Privacy policy
What RRR Bundles collects from a Shopify store that installs it, why, and what happens to it. Written to describe the app as it actually behaves.
The short version
No customer personal data
No customer names, emails, phone numbers, or addresses are read or stored. Attribution works on line values and a bundle marker, not on who placed the order.
Never sold
No selling or renting of data, no advertising networks, no cross-site tracking, and no third-party analytics — in the app or on this site.
Deleted on uninstall
Credentials are removed immediately, and your shop's stored data is deleted when Shopify sends the redaction request that follows an uninstall.
Who we are
RRR Bundles is a Shopify application operated by the app's developer, reachable at support@utekar.com. For store data processed by the app, the merchant is the data controller and we act as a data processor on the merchant's behalf.
What the app collects
Store and installation data
Your store's domain and the access credentials Shopify issues at install, which are what allow the app to call Shopify on your behalf. Also the plan, subscription state, and billing period records needed to operate your subscription.
Configuration you create
Bundle definitions, pricing rules, widget appearance settings, translations, and app settings. This is your own commercial configuration, stored so the app can reproduce it.
Order data, limited to bundle lines
When order tracking is enabled, the app reads paid orders to identify line items created by its bundles. It stores the value and identifiers of those bundle lines, and refund events that reverse them.
The app does not read or store customer names, email addresses, phone numbers, or postal addresses. It holds no customer-level personal data of any kind. Attribution operates on line item values and a bundle marker property, not on who placed the order.
Support messages
If you contact us through the app, the message you write and your store's identity are stored so we can answer. If you email us, we hold that email.
Operational logs
Server logs recording requests, errors, and background job outcomes, used for diagnosis and reliability. These are short-lived and are not used for profiling or advertising.
What the app does not do
- No selling or renting of data, ever.
- No advertising, ad networks, cross-site tracking, or analytics.
- No customer personal data collection, as described above.
- No handling of payment card details — billing runs entirely through Shopify.
- No writes to your theme files.
Why we process it
To provide the service you installed the app for: creating and publishing bundles, applying bundle pricing at checkout, showing you analytics, enforcing and billing the plan you selected, and answering your support requests. Where the GDPR applies, our basis is performance of a contract with the merchant, and our legitimate interest in keeping the service secure and working.
Who we share it with
Only the parties needed to run the app:
- Shopify — the source and destination of store data, and the processor of all billing.
- Our hosting provider — operates the server and managed database the app runs on.
- Email provider — carries support correspondence.
- Google Fonts — serves the typefaces used on these public marketing and policy pages. Your browser requests the font files from Google, which means Google receives your IP address and basic request headers as part of that. This applies only to these public pages, not to the app inside your Shopify admin, and no cookies are set by it.
We also disclose data where legally required. Beyond the above we do not share data with anyone else, and there are no analytics, advertising, or tracking third parties anywhere in the app or on this site.
Where data is held, and for how long
Data is stored in our hosted database and retained while the app is installed, because it is the configuration that makes the app function. Support messages and revenue records are retained for a limited period afterwards for accounting and dispute purposes.
On uninstall, access credentials are removed immediately. Shopify then sends a shop redaction request, and on receiving it the app deletes the shop's stored data — bundle definitions, settings, plan records, and support tickets.
Security
All traffic is served over HTTPS. The database is not reachable from the public internet. Administrative access is restricted, and the app requests only the Shopify permissions it uses. No system is perfectly secure, and we do not claim otherwise; if you believe you have found a problem, please write to us using the address above.
Shopify data requests
The app implements Shopify's three mandatory privacy webhooks and acts on all of them automatically:
- Customer data request — resolves to a recorded no-op, because the app stores no customer-level personal data to return.
- Customer redaction — likewise a recorded no-op; any identifiers contained in the request itself are stripped from our record of it rather than retained.
- Shop redaction — the shop's stored data is deleted.
Each request is logged with its outcome so that fulfilment is auditable.
Your rights
Depending on where you are, you may have the right to access, correct, export, or delete your data, to restrict or object to processing, and to complain to a supervisory authority. Merchants can exercise these by writing to support@utekar.com; we respond within the period the applicable law requires. Shoppers should contact the store they purchased from, since we hold no data identifying individual shoppers.
Children
The app is a business tool for merchants and is not directed at children, and we do not knowingly collect data from them.
Changes to this policy
If this policy changes materially we will update the date above and, for changes that affect how merchant data is handled, notify installed merchants.