Data Privacy, Retention & GDPR Compliance — RUTHH COD Form & Upsells

Understand what merchant and buyer data RUTHH COD Form & Upsells collects, why each field is processed, how long operational records are retained, and how automated Shopify GDPR webhooks and manual data requests work.

• Review our full legal notice at the RUTHH COD Form & Upsells Privacy Policy and Data Access & Deletion.

RUTHH COD Form & Upsells (operated by Ruthh Digital LLC) processes data strictly as a service provider/processor on behalf of the Shopify merchant:

1. Merchant & Store Configuration Data: Shop domain, currency, active form configuration snapshots, shipping rules, sales booster rules, fraud blocklists, and encrypted integration credentials (such as AES-256-GCM encrypted Google OAuth tokens and CAPI access tokens).
2. Buyer Order & Delivery Data: Customer name, phone number, optional email, delivery address (country, province, district, street address, postal code), selected variants/quantities, and optional delivery notes—collected solely to validate and create the merchant’s Cash on Delivery order in Shopify (orderCreate or draftOrderCreate) and export to merchant-enabled integrations (such as Google Sheets).
3. Abuse Prevention & Attribution Metadata: Client IP address, user-agent, normalized phone/email hashes, and UTM/funnel correlation tokens—processed to enforce merchant-configured velocity/duplicate/blocklist rules and consented pixel attribution.

Data Category	Retention Window	Automatic Cleanup Behavior
Idempotency & Request Deduplication Keys	24 hours	Expired idempotency tokens are purged after the 24-hour deduplication window.
Verification Session & Ephemeral OTP Logs	30 days	Verification state records expire and are cleaned up on a 30-day rolling window.
Operational & Funnel Telemetry Events	90 days	Privacy-safe funnel analytics records are retained for up to 90 days.
Order Reconciliation & Fraud Velocity Metadata	190 days	Order-intent and velocity protection records (supporting up to the 6-month velocity preset) are retained for up to 190 days or until shop redaction.

The application registers and enforces Shopify’s mandatory privacy webhooks:

1. customers/data_request: Locates and exports any stored COD order-intent or verification records matching the requested customer email/phone for the merchant.
2. customers/redact: Redacts personal identifiers (name, phone, email, address, IP) associated with the specified customer across application tables.
3. shop/redact: Triggered 48 hours after a merchant uninstalls the app; permanently deletes remaining store configurations, encrypted integration tokens, and associated buyer records.

1. Merchants or buyers can submit a written request at any time by emailing [email protected] or following the instructions on Data Access & Deletion.
2. In Settings → General (/app/settings/general), merchants also have a direct Privacy & Data Requests link pointing to the privacy workflow.

• Need to disconnect Google Sheets and wipe stored OAuth tokens immediately: Open Integrations → Google Sheets (/app/integrations/google-sheets) and click Disconnect. This immediately deletes the encrypted OAuth token record from the database.

• RUTHH COD Form & Upsells Privacy Policy
• Data Access & Deletion
• Support & Coverage Backlog