Bundlo — Privacy Policy

Bundlo is a bundling app for Shopify stores. This policy explains exactly what the app stores, what it deliberately does not store, how long it keeps anything, and how it is erased. It is written from the app's actual database schema and code, not from a template.

The short version

Bundlo does not store your customers' personal data. No names, no email addresses, no phone numbers, no shipping or billing addresses, no payment details. It stores the merchant's own bundle configuration, plus counts and diagnostics — all keyed to a shop domain. The only things it puts on a shopper's own device are an A/B test cookie and a dismissed-this-bar flag, neither of which identifies anyone — section 5 sets out both in full.

1. Who we are

Bundlo is operated by Fons and splendor. For any privacy question, or to ask for data to be erased, email support@brandexio.com.

2. What Bundlo stores

Every record is tagged with the merchant's shop domain and is only ever read back for that shop.

What	Why
Shop domain and an encrypted Shopify access token	To talk to the merchant's store on their behalf
Bundle configuration — products, pricing, thresholds, landing-page content and translations	This is the merchant's own work; it is the app
Theme styling detected from the store's public theme (colours, fonts, button radius)	So widgets match the store instead of looking pasted on
Widget placement settings	To render bundles where the merchant chose
Daily aggregate counts per bundle — views and add-to-carts	The analytics screen. Counts only: no visitor is identified, and no individual event is retained
An audit trail of merchant admin actions	So a merchant can see who changed what
Error and degradation diagnostics	To fix faults. Credentials are redacted before writing
Free-trial grants and processed-webhook markers	Billing correctness and to ignore duplicate deliveries

3. What Bundlo never stores

Customer names, email addresses, phone numbers
Shipping or billing addresses
Payment card or bank details — the app never sees these; Shopify handles all payment
Individual order contents linked to a person
Any customer identifier, including inside privacy-request records (see section 8)

Bundlo's session records include name and email columns because Shopify's session library defines that schema for logged-in "online" sessions. Bundlo uses offline sessions only, so those columns are not populated.

4. Order data, and why the app asks for it

Bundlo requests read access to orders for two purposes, both of them about products rather than people:

Revenue attribution. To show the merchant how much revenue their bundles produced, it reads an order's total and the name of the discount that applied.
Frequently-bought-together. To suggest which products sell together, it reads the product name and handle of the items on the merchant's most recent orders (up to 500) and counts how often pairs appear. It keeps the resulting counts, not the orders.

In neither case does Bundlo read, store or transmit the customer attached to an order. It does not read names, email addresses, shipping addresses or payment details from orders, and it does not link a purchase to a person.

5. What Bundlo puts on a shopper's device

Two things, both first-party — set by the store's own domain, readable by nobody else, and carrying no name, no identifier and no profile. Bundlo sets no advertising cookies and no analytics cookies, and nothing here can follow a shopper to another site or another store.

What	Why	How long
A cookie named `_bab_` followed by eight characters of the bundle's id. Its entire value is one letter: `a` or `b`.	If the merchant has turned on A/B testing for a bundle landing page, this remembers which of the two versions the visitor was shown, so the page does not change under them on a later visit. It is read back by Bundlo when that same landing page is loaded again.	30 days
A browser `sessionStorage` entry, `bundlo-gwp-dismissed`.	If a shopper closes the free-gift bar, it stays closed instead of reappearing on the next page. It never leaves the browser.	Until the tab is closed

One more thing can reach a shopper's browser, and it is not ours: if the merchant puts a YouTube or Vimeo link on a bundle landing page, that video is embedded from YouTube or Vimeo. Nothing is requested from either until the shopper actually taps play — the player is only created on that tap — but once tapped, that provider receives the request and may set its own storage under its own policy, not this one. Bundlo uses youtube-nocookie.com rather than the standard YouTube domain. A merchant who does not add a video sends nothing to anyone.

Neither of the two entries above is required for the store to work, and neither is used to measure anything: the analytics counts in section 2 are daily totals that do not read either one. A/B testing is off unless a merchant turns it on, and while it is off the cookie is never set at all — which is the control a merchant should use if their own cookie policy requires consent before non-essential storage.

6. How it is protected

Encrypted at rest. Shopify access tokens are encrypted with AES-256-GCM before they are written to disk.
Encrypted in transit. All traffic is HTTPS, with HSTS set for a year.
Verified webhooks. Every webhook is checked against Shopify's HMAC signature before it is acted on.
Least privilege. The app requests no access to customer name, email, phone or address fields.
Redaction. Diagnostic records strip anything that looks like a credential before it is stored, and URLs are recorded without query strings so session tokens cannot leak into logs.

7. How long it is kept

Record	Retention
Bundle configuration and settings	Until the merchant deletes it, or about 48 hours after uninstall — when Shopify sends the shop-erasure webhook
Daily aggregate counts	400 days
Audit trail	90 days
Error and degradation diagnostics	30 days
Processed-webhook markers	7 days
Access tokens and session records	Deleted when the app is uninstalled

8. Erasure and data requests

Bundlo implements all three of Shopify's mandatory privacy webhooks.

Shop erasure. When a shop is redacted, the app deletes bundles, theme styling, placements, counts, sessions, audit trail, trial grants and error diagnostics. One record is deliberately kept: the processed-webhook markers, which hold a delivery id, a topic, a shop domain and a timestamp, and nothing else. They are the only evidence that an erasure already ran, so deleting them would let a retry of the same webhook — Shopify retries whenever an acknowledgement is lost — re-run the wipe against a shop that had reinstalled in the meantime. They expire on their own within seven days.
Customer erasure and customer data requests. Bundlo holds no customer data to return or erase. It records that the request was handled, and deliberately stores no customer identifier in doing so — keeping one would turn the record into exactly the personal-data store the request exists to remove.
Uninstall. Uninstalling deletes the app's access to the store.

Merchants can also email support@brandexio.com to request erasure directly.

9. Who else processes this data

Shopify — the platform the app runs on and reads from.
Fly.io — hosting and the database volume. The application runs in Paris, France.

Bundlo does not sell data and does not share it with advertisers. The storefront widgets make zero external requests — no fonts, no analytics, no image host, nothing. The single exception anywhere on a shopper's browser is a YouTube or Vimeo video the merchant chose to add to a bundle landing page, which loads only when the shopper taps play; section 5 covers it.

10. Changes

If what the app stores changes, this page changes with it, and the effective date above is updated.