Shadow COD — Privacy Policy

App: Shadow COD  ·  Provider: Vaynox Studio (operating as an independent freelance business; not yet a registered company), India

Contact: vaynoxstudio@gmail.com  ·  Last updated: 23 September 2026

1. Who this policy is for

This policy explains how Shadow COD ("we", "the app") handles data when a Shopify merchant ("you", "the merchant") installs and uses the app, including limited personal data about the merchant's customers ("buyers"). We act as a data processor on behalf of the merchant (the data controller) with respect to buyer data.

2. What data we access and why

We request the minimum Shopify scopes needed to provide the service:

Data	Shopify scope	Purpose
Orders (payment method, fulfilment/delivery status, tags, cancellation/refund status, order value, timestamps, delivery address zip / pincode)	read_orders	Determine each COD order's outcome (delivered/returned) to build the per-store risk memory; check delivery pincode against the merchant's blocked-pincode list
Customer identifiers (name, email, phone) and customer id	read_customers	Recognise a returning buyer and match orders to a buyer; if the merchant has enabled phone-OTP for COD, the phone number entered by the buyer is used to send and verify a one-time code
Customer tags	write_customers	Add/remove the cod-blocked tag that drives checkout behaviour
Payment customizations	write_payment_customizations	Hide the COD option at checkout for risky buyers

We use Shopify Protected Customer Data at the level required for the above and for no other purpose.

2a. Phone-OTP verification (optional feature, opt-in per merchant)

When a merchant enables "Require phone verification for COD", buyers who select Cash on Delivery are asked to verify their mobile number with a one-time code (OTP) sent by SMS. In this flow:

• The buyer enters their phone number in a widget on the merchant's cart page (they are not asked twice; the phone is provided directly by the buyer for verification).
• A 6-digit OTP is generated and sent to the buyer's phone via our SMS sub-processor Message Central (see Section 5). Message Central manages the OTP lifecycle (generation, delivery, and validation) on our behalf.
• We store a peppered one-way hash of the phone number for rate-limiting. The raw phone number is never stored, never logged, and never displayed.
• On successful verification, we mint a short-lived signed token (30-minute default) that gates checkout. The token is bound to the phone + shop; it cannot be reused across buyers or across merchants.
• Verification audit records are retained up to 90 days for abuse detection, then deleted.

3. What we store, and how it's protected

• We store, per merchant store: a buyer record (encrypted phone/email/name), a one-way hashed index of phone/email used only for matching, confirmed order outcomes, computed risk level and reasons, and merchant overrides.
• Buyer contact details are encrypted at rest (AES-256-GCM). Matching uses a peppered one-way hash (blind index); we do not need or use raw contact values for lookups. The merchant dashboard displays masked values only.
• Data is isolated per store. We do not pool, share, sell, or combine buyer data across merchants or with any third party.

4. What we do NOT do

• We do not process payments or store payment-card data.
• We do not share buyer data with other merchants or sell it.
• We do not use buyer data for advertising or profiling beyond the per-store COD risk decision.
• We do not perform automated decisions that produce legal effects; hiding a payment option still allows the buyer to purchase via prepaid.

5. Sub-processors

We use the following infrastructure and service providers to run the service:

• Render — application hosting (United States).
• Neon — managed PostgreSQL database (United States, AWS us-east-1).
• Render Key Value — managed Redis-compatible store for background job queues and rate-limiting (United States, co-located with the application).
• Message Central (U2OPIA MOBILE) — SMS OTP verification for Cash on Delivery phone verification (India). Receives the buyer's phone number only at the moment an OTP is sent, for the sole purpose of delivering and validating that OTP. Used only when the merchant has enabled the phone-OTP feature.
• Shopify — source of the data and the platform we operate on.

A current sub-processor list is available on request at vaynoxstudio@gmail.com.

6. Data retention and deletion

• Buyer data is retained only while the app is installed and needed for the service.
• On customers/redact we erase the identified buyer's records.
• On shop/redact (sent by Shopify ~48 hours after uninstall) we erase all of that store's buyer data.
• On uninstall we stop processing immediately; residual data is erased on the subsequent shop/redact.
• On customers/data_request we provide the merchant the data we hold about the identified buyer.

7. International transfers

Data is processed primarily in the United States (Render; Neon — AWS us-east-1). SMS delivery for OTP verification is processed in India (Message Central). Where required, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) with our sub-processors.

8. Buyer (data subject) rights

Buyers should direct requests to the merchant (the controller). We assist merchants in fulfilling access/erasure requests via Shopify's data-request/redaction webhooks and, if needed, on request to vaynoxstudio@gmail.com.

9. Security

Encryption at rest for PII, hashed blind-index matching, per-store isolation enforced in code, least-privilege scopes, and encrypted transport (TLS) to all providers. Report security concerns to vaynoxstudio@gmail.com.

10. Compliance

We support merchants' compliance with applicable data-protection law, including India's Digital Personal Data Protection Act, 2023 (DPDP), the EU/UK GDPR, and the CCPA, in our role as processor.

11. Changes

We may update this policy; material changes will be posted at this URL with a new "last updated" date.

12. Contact

Vaynox Studio, India — vaynoxstudio@gmail.com