Effective date: April 22, 2026
Last updated: April 22, 2026

Who we are

Bangladesh COD Fake Order Block ("the App") is a Shopify application developed and operated by Agent Wise X ("we", "us", "our"), based in Dhaka, Bangladesh. You can contact us at business@agentwisex.com.

What the App does

The App helps Shopify merchants running Cash on Delivery (COD) in Bangladesh flag suspect orders by comparing the phone number on a new order against a merchant-maintained blocklist. On a match, the App tags the order, adds a note, and emails the merchant so they can manually review the order. The App never blocks checkout or modifies the customer's purchase experience.

Data we process

When a merchant installs the App, we process:

Merchant (shop) data, from Shopify:

Shop domain, primary locale, country.
OAuth access token (encrypted at rest).
Shop owner email address (used to send fraud-review notifications).

Order data, from Shopify webhooks:

Phone number attached to the order (stored in E.164 format).
Order ID, order value, order creation timestamp, the IP country of the customer (not their IP address), the email domain of the customer (not the full email), and the customer's browser user-agent string.
We do not read, store, or receive the customer's name, email address, home address, or any other personal information.

Fraud-intelligence dataset (opt-out):

A SHA-256 hash of blocked phone numbers, the IP country, the email domain, the order value in USD, the store country, the occurrence timestamp, and the user-agent string. The SHA-256 hash is a one-way transformation and cannot be reversed to recover the phone number.
Merchants can disable this collection entirely from the App's Settings page.

Lawful bases

Contract. We process shop data to provide the App to the merchant.
Legitimate interest. We process hashed, aggregated order metadata to maintain and improve a fraud-detection dataset that benefits the broader Shopify merchant community. This processing is anonymized, does not identify any individual customer, and merchants may opt out.
Legal obligation. We respond to Shopify GDPR webhooks (customers/data_request, customers/redact, shop/redact) as required by Shopify's platform policy.

How we use the data

To operate the blocklist feature (tag, note, email alert).
To render the merchant-facing dashboard, blocklist management, and attempts log.
To produce anonymized, aggregated fraud statistics for the merchant community (opt-out).
For customer support when merchants contact us.

We do not:

Sell data to any third party.
Use data for advertising or profiling.
Share data with any party other than the sub-processors listed below, who act on our behalf.

Sub-processors

We rely on the following sub-processors to operate the App:

Sub-processor	Purpose	Region
Shopify Inc.	Host platform, source of order data	Global
Vercel Inc.	Application hosting	Global
Supabase Inc.	PostgreSQL database	ap-southeast-1 (Singapore)
Upstash Inc. (QStash)	Background job queue	Global
Resend (Resend.com Inc.)	Transactional email delivery	US / EU
Sentry (Functional Software, Inc.)	Application error monitoring (no PII)	US

Each sub-processor provides its own security and privacy commitments, which we periodically review.

Data retention

Shop data is retained while the App remains installed. When the App is uninstalled, all shop data is deleted within 48 hours via Shopify's shop/redact webhook.
Customer redaction requests (customers/redact) are honored within 30 days, as required by Shopify's GDPR webhooks. All matching records are deleted, including the fraud-intelligence hash if present.
Access logs are retained for 12 months, then deleted.

Data subject rights

If you are a customer of a Shopify merchant using this App and want to exercise your rights under GDPR, CCPA, the Bangladesh Personal Data Protection Act, or any other applicable law, please contact the merchant whose store you purchased from. Per Shopify's platform, the merchant is the data controller; we act as a processor. The merchant will submit a customers/data_request or customers/redact request to Shopify, which Shopify will route to us, and we will respond within 30 days.

You may also contact us directly at business@agentwisex.com and we will coordinate with the merchant on your behalf.

Security

All traffic uses TLS 1.2 or higher.
Shopify OAuth access tokens are encrypted at rest with AES-GCM at the application layer before being persisted.
Database backups are encrypted at rest by our sub-processor.
Development, staging, and production data are fully separated across distinct database connections.
Access to production data is restricted to the founder of Agent Wise X, Sheikh Rifat, under strong password and multi-factor authentication.
We do not log customer personal data anywhere in our infrastructure.

Breach notification

In the event of a confirmed data breach affecting merchants or their customers, we will notify affected merchants within 72 hours of confirmation. We will also notify Shopify per their platform incident-reporting requirements.

Children's privacy

The App is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly process data of children.

International transfers

Data may be processed in countries other than the merchant's country, including the United States and Singapore, by the sub-processors listed above. Each sub-processor provides appropriate safeguards (Standard Contractual Clauses or equivalent).

Changes to this policy

We will update the "Last updated" date above whenever this policy changes. Material changes will be communicated to installed merchants by email.

Contact

Agent Wise X
Dhaka, Bangladesh
Email: business@agentwisex.com
Support response: 24 hours on weekdays, 48 hours on weekends.