COD Shield

Privacy policy

Last updated October 29, 2026

COD Shield is a Shopify app made by Nexus Cloud Services (“we”). It lets a store mark cash on delivery (COD) orders that the buyer refused, and hides COD at checkout for buyers who refused before. This policy explains what the app stores when a merchant installs it, including information about the merchant’s buyers, and how that information is used and deleted.

Information the app stores

The app reads this from the merchant’s Shopify store through Shopify’s API:

• The store: its myshopify.com domain, the access token Shopify issues to the app, and the app’s settings (COD rules, the payment method names treated as COD, and the estimated shipping cost of a refusal).
• COD orders only: the order number, total and currency, order date, product titles and quantities, cancel reason, the Shopify customer ID if there is one, and whether it was the buyer’s first order. Orders paid any other way are ignored.
• The buyer on those orders: their name, the last 4 digits of their phone number, their city, province and country, and a hash of their phone number and of their shipping address. The full phone number and street address are not stored.
• What the merchant enters: refusal reasons and notes, and buyers they add to the blocked or trusted list by hand.

A hash is a short code calculated from the phone number or address. It lets checkout recognise the same number again without keeping the number itself. A hash is not encryption: someone who had it could test guesses against it. We therefore treat hashes as personal information and protect them like the rest.

The app also saves the store’s checkout rule (its limits and the list of blocked hashes) in the merchant’s own Shopify store. A Shopify Function runs that rule inside Shopify’s checkout. The app’s server does not receive anything a buyer types at checkout.

What the app does not collect

• Card or other payment details.
• Full phone numbers or street addresses.
• Anything about buyers’ browsing. Buyers never use the app directly.
• Analytics, advertising or tracking cookies, for merchants or buyers.

How the information is used

Only to run the app for the store that installed it: listing refused orders, working out the refusal rate and the money lost to refusals, and building the checkout rule. Each store’s data is kept separate. A buyer blocked by one store is not blocked by any other store, and we do not combine data across stores. We do not sell the information or use it for marketing.

Who else handles it

• Shopify, which runs the store, the checkout and the Shopify Function.
• OVHcloud, which hosts the server and database the app runs on.

No one else receives it, unless the law requires us to disclose it.

How long it is kept, and deletion

• While the app is installed, the information is kept so the store’s reports keep working.
• When a merchant uninstalls the app, its access token is deleted straight away and the checkout rule stops running. Shopify sends us a deletion request 48 hours later, and we then delete all of that store’s orders, buyers and settings.
• When a buyer asks the store to delete their data, Shopify passes the request to us. We remove the buyer from the blocked list, and clear their name, phone digits, hashes, city and the merchant’s notes from their orders. The order totals and products stay, without the buyer’s details, so the store’s refusal rate stays correct.
• Database backups are made nightly, encrypted, and deleted after 14 days, so deleted information is gone from backups within 14 days.

Requests from buyers

The store a buyer ordered from decides what happens with their information, and we handle it on the store’s behalf. To see, correct or delete your information, contact that store. Merchants can see everything the app holds about a buyer on its Refusals and Blocked buyers pages. You can also write to us at the address below, and we will work with the store to answer.

Security

The app is served only over HTTPS. Buyer names, phone digits and notes are encrypted in the database with AES-256-GCM, and backups are encrypted too. The database accepts connections only from the app’s own server, and the server is reachable for maintenance only with our SSH key. Messages from Shopify are checked with Shopify’s signature before the app acts on them. Our handling of the store’s data is also set out in the data processing terms within our terms of service.

Children

The app is for businesses and is not directed at children.

Changes

If this policy changes, the new version will be posted on this page with a new date.

Contact

Nexus Cloud Services
rupert2133@gmail.com