Privacy & data
Protected customer data
COD Flex reads your store’s native Cash-on-Delivery orders to score how likely each one is to be refused, and generates courier shipping labels. To do that it must process the buyer’s order and delivery details — so it requests order scopes and is Level 1. It never creates orders and never touches checkout.
PCD LEVEL 1
What COD Flex accesses
read_orders / write_orders
To read each Cash-on-Delivery order and score its refusal risk, to tag the risky ones so you can act on them, and — when you edit an order in Shopify — to refresh the COD total we display. Order data includes the buyer’s name, phone, email and address — which is why this app is Level 1.
read_fulfillments / write_fulfillments / write_merchant_managed_fulfillment_orders / read_locations
To generate the courier AWB for the delivery address, mark the order fulfilled with tracking, and update delivery status.
read_shipping / write_shipping
To read your real Shopify shipping rates for the buyer’s address and, when you ask, to write shipping rates back into Shopify.
write_payment_customizations / read_products
To hide Cash-on-Delivery at checkout for the addresses you flag (a Payment Customization Function), and to resolve the variant, price and stock the buyer is ordering.
What COD Flex stores
For each COD order: the Shopify order ID and name, the amounts (COD total, currency), the chosen courier, parcel count, AWB, tracking number and delivery status, the delivery method and locker (if any), and an address-validation status — plus your shop domain, app settings and billing status. To prevent repeat refusals it keeps a hashed contact reference and refusal counts — never the raw phone or email.
The buyer’s name, phone, email and address are read from the order to score refusal risk and are passed to your own courier (to print the AWB). To prevent repeat refusals, email and phone are SHA-256 hashed and only the hash is stored — never the raw value. COD Flex never stores card or bank details — Cash-on-Delivery takes no card.
How your data is handled
- Purpose-limited: order data is used only to score refusal risk, ship the COD order, keep the COD total we display in step, and prevent repeat refusals. It is never sold, shared, or used for advertising or model training of our own.
- EU hosting, TLS in transit: COD Flex is hosted on a dedicated server in the European Union; all traffic is served over HTTPS/TLS, and access is restricted.
- Your couriers only: data is sent to a courier only with your own account credentials, only to ship an order you created.
- Deletion & export: we honour the mandatory Shopify webhooks. customers/data_request returns the stored COD order rows for a customer; customers/redact deletes those COD order rows and any refusal risk profile; shop/redact deletes all of the shop’s data, including web-vitals and sessions.
- No card data, ever: COD is paid in cash at delivery — COD Flex never touches card or bank details and never handles your money.
No AI
COD Flex is deterministic. The COD-total refresh, hide-COD rules, address matching and tracking are rules — not predictions. Nothing from your store is sent to an AI model.