Privacy policy

On install BundleForge asks Shopify for these scopes and no others: read_products, write_products, write_publications, read_inventory, read_locations, read_orders, read_cart_transforms, write_cart_transforms and write_app_proxy. We do not request read_customers, read_all_orders, read_customer_payment_methods, read_themes or any marketing scope. Because the customer scope is never requested, the app has no route to a customer profile, address book or saved payment method.

We store the merchant shop domain and a shop identifier we derive from that domain; Shopify sessions, including the access token and the session payload, which are encrypted before they are written; the Shopify staff account details Shopify returns with an online session, which are the staff user identifier, first name, last name, email address, locale, account-owner flag, collaborator flag and email-verified flag; the merchant's bundle configurations, meaning the bundle title, the chosen product and variant identifiers, component quantities, component prices, required or optional flags, minimum and maximum selection limits, publishing status and the published price; a per-order bundle ledger holding the Shopify order identifier, the order name such as #1001, Shopify line-item and line-item-group identifiers, the bundle key, quantities, component variant identifiers and prices, refund identifiers and the allocated, released or refunded status with its timestamps; a webhook inbox holding a reduced copy of each order, refund, cancellation, product, inventory and app-uninstall webhook we receive; queue records that reference a webhook inbox row; and audit records for the Shopify privacy webhooks.

We also store one billing record for the installation. It holds the plan handle, the subscription status, a plan reference we build from the shop domain and the plan handle, and the trial-end and billing-period-end dates Shopify reports. This record is written whenever the billing page reads the plan from Shopify, so it exists even when there is no active plan.

The BundleForge database holds no customer names, email addresses, phone numbers, billing or shipping addresses, payment card data, shopper IP addresses or marketing profiles. Before a webhook is written to our database it is stripped down to the order identifier, the order name, the line-item identifiers, quantities, product titles and line-item properties, plus the refunded line-item identifiers and quantities when the webhook is a refund. The customer object, contact details and addresses in Shopify's payload are discarded and never reach our storage. Payment for a plan is taken by Shopify, so we never see card details.

One thing to be aware of: line-item properties are kept, because BundleForge uses its own bundle properties to reconcile an order. If a merchant's theme or another app writes customer-entered text into a line-item property, for example a gift message or an engraving name, that text is stored in our webhook inbox along with the rest of the reduced payload. Merchants who collect personal data in line-item properties should treat that as personal data processed by this app and can ask us to remove it.

Products, variants, SKUs, prices, component inventory levels and orders are read live from the Shopify Admin API when a merchant opens a page in the app, and the affected order is read again when Shopify sends an order, cancellation or refund webhook. Shopify remains the source of truth and the app keeps no shadow copy of a catalogue or of inventory. The order query used by the app requests order and line-item fields only; it does not request any customer field.

With the merchant's action in the app, BundleForge creates and updates bundle products, variants and their Shopify component relationships, publishes them to the merchant's Online Store, and writes an app-owned metafield in the bundleforge namespace holding the published bundle titles, links, images, prices, item counts and saving percentages so the theme block renders with no configuration. For a customisable bundle it also writes an app-reserved metafield on each chosen component variant, recording which bundle that variant belongs to, the permitted component variants, their quantities and any percentage discount, which is what the Shopify Function reads in the cart. This data is business catalogue data and contains no personal data.

The public bundle page served through the Shopify app proxy renders published bundle titles, the components in each bundle and their quantities. It sets no cookie, runs no analytics, loads no third-party script and records nothing about the shopper. The theme block renders the titles, images, prices and saving percentages held in the app-owned metafield, and it too records nothing about the shopper. When a shopper configures a customised bundle, the app returns a short-lived signed token that describes only the bundle key, the parent variant and the chosen component variants and quantities; the token expires after fifteen minutes and holds no shopper identity. The Shopify Function that assembles the bundle in the cart runs inside Shopify's own infrastructure and sends nothing to us.

We process this data to provide the app, to let a merchant build and publish bundles, to keep the storefront block in step with what is published, to reconcile bundle sales, refunds and cancellations exactly once, to enforce the plan the merchant chose in Shopify, to protect the service and to meet legal obligations. We do not sell data, we do not profile shoppers and we do not use any of this data for advertising.

BundleForge makes no outbound calls to any third-party service. It talks to the Shopify Admin API and to its own database, and nothing else. There is no analytics provider, no email provider, no error-reporting provider and no advertising network in the app. Data is held by Fleeta Limited, United Kingdom, on hosted infrastructure operated on our behalf under contract. We disclose data outside that arrangement only where the law requires it.

We want to be exact here rather than reassuring. Bundle configurations, the bundle order ledger, the reduced webhook inbox, queue records, audit records and the encrypted session are kept for as long as the installation exists. Uninstalling the app does not by itself delete them: BundleForge records the uninstall webhook but erases nothing at that point, and it runs no scheduled purge, so no record is aged out on a timer.

Deletion happens when Shopify sends the shop-redaction request that follows an uninstall. That request deletes the shop record and every record attached to it, which covers the bundle configurations, the order ledger, the webhook inbox, queue records, audit records, the billing record and the Shopify sessions attached to that shop record. One honest caveat: a session row written in the short window before the shop record exists is not attached to it and can outlive the redaction, so we clear any such leftover on request. A merchant who wants their records removed sooner, or who wants us to confirm the deletion, can email accounts@fleeta.co.uk with their shop domain and we will delete them on request.

BundleForge subscribes to all three mandatory topics and each one is handled before any other processing. A shop/redact request deletes the shop record and the data attached to it, with the scope and the one caveat set out under Retention. The app/uninstalled webhook is recorded but does not delete anything on its own. A customers/redact or customers/data_request request is recorded in the audit trail, and because the app holds no customer identifier there is no customer record to return or to erase; the reduced webhook payloads described above are keyed to Shopify order identifiers, not to a customer. If a merchant believes customer-entered text reached us through a line-item property, they should contact us directly so we can remove it, since the automated customer-redaction handler does not cover that case.

The app is served over HTTPS. Shopify access tokens and session payloads are encrypted with AES-256-GCM authenticated encryption before they are written to the database, and the encryption key is held in the server environment and never in the database. Every webhook is verified against Shopify's HMAC signature before it is accepted, every storefront request through the app proxy is verified by Shopify's proxy signature, and bundle composition tokens are signed with HMAC-SHA256 and compared in constant time. Every stored record is scoped to one shop and one app key, so one merchant's data cannot be read through another installation. The staff account fields returned with a Shopify session are stored in ordinary database columns rather than encrypted ones.

Merchants choose what to bundle, what to publish and when to uninstall. Subject to applicable law, you can ask for access to, correction of, or deletion of personal data we hold, and you can object to or ask us to restrict processing. Shoppers should raise requests with the merchant who runs the store, since the merchant is the controller of their order data and we act on that merchant's instructions. Requests can be sent to accounts@fleeta.co.uk.

Fleeta Limited, United Kingdom. Privacy, security and data-deletion enquiries: accounts@fleeta.co.uk.