Privacy policy
Bundlewright is a Shopify app that lets merchants sell bundles customers put together themselves. This policy explains what data the app processes when a merchant installs it and when shoppers use a bundle on the merchant's store.
Who we are
Bundlewright is made by Jager Consultancy, Biezenoever 2, 2371 JM Roelofarendsveen, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 50776770. For anything about privacy, email privacy@bundlewright.app.
Data we process about merchants
| Data | Why |
|---|---|
| Your store's Shopify domain and an access token from Shopify, with the permissions you approved at install | To connect the app to your store and read and update the products, files and discounts your bundles use |
| Your bundles: which products and variants they contain, prices, discounts, rules and appearance settings | To show your bundles on your storefront |
| Your subscription status from Shopify: plan, trial end date and billing period | To give you access to the app and bill you correctly |
| Paid orders that contain a bundle: order and line IDs, quantities, amounts, discounts, tax and currency | To calculate your bundle sales per billing period, which sets your monthly price. We convert amounts to US dollars using the European Central Bank's published exchange rates. |
We do not store your name, your staff accounts or your email address. Shopify handles your payment for the app; we never see your payment details.
Data about shoppers
When a shopper builds a bundle on your store, their browser loads the bundle settings from our server and adds the chosen products to Shopify's cart. The cart lines carry technical details about the bundle, such as an ID and the chosen parts, so the discount can be applied.
The order data we read for billing does not include customer names, emails, addresses or phone numbers; the app asks Shopify for order lines only. We do not use cookies, tracking or analytics on your storefront.
Like any web server, ours briefly receives the IP address and browser details of each request. We use these only to deliver the page and to investigate errors and abuse, and we do not combine them with other data.
If a shopper asks you for their data or for deletion, Shopify forwards that request to us. Because we hold no customer records, there is nothing to hand over or delete, and we confirm this to Shopify.
Legal basis
We process merchant data to perform our agreement with you (providing and billing the app). Server logs are processed on the basis of our legitimate interest in running a secure service. For data about your shoppers, you are the controller and we process it on your behalf, only to provide the app.
Who else handles the data
- Shopify: the platform the app runs on, which also handles billing.
- Fly.io: hosts the app and its database in Amsterdam, the Netherlands.
- [EMAIL AND WEB HOST]: hosts this website and our support mailbox.
We do not sell data and do not share it with advertisers.
How long we keep data
- When you uninstall the app, we delete the connection to your store straight away.
- Shopify then sends us a request to erase your store's data, normally 48 hours after uninstall. We then delete your bundles, settings, subscription status and sales records.
- Server logs are kept for a limited period and then deleted automatically.
Security
All traffic uses HTTPS. Access tokens are stored on our server and are never sent to the storefront. Only the people who run Bundlewright can access the database.
Your rights
Under the GDPR you can ask to see, correct or delete your data, object to processing, or receive your data in a portable format. Email privacy@bundlewright.app and we will reply within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
If we change how the app handles data, we update this page and the date at the top. Significant changes are announced in the app.