Privacy Policy

Last updated: July 15, 2026

This Privacy Policy describes how Bundle Builder: Build a Box, provided by Ecombone (“the App”, “we”, “us”), collects, uses, and protects information when a merchant installs and uses the App on their Shopify store.

Information we access and store

The App is a discount-management and offer-analytics tool. To function, it accesses the following data through the Shopify Admin API, under the permissions you grant at install (read_products, write_discounts and read_orders):

• Store and session data — your store domain and the OAuth access token issued by Shopify. This is stored so the App can authenticate requests on your behalf.
• Products and collections (read only) — used to let you target discounts and resolve which products an offer applies to.
• Discount and app configuration — the offers you create are stored in Shopify metafields on your own store.
• Order data (read only) — we read order totals, line items and the discount/offer applied to each order, solely to attribute revenue to each offer or banner so you can measure how much sales each promotion generates. We store only aggregated revenue metrics per offer; we do not retain individual orders, and we do not access protected customer fields (name, email, phone, or address).

Customer personal data

The App does not collect or store the personal data of your customers (names, emails, addresses, or payment details). We read order data only to compute aggregated, per-offer revenue figures; no customer-identifying information is retained by the App.

How we use information

• To provide and operate the App’s discount features.
• To manage your subscription. Billing is handled entirely by Shopify App Pricing; Shopify processes the charge and we do not receive or store your payment details.
• To provide support and respond to your requests.

Data sharing

We do not sell or rent any data. Data is processed by Shopify (our platform provider) and by the App’s hosting provider solely to operate the service. We may disclose information if required by law.

Data retention and deletion

We retain the aggregated per-offer revenue metrics only for as long as the App remains installed on your store. We do not store individual orders or any customer-identifying data. When you uninstall the App, all of your data — session records and aggregated metrics alike — is deleted. We honor Shopify’s mandatory GDPR/CCPA compliance webhooks:

• customers/data_request and customers/redact — as the App stores no customer personal data, there is nothing to return or erase; we acknowledge these requests.
• shop/redact — 48 hours after uninstall, we erase the store’s session records and all aggregated offer metrics for that store.

Data security

All data is encrypted in transit (TLS/HTTPS) and encrypted at rest by our hosting provider. Access to production systems is restricted to authorized personnel.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete data we hold. To exercise them, contact us at the address below.

Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date reflects the latest revision.

Contact

For any privacy questions, email info@ecombone.com.