Privacy Policy

Effective date: 2 October 2026

CODWise is a Shopify app that hides, renames and reorders payment and delivery methods at checkout, using rules the merchant sets up. Script Veda, an individual developer in India, builds and runs it. This page explains what CODWise stores when you install it, why it needs that data, and how to get it deleted. Questions go to scriptvedainnovations@gmail.com.

1. What we store about your store

Store and access credentials

When you install CODWise, Shopify sends us your store's myshopify.com domain, an access token, a refresh token and their expiry times. We keep these in a session record with the permissions you approved: read products, and manage payment and delivery customizations. CODWise uses the token to call the Shopify Admin API with those permissions and nothing more.

CODWise only asks for store-level access. It never requests tokens for individual staff members, so we don't store staff names or email addresses.

Your rules

For each rule we store its name, whether it's on, whether it applies to payment or delivery methods, the method names it matches, its action (hide, rename or reorder), the new name or position, and its conditions. Conditions can use cart value, country, zip or pincode lists, products, collections, product tags, customer tags, order count, cart weight, currency, day and time, and whether the buyer is a B2B company.

When you import pincodes from a CSV file, your browser reads the file. We save only the codes it contains. The file itself is never uploaded.

App settings

Each store has one settings record: the plan setting (free or pro), the payment method names CODWise treats as cash on delivery, whether you finished onboarding, and when the record was created and last changed.

A copy of your active rules in your Shopify store

Checkout can only apply rules it can read, so CODWise saves a copy of your active rules in your store. The copy, plus the list of tags and collections those rules check, sits in app-reserved metafields on the payment and delivery customizations CODWise creates. It lives in Shopify, not on our server.

Billing

Shopify bills paid plans. CODWise asks Shopify whether your store has an active CODWise subscription and applies the matching plan limits. We never see card or bank details.

Server logs

Our server logs each request it receives: the time, method, page path, response status, how long it took and the IP address it came from. Some lines also include your store's domain, for example when Shopify tells us the app was uninstalled. We strip query strings, login tokens and request signatures before anything is logged. We read the logs to spot abuse and fix problems. They rotate automatically, so old entries get overwritten. Rate limiting also uses IP addresses, held in memory only.

Support emails

When you email us, we receive what you send, usually your name, email address, store domain and a description of the problem. We use it only to answer you.

2. What we don't collect

CODWise doesn't store your customers' names, email addresses, phone numbers, addresses or order details.

Your rules run as Shopify Functions, on Shopify's own servers, during checkout. To decide which methods to show, Shopify gives the Function:

• the cart total and currency;
• the products in the cart, with their IDs, quantities and weights, and whether they carry the tags or belong to the collections your rules check;
• for a logged-in customer, their number of previous orders and whether they have the customer tags your rules check;
• whether the buyer is purchasing for a B2B company;
• the delivery country and zip or postal code;
• your store's local date and time;
• the names of the available payment methods or delivery options.

All of this stays inside Shopify. Shopify Functions can't make network calls, so none of it is sent to or stored on our server.

CODWise adds no analytics, advertising or tracking scripts to your admin, your storefront or these pages. We don't sell, rent or trade any information.

3. Why we use it

We use the information above to:

• sign you in to CODWise from your Shopify admin;
• save your rules and apply them at checkout;
• apply your plan's limits;
• answer support requests;
• keep the service secure and fix problems.

Our legal basis is that we need this information to provide the app you installed, plus our legitimate interest in keeping it secure and working.

4. Who handles the data

• Shopify runs the platform CODWise is built on: sign-in, the Admin API, checkout (where your rules run) and billing. Shopify's own privacy policy covers what it does with data.
• Our email provider delivers messages sent to scriptvedainnovations@gmail.com.

Shopify and the developer are in different countries, so your information may be processed outside the country where your store is based. We share it only as far as running the app requires.

5. How long we keep it

• While CODWise is installed, we keep your rules, settings and session. You can edit or delete any rule in the app at any time.
• When you uninstall, Shopify tells us straight away and we delete your store's session, rules and settings. Shopify removes the app's checkout customizations, along with the rule copy saved on them.
• 48 hours after uninstall, Shopify sends a shop/redact request and we delete anything still held for your store.
• We take an encrypted database backup every day and keep each one for 14 days. The server can create backups but can't decrypt them; the decryption key is kept offline. Deleted data disappears from backups once the last copy that contains it expires, at most 14 days later.
• Server logs get overwritten as they rotate.
• We keep support emails while we help you and for a reasonable time afterwards. Ask, and we'll delete them.

6. Shopify privacy requests (GDPR webhooks)

CODWise handles all three privacy webhooks Shopify requires, and checks Shopify's signature on every request before acting on it.

• customers/data_request: we hold no personal data about your customers, so there's nothing to report. We acknowledge the request.
• customers/redact: there's nothing to delete, for the same reason. We acknowledge the request.
• shop/redact: we delete every rule, settings record and session for the store.

7. How we protect it

• All traffic to and from CODWise uses HTTPS.
• Every request from your admin carries a Shopify session token, which we verify. Every database query is limited to your own store's data.
• Access tokens stay on our server. They never go to your browser or into our logs.
• The database only accepts connections from inside the server and can't be reached from the internet. Only the developer has administrative access to the server.
• Rate limits and request size limits block abuse.

If a security incident affects your store's data, we'll tell you without undue delay.

8. Your rights and choices

• You can see, change or delete your rules in CODWise at any time.
• Uninstalling CODWise deletes your data as described above.
• Email scriptvedainnovations@gmail.com to get a copy of the data we hold for your store, or to have it corrected or deleted. We reply within 30 days, usually much sooner.
• Depending on where you live, you can also complain to your local data protection authority.

Shoppers: CODWise holds no information about you. The store you bought from controls your customer data in Shopify, so contact that store directly.

CODWise is a tool for businesses and isn't meant for children.

9. Changes to this policy

We publish any new version on this page and update the effective date at the top. If a change significantly affects how we use your data, we publish it here at least 14 days before it takes effect.

10. Contact

Script Veda, India. Email: scriptvedainnovations@gmail.com