Privacy Policy

BNDL is a Shopify bundle widget. This page explains what data we collect, why we collect it, and what we don't.

Effective May 27, 2026.

The short version

• We collect no data about your store's shoppers.
• We store the access token Shopify issues to the app, plus the merchant profile Shopify sends with it. That's how the app stays signed in and knows who you are inside the admin.
• Your bundle configurations live in Shopify product metafields, owned by your store. Images you upload go directly to Shopify Files.
• Uninstalling the app deletes the session we hold. Forty-eight hours later, Shopify confirms with us that nothing remains.
• We don't sell, rent, or share your data with anyone other than Shopify, where it already lives.

Who we are

BNDL ("we," "us") is operated by an independent developer. You can reach us at privacy@bndl.levidan.com.

What this policy covers

This policy covers the BNDL marketing site at bndl.levidan.com and the BNDL Shopify app installed from the Shopify App Store.

What data we collect

From merchants installing the app

• Your shop's domain (e.g. yourstore.myshopify.com).
• The OAuth access token Shopify issues to the app.
• The merchant profile Shopify includes with that token: your name, email, locale, and whether you are the account owner or a collaborator. We use this to identify you in the admin UI and to authenticate your session.

From the marketing site (bndl.levidan.com)

The marketing site does not set tracking cookies and does not run third-party analytics. Standard server logs (IP address, user agent, requested URL) are retained transiently for security and debugging and are not used to build a profile of you.

From your store's shoppers

None. BNDL renders inside your storefront as a theme app extension. It reads your bundle configuration and adds a line item property when a shopper clicks add-to-cart. It does not transmit any shopper data to our servers.

Where your data lives

• Bundle configurations are stored in product metafields on Shopify, owned by your shop.
• Images uploaded through the template image picker go directly to Shopify Files, owned by your shop.
• The session record (shop domain, access token, and the merchant profile fields described above) is stored in a Postgres database operated by BNDL.

How we share data

We do not sell, rent, or share your data with third parties. The only place your data flows is back to Shopify, where your configurations and images already live, and to infrastructure we control for the purpose of running the app.

Cookies

The admin app uses session cookies set by Shopify's app framework to keep you signed in inside the embedded Shopify admin. The marketing site does not set tracking cookies.

Data retention and deletion

• When you uninstall the app, we delete your session record immediately.
• Forty-eight hours after uninstall, Shopify sends a shop/redact webhook, and we again delete any data keyed to your shop. This is the contractual backstop.
• You can request earlier deletion at any time by emailing privacy@bndl.levidan.com.

Shopper data requests (GDPR)

Shopify forwards customers/data_request and customers/redact webhooks to BNDL on behalf of your shoppers. Because we store no shopper data, we acknowledge these requests and have nothing to return or erase. If that ever changes, this policy and our handlers will be updated together.

Your rights

Depending on where you live, you may have the right to access, correct, or delete the data we hold about you, and to object to our processing of it. Email privacy@bndl.levidan.com and we'll handle it.

Changes to this policy

If we change this policy in a way that affects what data we collect or how we use it, we'll update the effective date at the top of this page. Material changes will be flagged in the app or on the marketing site before they take effect.

Contact

Questions, requests, or concerns: privacy@bndl.levidan.com.