Privacy policy

1. Who we are

CODPrem COD Form & Booster (“CODPrem”, “the app”) is a Shopify app, and codprem.com is its website. Both are operated by SellPrem LLC (“we”, “us”).

For any question about this policy or your data, write to contact@codprem.com.

2. Our role

Merchant data. For information about the stores that install CODPrem and the people who run them, we decide how the data is used, so we are the controller.

Buyer data. For information about the shoppers who use the CODPrem form on a merchant's store, the merchant is the controller and we process it only on the merchant's behalf and instructions, to provide the app. Buyers who want to exercise their rights should contact the store they ordered from; we help the merchant answer.

3. Data we collect about merchants

• Store details from Shopify when you install: the store's domain and name, the store owner's email address, currency, country and your CODPrem plan.
• Access credentials Shopify issues to the app so it can create orders and read the store data it needs. They are stored encrypted and refreshed automatically.
• Your app settings: the form, offers, texts, styles and rules you configure.
• Connections you choose to add: Telegram bot details, webhook addresses, a Google account connected to Google Sheets (limited to the files the app creates), and ad accounts connected with read-only access to campaign spend.
• Billing records. Plans and WhatsApp credit are charged through Shopify. We never see or store card details.
• Support messages you send us by email or chat.

4. Data processed about buyers

When a shopper uses the CODPrem form on a merchant's store, the app processes:

• Name, phone number, email address and delivery address typed into the form, and the products, quantities and offers chosen.
• The IP address and browser user agent, used for fraud checks, order limits and, where the merchant enables it, to match orders to ad campaigns.
• The shopper's language and country, so the form appears in the right language and currency.
• Campaign details from the page address (UTM parameters) and ad click identifiers set by Meta, TikTok, Snapchat or Google, where present.
• Abandoned form details: if the merchant enables it, what a shopper typed into the form before leaving without ordering. The form shows a notice when this is on.
• WhatsApp verification: the phone number, a one-way hash of the code sent and the result, when the merchant requires verification.
• Form visits: a random visitor identifier and which form was shown, with no name, phone or email attached.

The order itself is created in the merchant's Shopify store and is also governed by Shopify's privacy policy and the merchant's own.

5. How we use data

• To provide the app: show the form, create orders in Shopify, apply offers and prices, and send the messages and notifications the merchant has switched on.
• To prevent fraud and abuse: blocklists, order limits, verification codes and bot checks set by the merchant.
• To show merchants their results: orders, confirmation and delivery rates, campaign profit and A/B test results.
• To bill for plans and WhatsApp credit through Shopify, and to answer support requests.
• To keep the service secure, fix errors and meet legal obligations.

We do not sell personal information, we do not use buyer data to advertise our own products, and the app makes no automated decisions that have legal effects on a person.

6. Who we share data with

We share data only with the service providers needed to run CODPrem, and with the services a merchant connects on purpose.

We may also disclose information when the law requires it, or to protect the rights and safety of our users, buyers or ourselves.

7. How long we keep data

• Abandoned form details: for the period the merchant sets, between 7 and 365 days after the shopper's last activity.
• Order-limit records: 30 days.
• All data for a store is deleted when Shopify tells us the store has been removed, which Shopify does 48 hours after the app is uninstalled.
• When a merchant or buyer asks through Shopify for a buyer's data to be erased, that buyer's records are deleted.
• Backups roll over and are deleted within 14 days.
• Billing records are kept for as long as accounting and tax law require.

8. Security

Data travels over encrypted connections only and is encrypted at rest, including backups. Access to servers and databases is limited to two people, by key, with two-factor authentication on every provider account. Error reports have personal fields removed before they leave the server.

Our security incident response policy explains what we do if something goes wrong, including telling affected merchants within 72 hours.

9. International transfers

The app's servers and backups are in the European Union. Some providers listed above process data in other countries, including the United States; where they do, transfers rely on safeguards such as the European Commission's standard contractual clauses.

10. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how it is used, and to complain to your data protection authority. Merchants can export their settings from inside the app and delete all their data by uninstalling it. For anything else, write to contact@codprem.com.

Buyers should contact the store they ordered from. Shopify passes data access and erasure requests to us and we act on them.

11. This website

codprem.com uses cookies needed for the site to work and may use Google Analytics to understand how visitors use it. We receive what you send us through contact links, such as your email address and message, and use it only to reply.

12. Children

CODPrem is a business tool and is not directed at children under 16.

13. Changes to this policy

When we change this policy we update the date at the top of this page. If a change materially affects how we use merchant data, we tell merchants inside the app or by email before it takes effect.

14. Contact

SellPrem LLC · contact@codprem.com