Privacy Policy

Easy COD Form, by Amrania Labs · Last updated: 3 August 2026 · Contact: amrani4online@gmail.com

Easy COD Form ("the App") is a Shopify application that lets merchants collect cash-on-delivery orders through an order form on their storefront. This policy explains what data the App handles, why, and what rights you have. It covers both merchants who install the App and shoppers who use the order form on a merchant's store.

Our role

For shopper data collected through the order form, the merchant operating the store is the data controller and Amrania Labs acts as a data processor on the merchant's behalf. Shopify Inc. independently processes the same order data as the merchant's commerce platform.

Data we collect

From shoppers (through the order form)

Data	Purpose	Stored by the App?
Name, phone number, delivery address, country, and (optionally) email	Creating the cash-on-delivery order and prefilling the store's Shopify checkout	Passed to Shopify. Stored by the App only when a shopper starts the form and does not finish ("abandoned form"), so the merchant can follow up
Order details (product, variant, quantity, totals, discount code, order number)	Order records, the merchant's dashboard, and plan metering	Yes — order references without shopper identity
IP address	Rate limiting and abuse prevention only	Never stored raw — only a keyed HMAC-SHA-256 digest
Campaign parameters (utm_*) and, where the merchant has enabled ad tracking, the browser identifiers _fbp, _fbc, ttclid	Attributing the sale to the merchant's own advertising	Attached to the order; identifiers are forwarded, not retained

From merchants

Data	Purpose
Store domain and app settings (countries served, shipping rates, quantity offers, order tags)	Operating the App
Optional ad-platform credentials (Meta / TikTok access tokens, GA4 API secret)	Sending the merchant's own conversion events; stored encrypted at rest
Subscription plan and order counts per billing period	Billing and plan limits

What we do not do

We do not sell or rent personal data, to anyone, ever.
We do not use shopper data for our own marketing or profiling.
We do not store payment details — the App has none: orders are cash on delivery, completed through Shopify's own checkout.
The order form sets no advertising cookies of its own.

Sharing

Data is shared only with:

Shopify — the order, customer and checkout data that makes the sale exist on the merchant's store.
The merchant's own advertising platforms (Meta, TikTok, Google Analytics 4) — only if the merchant has connected them, and only hashed identifiers (SHA-256 of email/phone/name/address fields) plus order value, as those platforms' conversion APIs require.
Our hosting provider — which processes data on our instructions to run the App.

Retention

Abandoned form records are deleted automatically after the merchant's configured retention window (30 days by default), and immediately when the shopper's order completes or the merchant deletes them.
Order references are kept while the App is installed, for the merchant's dashboard and billing.
Uninstall: when a merchant uninstalls the App, all of that store's data — settings, credentials, order references, abandoned forms, hashed identifiers — is erased in response to Shopify's shop/redact notice (sent 48 hours after uninstall).

Your rights (GDPR and similar laws)

Shoppers can ask the merchant they bought from to access, correct, or delete their data. The App implements Shopify's mandatory privacy webhooks in full:

customers/data_request — we compile any data held about the shopper and return it to the merchant.
customers/redact — we delete the shopper's abandoned-form records and unlink hashed identifiers from their orders.
shop/redact — we erase everything for the store.

You may also contact us directly at amrani4online@gmail.com and we will act on verified requests within 30 days.

Security

All traffic uses TLS; storefront requests are verified with Shopify's HMAC signatures.
Ad-platform credentials are encrypted at rest.
IP addresses are stored only as keyed one-way digests.
Access to production systems is limited to the developer.

Children

The App is not directed at children and we do not knowingly collect data from anyone under 16.

Changes

If this policy changes materially, the "Last updated" date above changes and merchants are notified through the App.

Contact

Amrania Labs · amrani4online@gmail.com