Privacy Policy — Mojo Bundles
Last updated: July 18, 2026
Mojo Bundles ("the App", "we", "us") provides offer, bundle and split-testing functionality for Shopify stores to merchants who install the App ("Merchants"). This policy explains what information we collect, why, and how we handle it.
1. Information we collect
Merchant / store information. When you install the App we store your shop domain, your billing plan with us, and the configuration you create inside the App (offers, bundles, pricing rules, design settings). As part of the standard Shopify login session we also process the store owner's name and email address (used only to operate your session and to contact you about the Service — never for third-party marketing).
Anonymous storefront analytics. To show you how your offers perform, the App records anonymous interaction events on your storefront (offer viewed, bundle selected, added to cart, checkout reached, purchase completed), keyed to a randomly generated session token. They contain no names, no email addresses, no phone numbers, and no postal addresses.
Limited order data. To attribute purchases to your offers and calculate revenue statistics, we receive a deliberately reduced version of new orders from Shopify, technically restricted (via Shopify's include_fields) to: order ID, creation date, currency, order totals, order tags, and line items. Customer name, email, phone number, and addresses are excluded at the API level — Shopify never sends them to us.
We do NOT collect: customer names, customer email addresses, phone numbers, shipping or billing addresses, payment details, or browsing behavior outside of your offer widgets.
2. How we use information
To render your offers and apply the discounts you configured; to show you per-offer and per-variant analytics; to run the split-testing features you enable; to bill your subscription through Shopify's billing system; and to provide support when you contact us. When you use the App's AI features, we send your offer configuration and product titles/prices to our AI provider (Anthropic) to generate suggestions — no customer data is ever sent to the AI provider.
3. Data sharing
We do not sell, rent, or trade any data. We share data only with the service providers required to operate the App:
| Provider | Purpose | Data |
|---|---|---|
| Shopify | Platform, billing | All App functionality runs through Shopify's APIs |
| Fly.io (hosting, EU region — Frankfurt) | Application and database hosting | All data listed above |
| Anthropic | AI offer suggestions | Merchant offer content only — never customer data |
4. Data retention & deletion
Analytics events and daily statistics are retained while the App is installed so your dashboards keep working. We honor Shopify's mandatory data-deletion webhooks: on shop/redact we delete the store's data from our systems; on customers/data_request and customers/redact we respond according to Shopify's GDPR process — because we do not store customer identities, there is typically no personal data to return or erase.
5. Security
All traffic between Shopify, your storefront, and our servers is encrypted (TLS). Webhooks are verified with Shopify's HMAC signatures; storefront requests are verified with Shopify's App Proxy signatures. Access to production systems is restricted to the App's operators.
6. Cookies & local storage
On your storefront, the App stores a single random session token in the visitor's browser (local storage) to avoid counting the same visitor twice. It contains no personal information and is not used for advertising or cross-site tracking.
7. Your customers' privacy (for Merchants)
You remain the data controller for your store's customer data. The App is built so that it operates without access to customer identities. If your privacy policy lists data processors, you can describe Mojo Bundles as an analytics/offer tool that processes anonymized interaction data and order amounts only.
8. Your rights (GDPR / CCPA)
Where the GDPR (EU/EEA) or the CCPA (California) applies, merchants and their customers have the right to access, correct, delete, or export personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Requests: support@mojobundles.com — we respond within the statutory deadlines. Our legal bases under GDPR Art. 6 are contract performance (operating the App you installed) and legitimate interest (anonymous analytics, service security). We do not sell personal information within the meaning of the CCPA. A data processing agreement (DPA) is available on request.
9. Changes & contact
We may update this policy as the App evolves; material changes will be reflected on this page with a new date. Questions or requests: support@mojobundles.com.