Privacy policy
Bundlewright is a Shopify app that lets merchants sell bundles customers put together themselves. This policy explains what data the app processes when a merchant installs it and when shoppers use a bundle on the merchant's store.
Who we are
Bundlewright is made by Jager Consultancy, Biezenoever 2, 2371 JM Roelofarendsveen, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 50776770. For anything about privacy, email privacy@bundlewright.app.
Data we process about merchants
| Data | Why |
|---|---|
| Your store's Shopify domain and an access token from Shopify, with the permissions you approved at install | To connect the app to your store and read and update the products, files and discounts your bundles use |
| Your bundles: which products and variants they contain, prices, discounts, rules and appearance settings | To show your bundles on your storefront |
| Your subscription status from Shopify: plan, trial end date and billing period | To give you access to the app and bill you correctly |
| Orders that contain a bundle: order and line-item IDs, bundle markers, quantities, order dates, totals, discounts, taxes and currency | To calculate your bundle sales per billing period, which sets your monthly price. We convert amounts to US dollars using the European Central Bank's published exchange rates. |
We do not store your name, your staff accounts or your email address. Shopify handles your payment for the app; we never see your payment details.
Data about shoppers and order data
When a shopper builds a bundle on your store, their browser loads the bundle settings from our server and adds the chosen products to Shopify's cart. The cart lines carry technical details about the bundle, such as an ID and the chosen parts, so the discount can be applied.
For billing and reconciliation, Bundlewright processes a limited set of order data: order and line-item IDs, bundle markers, quantities, order dates, totals, discounts, taxes and currency. Shopify treats order data as protected customer data, because an order relates to a customer.
Bundlewright does not request customer names, email addresses, phone numbers, postal addresses or payment details for this purpose. We do not use order data for advertising, marketing or customer profiling, and we never sell it. We do not use cookies, tracking or analytics on your storefront.
Storefront requests to our server may include an IP address and basic browser and request details. We use these only to deliver the service, protect it against abuse and investigate errors.
Requests from shoppers
If a shopper asks you for their data, Shopify sends us the IDs of the relevant orders. Bundlewright finds the order-level billing data it holds for those orders and makes it available to you as a secure export in the app's admin, so you can answer the shopper. The request stays open until you mark it as completed; after that we remove its order references straight away.
If a shopper asks for deletion, Shopify tells us which orders it concerns. We then delete the matching order-level records, unless the law requires us to keep them.
This website
This website does not use cookies. We count visits with Cloudflare Web Analytics, which does not use cookies and does not collect visitors' personal data. It tells us which pages are visited and roughly where visitors come from, so we can improve the site. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.
Legal basis
We process merchant data to perform our agreement with you (providing and billing the app). Server logs are processed on the basis of our legitimate interest in running a secure service. For the bundle features on your storefront, you are the controller and we process shopper data on your behalf. When we use order data to calculate our own app fees, we do so to perform our agreement with you.
Who else handles the data
- Shopify: the commerce platform the app runs on, which also handles app billing.
- Fly.io: hosts the app and the production database in Amsterdam, the Netherlands.
- Theory7: hosts this website and our email in the Netherlands.
- Cloudflare: counts visits to this website, without cookies.
- Google Fonts: serves the fonts on this website.
We do not sell data and do not share it with advertisers.
How long we keep data
- Order- and line-level billing details, including Shopify order and line-item IDs, are kept for up to 12 months after the billing period ends. After that they are deleted and replaced by totals per billing period, per store and currency, without order or customer identifiers.
- These billing totals and settled app-usage records are kept for up to seven years for billing and financial recordkeeping, then deleted.
- An open data request from a shopper is kept until you complete it. Its order references are then removed immediately, and the remaining status details are deleted after 12 months.
- When Shopify asks us to delete data for specific orders, we delete the matching order-level details straight away, unless a specific legal obligation requires us to keep them.
- When you uninstall the app, we delete the connection to your store straight away. Shopify then sends us a request to erase your store's data, normally 48 hours after uninstall, and we delete all of it: bundles, settings, subscription status, billing details and totals.
- Encrypted backups made by our hosting provider can still contain deleted data for a short time, currently no more than five days, before they expire.
- Server logs are kept for a limited period and then deleted automatically.
- We keep data longer only where a specific legal obligation requires it.
Security
Traffic between browsers, Shopify and the app uses HTTPS. The production database is stored on Fly.io's encrypted storage, and the app connects to it on the same machine, so database traffic never travels over the network. The app's database account is password-protected using SCRAM-SHA-256. Access tokens are stored on our server and are never sent to the storefront. Only the people who run Bundlewright can access the database.
Your rights
Under the GDPR you can ask to see, correct or delete your data, object to processing, or receive your data in a portable format. Email privacy@bundlewright.app and we will reply within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
If we change how the app handles data, we update this page and the date at the top. Significant changes are announced in the app.