APP PRIVACY
POLICY.
RUTHH COD Form & Upsells · Effective 22 October 2026
This notice describes the personal-data processing associated with RUTHH COD Form & Upsells (the “App”) when a Shopify merchant installs and enables it. It supplements the RUTHH Studio website privacy notice, which applies to visits to ruthh.com and enquiries, not storefront orders. The App is being prepared for release; enabled features and integrations depend on the version and merchant configuration.
Who controls the information?
The Shopify merchant generally determines the purposes for collecting buyer information and managing orders in their store. RUTHH processes app-related information to supply the merchant-selected service, and may independently control limited account, support, security and contractual records. Buyers should contact the store they purchased from for questions about the merchant’s orders or marketing.
Information handled
Merchant and store information: Shopify store identifiers, installation permissions, configuration settings, selected products and variants, app-use records, support communications, and order references needed for functionality and troubleshooting.
Buyer and order information: when a customer submits a merchant-enabled COD form, the App may handle the customer's name, phone number, shipping address, selected items, quantities, prices, shipping charges, relevant order and Shopify customer references, and the information needed to create or reconcile an order. Depending on enabled safeguards, we may process request metadata such as network address and derived anti-abuse indicators. Analytics can include event types and campaign/UTM parameters. The App is not designed to require buyers to create a separate RUTHH account.
Why and how data is used
To validate COD requests, calculate authorised offers, create or reconcile Shopify orders, apply merchant-configured fraud and duplicate-order protection, provide operational analytics, maintain service security, respond to support requests and comply with applicable requests. We do not sell buyer personal information or use it for RUTHH's unrelated advertising. Shopify receives the order and customer details necessary for the merchant's fulfilment and ongoing records.
Security and retention
Pending buyer details held in the App's operational order-intent process are encrypted and subject to a maximum 24-hour processing window; successful and other terminal paths are designed to purge decryptable buyer details sooner. Some limited non-plaintext operational, reconciliation and fraud records remain for bounded periods: terminal order-intent records up to 90 days after safe completion, general operational analytics up to 90 days, webhook delivery metadata up to 30 days, and certain derived fraud decision records up to 190 days depending on state. Network-address-derived signals are subject to their own shorter retention controls. Shopify orders retained by the merchant are separate from App retention. Limited records may need to be retained longer where legally required or for an unresolved request.
Service providers and transfers
The App uses Shopify and necessary hosting, network security and database providers to operate. Authorised providers process only the categories relevant to their function under applicable agreements. Service providers and stores can operate in different countries; cross-border handling depends on their locations and applicable safeguards. We do not represent Google, Meta, WhatsApp or any other optional integration as active unless the merchant explicitly enables a supported feature and the relevant notice is updated.
Merchant choices and data rights
Merchants can change supported App settings or uninstall the App. Shopify's customer access and erasure requests are handled through the applicable authenticated compliance processes, including customers/data_request, customers/redact and shop/redact. Individuals can also request access, correction or deletion by following our data request instructions or emailing [email protected]. We may need enough information to identify the relevant store and verify a request; legally required records or merchant-controlled Shopify orders may be subject to different obligations.
Future connected services
If Meta, Google or another external API is offered through an App feature, access will be limited to the permissions authorised for that feature. Before enabling it, the applicable disclosure must identify the data and scopes involved, uses, sharing, retention, revocation and deletion options; the integration's current terms may also apply. This notice does not claim that any such integration is presently live.
Contact and updates
For app support, visit Support. For privacy questions, email [email protected]. Material changes to this notice will be published here and, where required, communicated before new processing begins.