Privacy Policy

1. Overview

Evolve Bundles ("we", "us", or "our") is a Shopify application dedicated to helping merchants automatically generate, curate, and optimize product bundles. This Privacy Policy describes how we collect, store, and process information when you install and use our application through your Shopify store.

We believe in privacy by design. Our application processes only the store product catalog and aggregated performance metrics necessary to curate bundles and measure conversions. We do not sell merchant data, nor do we harvest or track personally identifiable information (PII) of your end shoppers.

2. Data We Collect

To provide our automated bundling services, we access and synchronize:

• Store Identity & Settings: Store domain (e.g. store.myshopify.com), primary currency code, language locale, and chosen subscription tier.
• Product Catalog Data: Product titles, descriptions, categories, product types, tags, vendor names, collection memberships, SKUs, inventory status, prices, and variant options. This information is required for our AI engine to identify complementary products.
• Aggregated Order Snapshots (Attribution): When orders occur, we query order line items to assess whether bundles were purchased together. We only record product IDs, variant IDs, quantities, and net bundle revenue. We deliberately do not store customer names, physical addresses, emails, or payment details.
• Storefront Engagement Metrics: Anonymous bundle impressions, views, clicks, and add-to-cart events recorded directly on product pages to measure bundle conversion rate.

3. Customer Data & GDPR Compliance

Under GDPR, CCPA, and global privacy standards, we support all mandatory Shopify privacy webhooks:

• customers/data_request: We return confirmation that no shopper personal data is held.
• customers/redact: Any anonymized transaction references associated with the redacted customer are purged.
• shop/redact: Within 48 hours of an uninstallation or redaction notice, all cached store catalog and metrics are deleted permanently.

4. How We Use Data

We use the data collected strictly for the following purposes:

1. Generating and scoring candidate product bundles matching your catalogue taxonomy.
2. Synchronizing published bundles to your store metafields (smart_bundles.bundle_data).
3. Configuring automatic checkout discount functions through Shopify Functions.
4. Providing the merchant dashboard with performance funnels, add-to-cart rates, and revenue impact reports.
5. Executing automated maintenance cycles (pruning underperforming bundles, retiring discontinued inventory).

5. AI Model Processing & Third Parties

Our candidate pairing and curation engine utilizes secure LLM inference via OpenRouter (e.g., Seed 2.0 Lite / OpenAI-compatible models).

• Only anonymized product metadata (e.g. titles, tags, and product types) is transmitted for relationship reasoning.
• No merchant customer data or transactional PII is ever sent to AI model providers.
• Prompts and inference inputs are stateless and not used for public foundation model training.

6. Data Retention & Deletion

We retain store catalog and performance metrics as long as your store keeps Evolve Bundles installed. When you uninstall Evolve Bundles from your Shopify store:

• The app/uninstalled webhook immediately flags the store as inactive and disables all background curation cycles.
• All active discount functions and theme app embeds automatically deactivate.
• Database records, cached products, and analytics are permanently removed in accordance with Shopify partner guidelines.

7. Security & Webhooks

All communications between Shopify, our backend servers, and end-user browsers are encrypted using modern Transport Layer Security (TLS 1.2+). Database connections use isolated volume storage with write-ahead logging (WAL), protected behind Cloudflare proxy tunnels.

Every incoming webhook request is cryptographically validated using Shopify's HMAC-SHA256 signature algorithm to ensure authenticity.