Privacy policy

Bundles Monk is a Shopify app built and operated by Ioun Developers. It applies bundle and complete-set discounts to the carts of the stores that install it. This policy explains what the app stores, why, who else sees it, and how long it lasts.

Merchants who install the app are our customers. Their buyers are not: the app holds one thing about them, a Shopify customer identifier on the record of each order where a bundle discount was applied, as set out below.

The short version

Bundles Monk does not collect names, email addresses, phone numbers, addresses or payment details of your customers. It keeps a small record of each order in which one of your bundles or complete sets was discounted, so that the app’s home page can report which bundles sell: the order number, the time, the bundle, the quantity, the discount and the revenue of the discounted lines, and the Shopify customer identifier (a number) attached to that order. Buyer identity is also read transiently at checkout, inside Shopify’s own infrastructure, to work out which bundle offer applies (see “The discount function” below); none of that reaches us. Beyond that we keep only what the app needs in order to talk to your store and to know which plan it is on.

What we store

• Your shop domain and access token. The myshopify.com domain of your store and the access token Shopify issues when you install the app, together with the refresh token and expiry that keep it valid. These exist so the app can make API calls back to your store. The token is an offline access token, which belongs to the installation rather than to a member of your staff.
• A small record about your shop. Your shop’s Shopify identifier, the last plan we were able to read for it, which source that reading came from, and when. This exists so that a failed plan read cannot silently drop a paying store to the free allowances and switch its promotions off.
• Bundle order records. When an order is paid in your store and one of the app’s bundle or complete-set discounts was applied to it, Shopify sends us the order and we keep one row per bundle or set it discounted: your shop domain, the order’s Shopify identifier and order number, when it was placed, which bundle or set and add-on product it was, how many units were discounted, the discount amount and the revenue of the discounted lines in your store currency, and the Shopify customer identifier on the order (a number; blank for guest checkouts). Nothing else from the order is kept: no line items outside the bundle, no names, addresses, email addresses or payment details. These rows power the reporting on the app’s home page.
• Server logs. Request timestamps, shop domains and error messages, kept for operational troubleshooting. They contain no customer identifiers.

That is the whole list.

What we do not store

Your bundle and complete-set configuration is not stored by us. It is written into your own Shopify store: metafields on your products, app-owned records for your complete sets, and a compiled copy of those sets in a shop-level metafield that the discount function reads. It stays in your store, under your control.

Customer names, email addresses, phone numbers, shipping and billing addresses and payment details are never collected by this app. The order webhook subscription asks Shopify for a trimmed payload (the order and line identifiers, dates, currency, discount allocations and the customer’s numeric identifier only), so those fields are not delivered to us in the first place. We do not request the read_customers scope. The checkout-time read described under “The discount function” never leaves Shopify.

The scopes the app requests are read_discounts, write_discounts, read_products, write_products, read_themes, read_metaobjects, write_metaobjects and read_orders. The theme scope is read only, and is used for one thing: checking whether the app’s block is present on your published theme’s product template. The orders scope exists for the paid-order webhook described above.

The discount function

The pricing logic runs as a Shopify Function, executing on Shopify’s own infrastructure at checkout. It receives cart contents transiently in order to calculate a discount, and returns the result to Shopify. That data is never transmitted to us, and nothing from it is retained anywhere.

Because a bundle can carry exceptions for particular buyers, the function also reads two facts about the buyer, again transiently and only inside Shopify’s runtime:

• Whether the buyer is purchasing on behalf of a company, using the identifier of that company’s Shopify record. This is how a B2B-only offer applies at checkout. The function reads the identifier only, never the company’s name, contacts or addresses. Shopify classifies this field as protected customer data, and the app holds the corresponding Level 1 approval for it.
• The buyer’s country, as a two-letter country code, so that an offer limited to certain countries applies to the right checkouts.

Neither value is stored, logged or sent outside the function. The app never reads a buyer’s name, email address, phone number or address.

Sharing and processors

We do not sell, rent or share your data. The app is hosted on Railway (United States), which stores the records described above on our behalf. To find out which plan your store is on, we ask Shopify, using Shopify’s own APIs.

Beyond Railway and Shopify itself, no third party receives data from this app. There is no analytics, tracking or advertising code in the app or in the storefront blocks it provides. The only script the app loads from outside its own server is Shopify’s App Bridge, from Shopify’s CDN, which every embedded Shopify app loads.

Privacy requests

The app subscribes to Shopify’s three mandatory privacy webhooks and answers each of them:

• customers/data_request: we look up the bundle order records that carry that customer’s identifier and report to you, the merchant, which order numbers they cover, so you can include them in your answer to the customer. That identifier and those order numbers are the whole of what we hold about them.
• customers/redact: we remove the customer identifier from every bundle order record that carries it. The record itself stays, anonymous, so your bundle totals do not change.
• shop/redact: we delete the session records, the shop record and every bundle order record for your store. Uninstalling already deletes the session records immediately; this webhook clears everything else.

Retention

Session records are deleted as soon as the app is uninstalled, and again on shop/redact if any remain. The shop record, which holds your shop domain and Shopify identifier, and the bundle order records are deleted on shop/redact, which Shopify sends 48 hours after an uninstall; until then they are kept so that a reinstall keeps its reporting history. Metafields and records written into your store belong to you and are yours to keep or remove.

Security

All traffic to and from the app is over HTTPS. Incoming webhooks are verified against Shopify’s signature and rejected when it does not match. Access tokens are stored server side and are never exposed to the browser.

Changes

If this policy changes we will update the date at the top of this page.

Contact

Questions about this policy go to hello@ioun.dev.