Privacy Policy

1. Who we are

ItsCOD - COD Orders to Sheets is a Shopify app that exports your store's orders and draft orders to Google Sheets. You connect your own Google account, the app creates a spreadsheet in your Google Drive, and new orders are written to it as rows in real time. When you install the app on your Shopify store, you are the data controller for your store's data and your customers' personal data. We, the developer, act as a data processor operating the app on your behalf.

2. What we don't do

• We don't sell your data, or your customers' data.
• We don't share data with advertisers, data brokers, or any third party for marketing.
• We don't profile customers across merchants. Each shop's data is kept isolated to that shop.
• We don't use your data to train AI or machine-learning models.
• We don't access stores we're not installed on, and we only request the Shopify permissions the app needs to read orders and store its configuration.

3. Google user data

The Google Sheets export works through Google's OAuth. When you connect your Google account, we request a single permission: drive.file. This scope only lets the app see and edit spreadsheets the app itself created — it cannot read, list, or touch anything else in your Google Drive or Google account.

To keep the connection working without asking you to sign in again, we store an OAuth refresh token and the email address of the connected Google account in our database. These are used solely to create your order spreadsheets and write order rows to them — nothing else.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not transfer Google user data to third parties, use it for advertising, use it to train AI or machine-learning models, or allow humans to read it.

You can remove our access at any time: clicking Disconnect in the app revokes the token with Google and deletes it from our database, and uninstalling the app deletes the stored token as well. You can also revoke the app's access yourself from your Google Account's security settings.

4. Customer order data

Orders live in your Shopify store — the app doesn't create or modify them. When Shopify notifies us of a new or updated order (or draft order), the app writes the order details (such as name, phone, email, shipping address, and line items) as a row in the spreadsheet in your own Google Drive. From that point the data is in your Google account, under your control.

We do not keep a persistent copy of customer order data. The only ephemeral processing data we hold is a short-lived cache that maps an order to its row in your sheet (7-day expiry), so that an order edit updates the same row instead of adding a duplicate. It is deleted automatically.

5. Storage and retention

Your sheet configuration — file name, tab names, and which spreadsheet belongs to which products — is stored inside your own Shopify store. If you uninstall the app, this configuration stays with you in Shopify; we don't hold a copy elsewhere.

The app's own database stores only:

• Shopify OAuth sessions (required for the app to work)
• Per-shop billing and usage counters (your plan and monthly synced-order count)
• Your Google connection — the OAuth refresh token and connected account email (see section 3)
• Subscription discount-code usage, if you redeem one

When you uninstall the app, your sessions and Google connection are deleted automatically via the app/uninstalled webhook. Billing and usage counters are kept for up to 30 days after uninstall (so the free-plan quota can't be reset by reinstalling) and are then deleted.

6. Email notifications

When your shop approaches or reaches its monthly synced-order limit, we send a notification email to your store's contact email address. These emails contain only your shop name, plan, and usage numbers — never customer data. We don't use your email for marketing and we don't share it.

7. Subprocessors

The app relies on the following services to operate:

• Shopify — the underlying platform. Shopify hosts your store and remains the canonical store of record for your orders.
• Google LLC — the Sheets and Drive APIs used to create and update the spreadsheets in your own Google account.

No other third party processes your data.

8. Security

• Authentication uses Shopify's and Google's OAuth flows. We never see your Shopify or Google account password.
• Webhook requests from Shopify are verified using HMAC signatures before any action is taken.
• All traffic to the app is served over HTTPS.
• Google tokens are stored server-side only and are never exposed to the browser or the storefront.
• Per-shop data isolation is enforced at the application layer — every protected route checks the authenticated shop before reading or writing data.

9. Children

The app is not directed at children under 13 (or 16 in the EU), and should not be used to knowingly collect personal data from minors. If you operate a store whose customers may be minors, you are responsible for obtaining appropriate consents.

10. Changes to this policy

We may update this policy from time to time. When we do, the "Last updated" date at the top will change. Continued use of the app after a change means you accept the updated policy.

11. Contact

Questions about this policy or how ItsCOD - COD Orders to Sheets handles your data? Reach out:

support@itscod.com