Privacy Policy — BC Partial COD & OTP Verify
Last updated: 10 November 2026
This policy explains how Brand Current OÜ handles personal data in connection with the Shopify app BC Partial COD & OTP Verify (the “App”). The App helps stores reduce fake and returned Cash on Delivery (COD) orders: it shows shoppers a payment choice before checkout (pay online, pay part now and the rest on delivery, or full COD), can verify the shopper’s phone number or email with a one-time code (OTP), and can add a COD fee or a discount for paying online.
In short
- To verify COD orders, the App handles the shopper’s phone number (or email address), name and order amounts, only for the store where the shopper is buying, and only on that store’s instructions.
- One-time codes are created on our server and stored only in scrambled (hashed) form.
- We never sell data, never use it for advertising, and never match the same shopper across different stores.
- Personal details are deleted within 30 days of a shopper’s request through the store, and within 30 days of Shopify’s deletion request after a store uninstalls the App. We keep only anonymous records (amounts, results, dates) for billing, analytics and legal records.
- Payments for plans and SMS credits go through Shopify’s billing. We never see card or bank details.
- Codes sent to Indian numbers follow India’s telecom rules for OTP messages (section 11), and we follow India’s Digital Personal Data Protection Act.
1. Who we are
Brand Current OÜ (“Brand Current”, “we”, “us”)
Registry code 17536526
Mooni 18, 10613 Tallinn, Estonia
Privacy and grievance contact: [email protected] (subject line: “Privacy”)
We have not appointed a data protection officer. Questions about this policy go to the address above.
2. Our two roles
| You are… | Our role | What applies |
|---|---|---|
| A merchant, or staff of a merchant, who installs or uses the App | Controller (data fiduciary under Indian law) of the data about your store, your billing with us and your support conversations | This policy (sections 3–10) |
| A shopper or customer of a store that uses the App | Processor for the merchant, who is the controller (data fiduciary) and decides why your data is used | The store’s privacy policy. Sections 11–12 explain what the App does on stores |
3. Data about merchants
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Store domain (yourstore.myshopify.com) and the access token and permissions Shopify gives the App | Shopify, when you install the App | Let the App work for your store with the permissions you approved | Contract |
| Store details: store name, account and contact emails, the phone and city from the store’s Shopify address, country, currency, time zone, domain and Shopify plan; when the App was installed, uninstalled and last opened | Shopify | Support you, tell you about important problems with the App (for example COD orders that couldn’t be updated or SMS delivery problems), and keep a record of installs | Contract; legitimate interests in supporting you |
| Your App settings: payment options, partial payment and COD fee amounts, prepaid discount, verification rules and limits, markets, popup design and wording, email setup, setup progress | You | Provide the App | Contract |
| Billing records: your plan, approved spending limit, SMS credit packs bought, prices, and how many verification messages were used and charged | Shopify’s billing and your use of the App | Charge for the App correctly, show your usage, and keep accounting records | Contract; legal obligation |
| Live chat: your store’s name, domain and website, account email and phone, country, city, currency, your plan with us, and the messages and files you send; plus your browser and device details and IP address | You and Shopify, when you open the chat in the App | Know which store we’re helping and answer your questions | Contract; legitimate interests |
| Support emails: your email address, name and what you write | You | Answer you | Contract; legitimate interests |
| Technical logs: IP address, request times, the pages and webhooks requested | Your browser and Shopify, via our server and network provider | Keep the App secure and fix problems | Legitimate interests in security |
We don’t use your data for automated decisions that have legal or similarly significant effects on you. The store details, settings and billing records are needed to provide the App. Live chat and support emails are optional.
Cookies and browser storage in the App
The App’s pages in your Shopify admin set no cookies of their own. The live chat (Crisp) loads on the App’s pages and uses its own cookies and local storage to keep your conversation going between visits. We don’t use advertising or analytics cookies.
