Privacy policy
Last updated: 7 November 2026
Naqdi is a Shopify app that checks a store's cash-on-delivery orders for signs of fraud, and shows customers a “Confirm on WhatsApp” button after they order. This page explains, in plain words, what the app reads, what it keeps, why, where and for how long. It covers merchants who install the app and customers who order from their stores.
Naqdi is run by Qays Kadhim, a licensed freelancer in Dubai, United Arab Emirates. Questions: [email protected].
The short version
- Customers order through Shopify Checkout. Naqdi doesn't collect anything on the store and doesn't create orders.
- When Shopify creates a cash-on-delivery order, Naqdi reads it to check it. It keeps only secure fingerprints (keyed hashes) of the phone number, name and IP address, never the values themselves, and never the address or email.
- We don't sell data, don't use it for advertising, and don't put tracking cookies on the store.
Customers who order from a store using Naqdi
What Naqdi reads, and why
When you place an order paid with cash on delivery, Shopify sends it to Naqdi. Naqdi reads your phone number, name, IP address, the length of your delivery address, your shipping country and the products, to apply the merchant's rules: their blocklist, a limit on orders per phone per hour, and checks such as “is this a mobile number of the shipping country”. The result goes back to the merchant's order as a tag and a short list of reasons, never containing your details. Orders paid another way aren't read.
What Naqdi keeps about an order
| What | Why |
|---|---|
| Secure fingerprints (keyed hashes) of your phone number, name and IP address | To count recent orders from the same phone, notice the same phone used with a different name, and match the merchant's blocklist. A fingerprint can't be turned back into the value. |
| The Shopify order number, ID and confirmation number, the product IDs, the result of the check (OK, flagged, blocked, cancelled), its reasons and the time | So the merchant can see the checked orders, and to notice the same product ordered twice in one day. |
Your address and email are never stored by Naqdi. Your order, with all its details, stays in the merchant's Shopify store, under the merchant's privacy policy.
On the store and in checkout
The optional order button is a plain link to Shopify Checkout. The “Confirm on WhatsApp” block on the Thank you and Order status pages shows the merchant's message and a link to WhatsApp; it reads no personal details and sends nothing to Naqdi. Neither sets cookies, uses local storage, or loads anything from other websites.
Merchants who install the app
| What | Why |
|---|---|
| Your store's address (myshopify domain) and the access token Shopify gives the app | To check, tag and (if you turn on auto-cancel) cancel cash-on-delivery orders in your store. |
| Your settings: risk rules, auto-cancel, hourly limit, default country, thank-you message, WhatsApp number, order button text and colour, alert email and language | To run the app the way you set it up. |
| Your store's contact email, language and time zone, read from Shopify | To send alerts and the daily summary in your language and at the right time. |
| Your blocklist: a fingerprint of each phone number or IP address you block, and a masked label (for example +212 ••• 678) | To block orders from them, and so you can tell entries apart without the app keeping the full value. |
| Your plan and how many orders were checked this month | To apply the Free plan's monthly limit. |
| A record of alerts and summaries sent (order number, type, time) | To avoid sending the same alert twice. |
| An access log: each time the app handled customer data (checking an order, a data or deletion request) with the order number and time, never the data itself | Security: so access to customer data can be reviewed. |
Your thank-you message and WhatsApp number are saved to your store so the checkout block can show them; they're visible to your customers. Alerts and summaries contain order numbers, reasons, counts and times, never a customer's name, phone number or address.
Where data is kept, and who helps us
- Railway hosts the app and its database in the United States (US East).
- Resend sends alert and summary emails to the merchant.
- Cloudflare provides DNS for getnaqdi.com, hosts this website and stores the encrypted database backups.
- Shopify runs the store, the checkout, the orders and the billing for the app.
Our server logs never contain customers' details, access tokens or security signatures.
How long we keep it
- Order, alert and summary records are deleted automatically after 12 months.
- When a merchant uninstalls the app, we delete the access token right away, and Shopify asks us to delete everything else about the store 48 hours later. We do.
- When a customer asks a merchant to delete their data, Shopify tells us and we delete that customer's order records and blocklist entries.
- We keep encrypted nightly backups of the database for 30 days, after which each backup is deleted.
Your choices and rights
Customers: the merchant decides how your order is used, so contact the store first. The store can ask Shopify to send us a data request or a deletion request, and we answer it. You can also write to us at [email protected].
Merchants: you can see and change your settings and blocklist in the app at any time, and uninstalling removes your data as described above.
Depending on where you live (for example under the GDPR), you may have rights to access, correct or delete your data, or to complain to a data protection authority. For customer data, the merchant is responsible for the data and Naqdi processes it on their behalf.
Naqdi's checks only tag orders and, if the merchant turned it on, cancel orders that match the merchant's own blocklist or hourly limit. A person at the store decides what to do with flagged orders.
Security
Phone numbers, names and IP addresses are stored only as keyed fingerprints; addresses aren't stored at all. Data travels over HTTPS and is encrypted at rest. Access to the server and database is limited to the people who run Naqdi.
Changes
If we change what we read, store or why, we'll update this page and the date at the top.