BundleFly Privacy Policy

Last updated: August 25, 2025

BundleFly (“BundleFly”, “we”, “us”, “our”) provides a Shopify app that lets merchants create product bundles and discounts. We are committed to protecting the privacy and security of data processed through our app. This policy describes what we collect, how we use it, how we share it, and the rights available to you.

1) Scope

This policy applies to: (a) merchant/store data processed when you install and use BundleFly, and (b) customer data processed on behalf of the merchant to power bundle functionality on the storefront.

2) What We Collect

• Merchant/Store data: store name and URL, shop domain, email, merchant ID, plan details, installed theme/app settings, selected products, variants and collections, bundle configurations, usage and diagnostic logs, and billing/charge status via Shopify APIs.
• Order & cart context: line items, discounts, cart token/ID, draft orders, order IDs and totals as needed to create/apply bundle offers.
• Customer data (on behalf of merchants): non-sensitive customer identifiers associated to carts/orders necessary to apply bundles and measure performance (e.g., customer ID, order history metadata). We do not collect payment card data.
• Device & app telemetry: IP address, browser/OS info, timestamps, API errors for security, debugging, and service improvement.
• Cookies/Local storage: session and preference cookies to keep merchants signed in and to ensure storefront bundle performance.

3) How We Use Data

• Create and manage bundle offers, discounts, and price rules.
• Render bundles on your storefront and calculate eligibility.
• Provide analytics, reporting, and troubleshooting.
• Authenticate and secure the app; prevent fraud/abuse.
• Comply with legal, tax, and audit obligations.
• Improve features and performance using aggregated/de-identified data.

4) Legal Bases (EEA/UK)

Where applicable, we process data under the following bases: (i) necessity for the performance of a contract (to provide the app), (ii) legitimate interests (to secure and improve our services), and (iii) compliance with legal obligations. Where required, we obtain consent (e.g., optional cookies).

5) Sharing & Disclosures

• Shopify: We integrate and exchange data via Shopify APIs and webhooks consistent with the Shopify Partner Program Agreement and API License and Terms of Use.
• Service providers/Sub-processors: Hosting, logging, analytics, support tools that are contractually bound to confidentiality and security obligations and may process data only on our instructions.
• Legal: We may disclose information to comply with law, protect rights, or respond to lawful requests.

We do not sell or rent personal data. A current list of sub-processors is available upon request at [email protected].

6) Data Retention

We retain merchant/store data for as long as your app subscription is active and as needed to provide the service. Customer data processed on your behalf is retained only as necessary for bundle operations and analytics you enable. We may retain minimal records to meet legal, tax, fraud-prevention, or audit requirements.

7) Uninstall, Deletion & Shopify Webhooks

• Uninstall: When you uninstall BundleFly, we stop collecting data from your store and schedule associated merchant/store data for deletion within a reasonable period unless retention is required by law.
• Customer erasure: We honor Shopify’s privacy webhooks – customers/data_request, customers/redact, and shop/redact – and delete or anonymize data accordingly.
• Manual requests: You can request deletion at [email protected].

8) International Transfers

We may process data in countries outside your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs).

9) Security

• Encryption in transit (HTTPS/TLS) and at rest where supported.
• Access controls, least-privilege permissions, and credential rotation.
• Monitoring, logging, and routine vulnerability patching.
• Employee confidentiality and security awareness practices.

10) Your Rights

Depending on your region (e.g., EEA/UK/California), you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. Merchants can exercise these rights by contacting us. For customer data, we act as a processor on behalf of the merchant; customers should direct requests to the relevant store. We assist merchants in fulfilling verified requests received via Shopify or directly.

11) Children

Our app is not directed to children under 13 (or the equivalent age of consent in your jurisdiction). We do not knowingly collect such data.

12) Contact Us

Controller/Service Provider: Your Company Legal Name
Address: Your Registered Address
Email: [email protected]

13) Changes to This Policy

We may update this policy to reflect changes to our practices or legal requirements. If material changes are made, we will notify you in-app or by email where appropriate. Continued use of the app after the effective date constitutes acceptance of the updated policy.

By installing and using BundleFly, you agree to this Privacy Policy and our processing of data in accordance with it and applicable Shopify terms.