4. How long we keep data
| Data | Retention |
|---|---|
| Access token and App settings | Until you uninstall the App. The access token is deleted when Shopify sends its shop deletion request (about 48 hours after you uninstall); settings within 30 days of it |
| Store details (emails, phone, city and the like) | Deleted within 30 days of Shopify’s shop deletion request (sent about 48 hours after you uninstall). After that we keep only the store’s myshopify domain, its install and uninstall dates and its plan, so our records of installs stay correct |
| Billing records | As long as the law requires us to keep accounting records, even after you uninstall. They contain no shopper data |
| Live chat and support emails | As long as we need them to help you, including if you reinstall later. Deleted on request (section 8) unless we need them for a legal claim |
| Technical logs | A short period for troubleshooting and security, then deleted |
5. Who we share data with
Shopify, which provides the platform the App runs on and handles billing. Shopify’s own privacy policy applies to Shopify.
Service providers that process data for us:
- Hostinger (the server that runs the App and keeps its database)
- Cloudflare (network security and delivery for the App’s address)
- Messaging providers that deliver verification codes by SMS, voice call, WhatsApp or email, such as 2Factor (2factor.in) for Indian phone numbers. They receive only the phone number or email address and the code
- Crisp (live chat)
- Microsoft Outlook.com (support email)
Authorities, courts and advisers, where required by law or to establish, exercise or defend legal claims. A buyer or successor of our business, if the App or our business is transferred; we will tell you first.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
Some of our providers process data outside the European Economic Area: in the United States (Shopify, Cloudflare, Microsoft, and the data center of our server) and in India (our messaging provider for Indian phone numbers). Crisp processes chat data in the EU. Where a country has no adequacy decision, we rely on the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified, or on the European Commission’s Standard Contractual Clauses with the UK Addendum. Transfers of data about Indian shoppers follow the rules made under India’s Digital Personal Data Protection Act. You can ask us for a copy of the relevant safeguards.
7. Security
- Encryption in transit: every connection to the App, Shopify and our providers uses HTTPS.
- Encryption at rest: shoppers’ phone numbers and names, and the details of privacy requests, are encrypted in our database (AES-256), with the key kept separately from the data.
- One-time codes are random, created on our server, stored only as a hash, never sent to the shopper’s browser, and stop working after a few minutes.
- Limits on how many codes a phone number, email address or network can request, to stop abuse. The records behind these limits store the number, email and IP address only as keyed hashes, and are deleted after 2 days.
- Every request from Shopify (webhooks, App pages and the storefront) is verified with Shopify’s signatures.
- Data minimisation: we ask Shopify only for the customer fields the App needs.
- Access to our server and data is limited to authorised personnel.
No system is completely secure, but we work to protect your data. We will notify affected merchants and the authorities of a breach as required by law, including the Data Protection Board of India and CERT-In where Indian law applies.
8. Your rights
Depending on where you are, you have the right to:
- access your personal data and know who it has been shared with;
- correct and update it;
- delete it;
- restrict processing;
- receive a portable copy;
- object to processing based on legitimate interests;
- withdraw consent where we rely on consent; and
- nominate someone to use your rights for you if you die or become unable to (India).
To use these rights, email [email protected]. We reply within one month, which can be extended where the law allows. We may need to verify your identity.
Complaints: you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), to the supervisory authority where you live or work, in the UK to the Information Commissioner’s Office (ico.org.uk), or in India to the Data Protection Board of India after first contacting our grievance contact (section 1).
9. Marketing
We don’t send marketing emails and don’t use your data for advertising. We may contact you about the App itself, for example about an important change, a problem with your store’s setup, or your plan reaching its limit.
10. US state privacy disclosures
This section applies to residents of California and other US states with comprehensive privacy laws, for the merchant data we control.
- Categories collected in the last 12 months: identifiers (store domain, store name, email address, phone number and IP address), commercial information (your plan and purchases from us) and internet or other network activity (technical logs).
- Sources: you, Shopify, and your use of the App.
- Purposes: as in section 3.
- Disclosed for business purposes to: the service providers in section 5.
