Bundlo Privacy Policy

Last updated: July 21, 2026

Bundlo ("the app") provides quantity breaks and volume discounts for Shopify stores, operated by Altern Media ("we", "us"). This policy describes what data the app processes when a merchant installs it, and why.

What we collect and why

We process the minimum data needed to provide the service:

• Store and configuration data. Your shop domain, the discount rules and bundles you create, your app settings, your onboarding progress, and app session tokens. Needed to run the app.
• Order-level discount data (protected customer data, purpose: analytics). When an order uses a Bundlo discount or contains a Bundlo bundle we store the order ID, the order total and its currency, the discount amount per rule with the rule name as it was at the time, the revenue per bundle, which A/B variant was live, and whether we have tagged the order in Shopify. This powers the analytics dashboard, the A/B results and the CSV export, so you can verify what the app contributed.
• Order tags we write back. With your permission the app adds a tag such as "Bundlo: Starter Kit" to orders containing a bundle, so you can filter and fulfil them. That tag lives in your own Shopify admin.

We do not store customer names, e-mail addresses, phone numbers, addresses, payment details or IP addresses, and we store nothing at all about shoppers who do not buy. We do not sell data, do not use data for advertising, and do not use automated decision-making with legal or similar effects.

Data processing terms

We act as a data processor on behalf of the merchant for the order-level data described above, and only process it to provide the app's functionality. We process data in accordance with the GDPR and comparable privacy laws.

Retention and deletion

• Data is retained only while the app is installed.
• When Shopify sends the shop/redact notification (48 hours after uninstall), all stored data for that store is permanently deleted.
• Customer data requests and redaction requests received via Shopify's mandatory privacy webhooks are honored automatically; since we store no customer PII, there is typically nothing to return or erase beyond the order-level amounts, which are deleted with the store's data.

Security

Data is encrypted in transit (TLS) and at rest on our hosting infrastructure. Webhooks are verified with HMAC signatures. Access to production data is limited to the operator.

Contact

Questions or requests: info@alternmedia.nl.