Privacy policy

Last updated 9 November 2026

Gift & Bundle is a Shopify app that lets merchants run free gift, Buy X Get Y, volume discount and free shipping offers. This policy explains what data the app handles, why, and how it's protected. It applies to merchants who install the app and to shoppers who visit their stores.

What we collect from merchants

• Store details from Shopify: the store's Shopify domain, currency and time zone, so offers work in the store's money and dates.
• Access credentials: the access token Shopify issues when the app is installed, used only to run the app for that store.
• What you create in the app: your offers, their settings and designs, and the names of the products or collections you choose for them.
• Usage counts: how many orders used an offer each month, read from Shopify's count for the app's discount, to apply your plan's limit. We don't read the orders themselves.

Shoppers' data

Gift & Bundle does not collect, store or process shoppers' personal data: no names, emails, addresses, phone numbers or order details. Discounts are calculated by Shopify at checkout using our offer rules. On the storefront, the app reads the cart to show offer progress and add free gifts, and keeps small notes in the shopper's own browser (session storage), such as the size they chose for a free item. These notes never leave the browser and are cleared when the browsing session ends.

How we use data

Only to provide the app: running offers, showing them on the storefront, applying plan limits and giving support. We don't sell data, use it for advertising, or share it with anyone except the service providers below.

Service providers

• Shopify: the platform the app runs on, and billing for paid plans.
• Vercel: hosts the app.
• Supabase: our database, hosted in Japan, encrypted in transit and at rest.

Keeping and deleting data

We keep a store's data while the app is installed. If you uninstall, your offers are kept briefly in case you reinstall, and Shopify then sends us a deletion request 48 hours later, at which point we permanently delete everything we hold for your store. We also respond to Shopify's customer data requests; because we hold no shopper data, there is nothing to return or delete for shoppers.

Your rights

You can ask us what data we hold about your store, to correct it, or to delete it at any time, by emailing support@giftandbundle.com. Residents of the EEA, the UK and California have these rights under the GDPR, the UK GDPR and the CCPA, and we honour them for everyone.

Security

Connections are encrypted (HTTPS), access to the database is restricted to the app, and webhooks from Shopify are verified with Shopify's signature before anything is processed.

Changes

If we change this policy, we'll update the date above, and tell merchants in the app before significant changes take effect.

Contact

Gift & Bundle · support@giftandbundle.com · giftandbundle.com