- Sale or sharing: we have not sold or “shared” (for cross-context behavioural advertising) personal information, and have no actual knowledge of selling or sharing personal information of anyone under 16.
- Sensitive personal information: we keep account credentials (Shopify access tokens) only to provide the App, not to infer characteristics.
- Retention: section 4.
- Your rights: to know and access, delete, correct and opt out of sale or sharing (we do neither), and not to be discriminated against for using them. You may use an authorised agent. If we decline your request, reply to our decision to appeal; if your appeal is denied, you may contact your state Attorney General.
- How to exercise them: email [email protected].
11. India: OTP messages and data protection
Verification messages (TRAI rules)
- Codes sent by SMS or voice call to Indian numbers go through a licensed provider registered on the telecom operators’ DLT (Distributed Ledger Technology) platform, as required by TRAI’s Telecom Commercial Communications Customer Preference Regulations, 2018.
- Every SMS uses a registered sender ID and a registered message template. The message contains only the code, the store’s or our name and how long the code works.
- Codes are sent only when the shopper asks for one in the store’s popup, for that one transaction. They are service messages, never promotional, and the number is never used to send marketing.
- Codes stop working after a few minutes, and there are limits on how many can be sent to one number.
Personal data (DPDP Act, 2023 and IT Act, 2000)
- For shoppers, the store is the data fiduciary and we process data only on its instructions, for verifying the order. The popup tells the shopper why the number is needed before a code is sent.
- We use the data only for that purpose and delete personal details when they’re no longer needed (section 12).
- We protect the data with reasonable security practices (section 7), as required by the IT Act, 2000 and its rules on sensitive personal data.
- Grievances: contact the store first. You can also write to our grievance contact at [email protected] (subject line: “Grievance”). We acknowledge within 24 hours and resolve within the time the law allows. If you’re not satisfied, you can complain to the Data Protection Board of India.
12. Information for shoppers on stores using the App
If you shop on a store that uses this App, the store is responsible for your data. Please read the store’s privacy policy and contact the store first. We act on the store’s instructions.
| Data | When | Why | How long |
|---|---|---|---|
| Your phone number or email address, and the code you type | When you ask for a verification code in the store’s popup | Send you the code and check it. The number is also written on the order as “Phone verified via OTP”, so the store can reach you about delivery | In the store’s verification log while the store uses the App. Deleted within 30 days of your request through the store, or of the store uninstalling |
| The verification result: time, verified or not, wrong tries, codes sent, the order number | With each verification | Show the store which orders were verified, and bill the store for the messages sent | Kept as an anonymous record (without your number) for billing and analytics |
| Your name, the order number and amounts: total, paid online, due on delivery, COD fee, discount, delivery status | When you place a COD or prepaid order through the popup | Show the store its COD orders and what is still to collect | Your name is deleted within 30 days of your request through the store, or of the store uninstalling. The amounts are kept as an anonymous record |
| A keyed hash of your phone number or email address and of your IP address | When you ask for a code | Limit how many codes can be requested, to stop abuse | 2 days |
What the App does in your browser on a store:
- It reads the cart the store’s page already has (items, totals and automatic discounts) to show the payment choice. It saves your choice and a verification reference on the cart, so checkout charges the right amount.
- After you verify, it saves a cookie (bcc_verified) holding a verification reference and your number with most digits hidden, so you aren’t asked again while your browser is open. It’s deleted when you close the browser, or when you tap “Remove” in the popup.
- It uses your storefront country to decide whether the popup and verification apply to you.
The App does not track you across websites, does not use advertising or analytics cookies, and never receives your card or bank details: payments are handled by the store’s checkout. If you contact us about a store’s data, we will forward your request to the store.
13. Children
The App is for businesses and is not directed to children. We do not knowingly collect children’s personal data.
14. Changes
We will post updates here and change the “Last updated” date. If changes are significant, we will tell merchants in the App or by email.
15. Contact
Brand Current OÜ
Registry code 17536526
Mooni 18, 10613 Tallinn, Estonia
Email: [email protected]