Privacy Policy

1. Who This Policy Covers

This policy covers merchants who use WowBundles, their authorized staff and shoppers who interact with merchant-configured bundle and discount offers. Merchants manage their own customer relationships and remain responsible for their store’s privacy notices and permissions.

Shoppers should contact the store where they purchased for questions about an order or the store’s handling of their information.

2. Store and Account Information

The App stores the shop domain, currency, money format, time zone, installation state, setup progress and settings. It also stores offer configurations, product and variant references, discount rules, gifts, add-ons, design choices and identifiers used to publish offers to Shopify.

Shopify authentication sessions include access tokens, authorization scopes, session state and expiry information. Where Shopify supplies an associated admin user, session records can include their identifier, name, email, locale and account or permission flags. These are merchant or staff account details.

If you contact us for support, we receive the information you provide, such as your name, email, store details and message. Please do not send access tokens, payment details or sensitive customer records through a general support message.

3. Information Accessed Through Shopify

The App accesses product, variant, market and theme information to configure and display offers. It manages discounts, product references, storefront offer data and offer images through Shopify. Reading product titles, images, prices and availability does not mean the App copies the entire catalog into its database.

When order attribution is enabled and authorized by Shopify, the App processes order identifiers, creation times, test-order status, line quantities, prices, discounts and bundle labels. It stores matched offer and tier amounts and order time rather than the full order payload. Attribution records do not include shopper names, email addresses, phone numbers, postal addresses or customer identifiers.

4. Offer Analytics and Consent

Storefront offer-view and add-to-cart events are sent only when analytics consent is allowed by the store’s privacy settings. Messages identify the store, offer, tier and event type. The App aggregates events into daily counters instead of retaining individual event records. Admin previews, theme-editor sessions and detected automated traffic are excluded.

Daily records include views, add-to-cart counts and, when enabled, attributed order counts, revenue and discounts by offer and tier. Order attribution operates separately from consent-based storefront counts, so these reports may describe different audiences.

Network requests necessarily transmit connection information, including IP addresses, to servers. The App’s event handler does not store IP addresses as offer analytics data. Infrastructure providers may process technical connection data to operate their services.

5. Cookies and Browser Storage

The App’s storefront analytics does not set tracking cookies or create persistent shopper identifiers. Gift-cleanup functionality can use session storage, including a cart-token-based reload guard, to prevent repeated cart-page reloads. Merchant admin local storage remembers checklist completion in that browser.

Shopify’s authentication, storefront and checkout may use cookies and storage under Shopify’s and the merchant’s notices. The separate WowApps website uses Crisp for support chat and SendGrid to deliver contact-form messages. Those services process technical connection information or the information you submit for their respective support functions.

6. How We Use Information

We use store and session information to authenticate access, configure and publish offers, display products, preserve settings and provide merchant reporting. Support information helps us respond to questions and resolve issues. Privacy webhooks and cleanup functions support deletion and retention handling.

The App does not integrate an external advertising or analytics service. Its offer analytics uses aggregated counters, and its implementation does not sell advertising data or create shopper advertising profiles.

7. Storage and Service Providers

Application records and authentication sessions are stored in PostgreSQL. Shopify services handle offer display data, product references, discounts and uploaded images. Hosting and database services process information needed to operate the App; website support messages also use Crisp and SendGrid as described above.

Service providers may process information in locations outside your country. Contact us for questions about providers, processing locations or how information is handled. Shopify and other third-party services have their own privacy policies.

8. Retention and Deletion

The App removes order-attribution rows older than 90 days during subsequent order processing or merchant admin access. This cleanup is activity-triggered and does not guarantee removal exactly 90 days after collection.

Daily counters remain while an offer exists and are removed with it. Store settings and offers can remain after uninstall to support reinstallation. Shopify’s shop-erasure webhook removes the shop’s application records. Additional cleanup can remove records for shops uninstalled more than 30 days earlier when scheduled to run.

Authentication-session cleanup runs on uninstall and shop erasure. Deletion timing can depend on webhook delivery, application activity and provider backup lifecycles. Contact us about retained information or a deletion request.

9. Your Choices and Privacy Requests

Depending on applicable law, you may have rights to request access, correction, deletion or portability of information, or to object to or restrict certain processing. Contact support[at]wpxpo.com for privacy requests. We may need to verify your identity and relationship to the store before handling a request.

Shoppers should first contact the merchant from whom they purchased. The App authenticates Shopify’s customer-data request, customer-erasure and shop-erasure webhooks. Customer erasure removes attribution rows for order identifiers supplied by Shopify; shop erasure removes the shop’s records. Aggregate counters have no direct customer or order identifier.

Uninstalling the App ends its authorized access through that installation. It does not by itself erase every existing application record; retention and erasure are described above.

10. Security

The App authenticates merchant admin access and Shopify webhook requests. Production database connections require an SSL-mode setting, logging helpers limit error details and event handlers avoid logging request bodies. No online system is completely secure. Merchants are responsible for protecting access to their Shopify accounts.

11. Children’s Information

WowBundles is a merchant-facing business tool and does not provide shopper accounts or age-verification features. Merchants remain responsible for their store’s audience and collection practices. Contact us if you believe a child’s information has been provided to us through the App or support services.

12. Changes to This Policy

We may update this policy as the App or our practices change. Updates will be posted on this page with a revised effective date. Please review this page periodically and contact us with any questions.