Privacy policy

Updated October 11, 2026.

Bundlerie is a Shopify application operated by Errie Studios in the Netherlands. For privacy questions, contact erik@erriestudios.com. Merchants control the purposes for which their customers' information is processed. Bundlerie processes store data to provide the features configured by each merchant.

Information we use

We store the shop domain, Shopify shop identifier, currency, time zone, installation sessions, offer configurations and revisions, and subscription entitlement status. Access and refresh tokens are encrypted at rest. When Shopify provides an online merchant session, its associated merchant user details are stored to maintain that authenticated session.

For offer analytics, we process order and line item identifiers, discount allocations, merchandise amounts, currency, test-order and cancellation status, refunds, and a pseudonymous customer reference. We do not store customer names, email addresses, delivery addresses, or payment card information in offer analytics. Shopify may send additional information in webhook payloads; Bundlerie reads the fields required for its features and does not persist the complete payload.

Storefront experiments and analytics

Impression and add-to-cart events are collected only when Shopify's Customer Privacy API permits analytics processing. Events contain an offer identifier, experiment variant, event type and timestamp, and a random event identifier. We do not add advertising pixels or send these events to advertising networks. Experiment assignment uses session storage after analytics consent. Without available consent, the default offer is shown and these events are not collected. Security rate limiting may process the connection IP through Cloudflare; Bundlerie uses a keyed reference and does not store the raw IP in offer analytics.

Why we process information

Data supports authentication, offer publishing, Shopify-native discount calculations, inventory-aware product selection, analytics, refunds, privacy requests, troubleshooting, and abuse prevention. We do not sell customer information. Contact messages are used to respond to the request you send us.

Service providers and hosting

Shopify provides commerce, authentication, checkout, subscriptions, and platform APIs. Cloudflare provides application hosting, D1 database storage, TLS, and security infrastructure. The Bundlerie D1 database uses Cloudflare's EU jurisdiction setting. Requests and infrastructure services may operate across Cloudflare's global network. This setting is not a claim that every infrastructure process remains in the EU.

Retention and deletion

Offer configurations and revisions are retained while the application is installed. Storefront event records are retained for up to one year. Order analytics are retained for up to one year. Webhook receipts are retained for seven days. Customer data request exports expire after 30 days. Encrypted post-purchase authorization records expire after two hours. Minimal redaction references are retained to prevent deleted information from being recreated by later order updates.

Uninstalling deletes Bundlerie's active shop records, sessions, offers, and analytics. Shopify's mandatory customer and shop redaction webhooks also trigger deletion. Cloudflare's database recovery systems can retain recoverable database history for their configured recovery period; deletion from active records does not instantly erase recovery history.

Customer requests

Customers should contact the merchant who operates the store to request access, correction, or deletion. Bundlerie receives Shopify's mandatory privacy webhooks and makes requested stored data available to the authenticated merchant. A merchant can contact Errie Studios for assistance with a privacy request. You may also contact us directly about information we process in our own capacity.

Security

We use TLS, encrypted Shopify tokens, Shopify authentication, webhook signature verification, shop-scoped database queries, bounded input validation, and rate limiting. No system can guarantee absolute security. Please do not send secrets or payment details in support messages.

Changes

We update this policy when the application's data practices change and update the date above. Material changes will be communicated through the application or our support process where appropriate.