Codela connects to external services only when the related feature is configured and enabled. The details are below. The plugin uses the following external services only in the circumstances described below. Twilio WhatsApp API When the optional WhatsApp module sends a test or an enabled notification, it calls Twilio's API with the configured credentials, sender and recipient numbers, and message text. The text can contain order or customer details selected by the administrator. No request is made before credentials and delivery options are configured. Service: https://www.twilio.com/whatsapp Terms: https://www.twilio.com/legal/tos Privacy: https://www.twilio.com/legal/privacy Gravatar The optional My Account layout uses WordPress's get_avatar() function when avatars are enabled. Unless the site or another avatar plugin supplies a local image, the browser may request it from Gravatar using a hash of the account email and ordinary request data such as IP address and browser details. Service: https://gravatar.com/ Terms: https://wordpress.com/tos/ Privacy: https://automattic.com/privacy/ Administrator-configured HTTPS endpoints Flowboard can send order, customer, notification, support, or operational event data to an HTTPS webhook entered and enabled by an administrator. The optional consent adapter can send email or phone details, consent status, channel, source, order ID, timestamp, and configured site metadata to an administrator-configured HTTPS endpoint. The optional stock synchronization module can retrieve a CSV from an administrator-configured HTTPS URL. The server receives ordinary request metadata such as the site's IP address; no customer or order data is included in that request. The optional Invoice PDF module can retrieve a PDF only from an HTTPS host explicitly allow-listed by an administrator. The remote server receives ordinary request metadata such as the site's IP address. The retrieved document is validated and stored as authenticated ciphertext; its source URL is not shown to customers. No request is sent to these endpoints until the administrator configures and enables the related feature. The receiving provider and its terms and privacy policy are selected by the administrator. Carrier tracking pages The shipment module creates links to public carrier tracking pages. It does not contact a carrier merely by saving or displaying shipment information. When someone opens a tracking link, their browser sends the tracking number in the URL and ordinary request information, such as their IP address and browser details, to that carrier. Built-in templates can link to the providers below. The linked privacy notices are maintained by each provider: Türkiye: Yurtiçi Kargo, Aras Kargo, MNG Kargo, Sürat Kargo, PTT Kargo, HepsiJET, and Kolay Gelsin. Europe and global: DHL, DPD, GLS, UPS, and FedEx. United States: USPS, UPS, FedEx, and DHL. Administrators can add or replace carrier URLs. The terms and privacy policy for a custom carrier endpoint depend on the provider selected by the administrator.