COD Guard India
Privacy policy
Draft for App Store review. Last updated 9 October 2026.
This is a draft privacy policy for COD Guard India, an embedded Shopify app for Indian stores that sell with Cash on Delivery. It is not a substitute for advice from the publisher's own counsel. The contact for privacy and security incidents is the person named on the Shopify App Store listing. This draft does not name that person.
Who we are
COD Guard India scores Cash on Delivery orders after Shopify checkout and can ask the buyer to confirm the order on WhatsApp. It does not replace Shopify checkout, it does not take a commission on sales, and it does not bill merchants outside Shopify.
Data we process
For each Cash on Delivery order we store:
- Name, so the merchant and the WhatsApp template can address the buyer.
- Shipping address, including PIN code, city, and state, so the score can use address completeness and PIN risk.
- Phone number, so a confirmation message can be sent when the merchant has turned WhatsApp on.
- Email, so a customer data request can find the buyer's orders and a redact request can match them.
- Order totals, payment gateway names, fulfillment state, risk score, rule results, and merchant actions.
- WhatsApp template sends and button replies (yes, no, change address). Free-text replies are stored for the merchant and are not written back to Shopify.
- Shiprocket or Delhivery airway bill numbers and scan status, when the merchant connects a carrier.
Prepaid orders are not stored. We do not sell personal data. We do not use it for advertising. Access tokens for WhatsApp and carriers are stored as ciphertext.
Why
The merchant installs the app to reduce return-to-origin risk on Cash on Delivery. Scoring, rules, WhatsApp confirmation, and carrier status all use the fields above for that purpose only. A high score can recommend a cancel or, if the merchant turns it on, hide Cash on Delivery at checkout or cancel the Shopify order. Auto-cancel stays off until the merchant enables it.
Retention
Order name, address, phone, and email are cleared after the shop's retention window. The default is 365 days from the Shopify order date (`piiRetentionDays`). The worker runs this job on startup and every six hours. Shopify's customers/redact webhook clears the same fields sooner. Shopify's shop/redact webhook, sent after uninstall, deletes the shop's sessions and shop-owned rows. Score totals that no longer contain those fields may remain until the shop is deleted.
Shopify compliance webhooks
The app accepts customers/data_request, customers/redact, and shop/redact at /webhooks/compliance. A bad HMAC is rejected. A valid payload is stored on a ComplianceRequest in Postgres. The Redis job carries only that request id and the webhook id, and completed or failed GDPR jobs are deleted immediately. The merchant data processing terms are at /terms.
Where data lives
Production data is stored in Neon Postgres in aws-ap-southeast-1 (Singapore), with encryption at rest provided by Neon. The job queue is Upstash Redis in Singapore. TLS covers the browser to the Fly app. Development uses a separate local database. Staff access, backup encryption evidence, and the incident contact are owner responsibilities before submission.
Merchants and buyers
The merchant decides to install the app and to turn on WhatsApp, checkout hiding, and auto-cancel. Buyers place the order in Shopify checkout. COD Guard does not add a fee to the buyer's cart.