FluxCOD

Privacy Policy

Last updated: April 5, 2026

FluxCOD ("we", "our", "the app") is operated by FluxWin Tech. This privacy policy describes how we collect, use, and protect information when you install and use our Shopify app.

1. Information We Collect

From Merchants (App Users)

  • Shopify store information: Store domain, store name, email, and country (provided by Shopify during installation).
  • App configuration: Form designs, offer settings, coverage preferences, pixel configurations, and other settings you configure within the app.

From Customers (End Users of Merchant Stores)

When a customer submits a COD order form on a merchant's store, we collect:

  • Name: To include in the order and shipping label.
  • Phone number: To coordinate delivery via WhatsApp or phone.
  • Shipping address: Department, district, and delivery address or agency pickup point.
  • DNI (optional): National ID number, only if the merchant enables this field.

Automatically Collected

  • IP address: For fraud detection and rate limiting. Not stored permanently.
  • Browser fingerprint: A non-identifying hash used for fraud detection. Not linked to personal identity.
  • Analytics events: Form opens, field completions, and order submissions — stored as aggregate data for conversion analytics.

2. How We Use Information

  • Order processing: Creating orders in Shopify with customer shipping details.
  • Fraud prevention: Phone deduplication, IP rate limiting, and blacklist management to prevent fake orders.
  • Analytics: Aggregate conversion metrics (form opens, submissions, revenue) to help merchants optimize their forms.
  • WhatsApp notifications: If configured by the merchant, sending order details via WhatsApp.

3. Data Storage and Security

  • All data is stored in a PostgreSQL database hosted on Supabase (AWS infrastructure, South America region).
  • Shopify access tokens are encrypted using AES-256-GCM before storage.
  • Phone numbers and DNI in the fraud blacklist are stored as SHA-256 hashes, not in plaintext.
  • All communications use HTTPS/TLS encryption.
  • Row Level Security (RLS) is enabled on all database tables.

4. Data Sharing

We do not sell, rent, or share customer personal data with third parties, except:

  • Shopify: Order data is sent to Shopify to create orders in the merchant's store (this is the core function of the app).
  • FluxWin (optional): If the merchant explicitly connects their FluxWin account, order classification data (CEL/CEP/AG) is shared with FluxWin for courier management.
  • Pixel platforms: If the merchant configures tracking pixels (Facebook, TikTok, Google, etc.), conversion events are sent to those platforms. This is initiated by the merchant's configuration, not by default.

5. Data Retention

  • Order data: Retained for the duration of the app installation. Merchants can view and export their data at any time.
  • Fraud submissions: Rate limiting records are automatically purged after 7 days.
  • Analytics events: Retained for the duration of the app installation.

6. Data Deletion

  • Customer data requests: When Shopify sends a customer data request, we return all data associated with the customer's phone number.
  • Customer data deletion: When Shopify sends a customer deletion request, we anonymize all personal data (name, phone, address, DNI) in order records and remove blacklist entries.
  • App uninstallation: When a merchant uninstalls the app, all shop data is permanently deleted within 48 hours (triggered by Shopify's shop/redact webhook), including forms, offers, orders, analytics, and configurations.

7. GDPR and Data Protection

We comply with Shopify's requirements for protected customer data access:

  • We implement all three mandatory GDPR webhooks (customer data request, customer deletion, shop deletion).
  • We only access customer data fields (name, phone, address) that are necessary for the app's core function of creating COD orders.
  • We do not use customer data for marketing, advertising, or profiling.

8. Merchant Rights

Merchants can:

  • Export all their configuration and order data at any time via the app's Export feature.
  • Delete individual orders from their dashboard.
  • Uninstall the app at any time, which triggers complete data deletion.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify merchants of significant changes via the app dashboard or email.

10. Contact

For privacy-related questions or data requests: