HideCOD Privacy Policy

Last updated: 17 October 2026

What HideCOD does

HideCOD helps ecommerce merchants manage cash-on-delivery eligibility and risk. The service can match customer identifiers against COD incident or restriction records so connected stores can make a COD availability decision.

Personal data we process

For the Shopify integration, HideCOD requests only customer email and phone when those identifiers are needed for core app functionality. We do not require customer name or postal address for the COD eligibility flow.

Why we process it

Customer identifiers are used to match records, record relevant COD incidents, prevent duplicate records, and return COD eligibility signals to connected stores. Protected customer data is not used for advertising or unrelated marketing.

Security

Customer email and phone are encrypted server-side before storage. Searchable matching keys are generated server-side, and sensitive application secrets and Shopify installation tokens are not exposed to browser clients. Network traffic is protected using HTTPS/TLS, and access to risk data is restricted to authorized roles.

Retention and deletion

COD incident records have a default retention period of 24 months from the incident date and are excluded from active COD decisions after their retention date. Records can be removed or anonymized earlier when they are no longer necessary, and longer retention is used only where required by applicable law. Shopify privacy requests are processed through the mandatory Shopify privacy webhook flow and handled within the timeframe required by Shopify.

Shopify privacy requests

HideCOD supports Shopify customer data requests, customer redaction requests, and shop redaction requests. Redaction removes data contributed by the requesting store unless retention is required by law or another independent lawful data source still requires the record.

Test and production separation

Shopify partner development stores are separated from production merchant stores. Test-store COD incidents and network signals are not used to make production-store COD decisions, and production signals are not used for test-store decisions.

Service providers

HideCOD uses infrastructure and database service providers to host and secure the application. These providers process data only as needed to provide the service and are subject to their own security and data-protection obligations.

Merchant responsibilities

Merchants are responsible for ensuring that their use of HideCOD and any customer data they submit has an appropriate legal basis and is described in their own customer-facing privacy notices where required.

Contact

Privacy and data-protection questions can be sent to hidecod1@gmail.com.