Privacy policy

Last updated 3 November 2026

CodWing is a Shopify app that adds a checkout, cash-on-delivery verification and order messaging to Shopify stores ("merchants"). This policy explains what data CodWing handles, why, and what you can do about it. Questions: hello@codwing.com.

Who this covers

Merchants who install CodWing, and buyers who check out on a merchant's store through CodWing. For buyer data, the merchant decides how it is used and CodWing processes it on the merchant's behalf.

Data we handle

• Store data from Shopify: store name, domain, owner email, products, orders and customers, through the permissions the merchant approves at install.
• Buyer checkout data: name, phone number, email (if given), delivery address, cart contents, chosen payment method, and order and delivery status.
• Verification data: one-time codes sent to a buyer's WhatsApp to confirm cash-on-delivery orders, and whether they were confirmed.
• Technical data: IP address, browser and device details, and pages viewed in the checkout, used for security, fraud prevention and debugging.
• Merchant settings: payment gateway keys, WhatsApp Business account details and Meta pixel details that the merchant connects. Keys are stored encrypted.

CodWing does not collect or store card numbers, UPI PINs or bank login details. Payments are processed by the merchant's own payment gateway (such as Razorpay or PayU) under that gateway's terms.

How we use it

• To create orders in the merchant's Shopify store and show the checkout.
• To send order confirmations, OTPs and delivery updates from the merchant's own WhatsApp Business number.
• To estimate return-to-origin (RTO) risk and apply the merchant's rules, such as asking for a partial advance.
• To send purchase and delivery events to the merchant's own Meta pixel, when the merchant turns this on.
• To keep the service secure, fix problems and provide support.

We do not sell personal data and do not use one merchant's buyer data for another merchant.

Who we share it with

Only with services needed to run CodWing: Shopify; the merchant's payment gateway; Meta (WhatsApp Business Platform and the merchant's pixel); the merchant's courier partner when the merchant connects one; and our hosting and database providers. Each receives only what it needs for its task.

How long we keep it

We keep order and checkout data while the merchant uses CodWing. When a merchant uninstalls, we delete their store's data within 30 days, except records we must keep by law. Shopify's data-request and redaction requests are honoured as Shopify sends them.

Your choices

Buyers can ask the merchant, or us at hello@codwing.com, to see, correct or delete their data. We will respond within 30 days and coordinate with the merchant where needed. Merchants can export or delete their data by contacting us.

Security

Data is sent over HTTPS, gateway keys are encrypted at rest, and access is limited to people who need it to run the service.

Changes

We will post updates here and change the date above. Material changes will be emailed to merchants.