Privacy policy
How Reverse Bundle Pro processes shop and order data. Last updated: August 1, 2026.
1. Controller / operator
Reverse Bundle Pro (“the App”) is operated at https://reverse-bundling.me. Contact for privacy requests: support@reversebundling.com.
2. Scope
This policy covers data processed when a Shopify merchant installs and uses the App. It does not replace Shopify’s own privacy terms for the merchant’s storefront customers.
3. Data we process
- Shop domain, Shopify shop ID, and OAuth session / access tokens
- Order and line-item fields needed to match pack rules and run Order Edit
- Pack rules, app settings (including pick rate-card costs), and conversion logs
- Optional ShipStation API credentials you enter (used only to refresh orders after edit)
- Billing / subscription status from Shopify Billing
- Optional notification destinations you configure (email / Slack webhook)
- GDPR compliance webhook payloads (scrubbed audit copies retained for accountability)
We do not sell personal data. We do not use store data to train public AI models.
4. Purposes & legal bases
We process data to provide the App (contractual necessity): convert matching orders, show operational screens, enforce plan limits, send optional alerts you enable, and comply with Shopify’s mandatory GDPR webhooks and applicable law.
5. Subprocessors
Hosting, database, and transactional email providers required to run the service. Shopify remains the commerce platform. We do not claim independent SOC 2 certification.
6. Retention
Merchant app data is retained while the App is installed and as needed for billing disputes, security, or legal obligations. Uninstall triggers shop data purge for merchant app tables. Compliance audit records may be retained longer where required to demonstrate response to Shopify GDPR topics.
7. International transfers
Infrastructure may be located outside your country. Where required, we rely on appropriate safeguards offered by our providers and Shopify’s platform terms.
8. Security
We use industry-standard measures appropriate to a Shopify app (encrypted transport, access controls, secret management). No method of transmission or storage is 100% secure.
9. Your rights
Merchants may access or delete App data by uninstalling (purge) or emailing support. End-customer rights are primarily exercised through Shopify’s compliance webhooks (`customers/data_request`, `customers/redact`, `shop/redact`), which we implement.
10. Children
The App is for business use by Shopify merchants and is not directed to children.
11. Changes
We may update this policy; the “Last updated” date will change. Material changes will be reflected on this page.
12. Data Processing Addendum
Controllers needing a DPA: see /dpa and /subprocessors.