Privacy policy

Last updated 10 October 2026

CODeal (“the app”) is a Shopify app operated by zSellr Enterprises LLP (“we”, “us”). It lets Shopify merchants control cash on delivery at checkout: which payment methods are offered, whether a COD fee applies, and discounts for paying online. This policy explains what the app collects, why, how long it is kept and who it is shared with.

What we collect from merchants

Store details — your shop domain, store name and store currency, taken from Shopify when you install.
An access token Shopify issues so the app can act on your store. It is stored on our server and never sent to a browser.
Your configuration — the rules, fees, discounts and lists you create in the app, and a history of changes to them.
Your plan — which subscription you are on, read from Shopify Billing. We never see or store card or bank details; Shopify handles all payment.

What we process about your customers

The app processes customer information only on your behalf, and only what is needed to decide cash on delivery for an order. You are the controller of your customers’ data; we act as your processor.

At checkout. The app’s rules run as Shopify Functions, inside Shopify’s own infrastructure. They read the delivery region (country, state, city and postcode), the customer’s order count and tags, and the cart. This happens inside Shopify and none of it is sent to our servers.
Customer tags. When a customer’s tags change, Shopify sends the app that customer’s record. The app reads only the customer ID and tags, copies the tags your rules check to a field on that customer in your store so checkout rules can read them, and records the customer ID in its access log.
After an order is placed. To add a COD fee, Shopify sends the app the new order. The app reads the order total, its items and discounts, the delivery region (country, state, city and postcode), the customer’s order count and tags, and the payment choice, decides whether a fee applies, and records the outcome.
On the cart page. If you add the app’s Payment choice block to your theme, it sends the app the cart’s currency, total, item count and discount amount, the buyer’s choice so far, and, for each item, its price, quantity, vendor, product type and SKU, to show the buyer an accurate saving. The COD notice block and the store-wide notice load your message from the app; the blocks themselves send nothing about the buyer. Shopify adds the logged-in customer’s ID to these requests; the app does not use it. Nothing from these requests is stored.

What we never collect

The app never reads or stores a customer’s name, email address, phone number or payment details. Shopify’s order notification contains the street address; CODeal does not read, store or log it. The app does not track shoppers, set cookies on your storefront, or build profiles of anyone.

What we store, and for how long

Activity records — one per order the app evaluated: the order number, the cart total and whether each of your conditions matched. The customer’s own values are removed before the record is saved, so it shows that a postcode rule matched, not which postcode. Every record is deleted after 90 days.
Fee records — the order number and the fee charged, so the same order is never charged twice.
Access records — each time the app handles customer data, it records which fields were involved (for example “postcode”), when, and by which process or staff member. It records the field names only, never the values. Access records are deleted after one year.
Your configuration and change history — kept while the app is installed.

When you uninstall

Your access token is deleted immediately. Your configuration is kept for a short period so that reinstalling restores your rules. Shopify then tells us to erase your store’s data — normally 48 hours after you uninstall — and at that point we delete everything the app holds about your store, including all activity and fee records.

Customer data requests

When a customer asks you to delete their data, Shopify tells the app which of their orders are affected, and we delete every activity, fee and access record for those orders and that customer. When a customer asks what is held about them, the records tied to their orders (order number, order total, fee charged, and whether each rule matched, without their own values), and any access records naming their customer ID, are available to you: write to info@zsellr.com and we send them within 30 days.

Who we share data with

We do not sell data, show advertising, or use analytics or tracking services. The only company that handles the app’s data is our hosting provider, Railway, which runs the app’s server and database in the European Union (Netherlands). Fonts and other assets are served from the app’s own domain, so opening the app does not contact any other third party. Shopify, as the platform the app runs on, processes data under its own privacy policy.

Security

All traffic is encrypted in transit (HTTPS). Every message from Shopify is verified with Shopify’s signature before the app acts on it, and anything unsigned is rejected. Access tokens stay on the server.

Your rights

You can ask us for a copy of the data the app holds about your store, or ask us to correct or delete it, at any time. Depending on where you are, laws such as the GDPR, the UK GDPR, the CCPA or India’s Digital Personal Data Protection Act 2023 may give you further rights; we honour requests under whichever applies. Customers should contact the store they bought from, who can reach us if needed.

Complaints

If you have a concern about how the app handles data, write to info@zsellr.com with “Privacy” in the subject. We acknowledge every complaint and aim to resolve it within one month. You may also complain to the data protection authority where you live.

Children

The app is a business tool for Shopify merchants and is not directed at children.

Changes

If we change what the app collects or how it is used, we will update this page and the date at the top. Material changes will be shown inside the app before they take effect.

Contact

zSellr Enterprises LLP — for anything about privacy or your data, contact info@zsellr.com.