service is intended for business use by adults operating a merchant account. It is not directed at children, and we do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified to Merchants by email or in-product notice before they take effect.

13. Contact us

ONX (sole proprietorship; proprietor's legal name available on request)
Karachi, Pakistan
Email: privacy@onx.digital