Legal
Privacy Policy
How xbundle handles your store data, your shoppers' data, and the AI assistant you connect. The full policy is below; here is the short version.
The short version
A plain-language summary. It is not a substitute for the full text below.
- We act on your behalf You are the data controller for your store. We are the processor, and we access only what the app needs to build bundles, run discounts, and report performance.
- We never sell data Not your data, not your customers' data. The storefront pixel measures bundle performance only, and we do not use it for advertising.
- No AI keys, no training Connect AI runs through an assistant you connect yourself. We store no AI provider keys and never train models on your data.
- You can get it deleted Uninstall and we delete or de-identify your store and shopper data per Shopify's requirements. You can also request deletion any time.
Introduction
This Privacy Policy explains how xbundle, operated by DevOps Crowd Inc. (we, us, our), collects, uses, stores, shares, and protects information when you install and use our Shopify application, our website, and related services. By installing xbundle, you agree to the practices described here. We act as a data processor for the store data and shopper data we handle on your behalf, and you, the merchant, are the data controller for your store.
Information we collect from merchants
When you install and set up xbundle, we collect your Shopify store URL and domain, your email address, your account and plan details, and your in-app settings and preferences. If you connect an AI assistant through Connect AI, we record the connection you approved so we can honor it. We do not collect or store AI provider keys.
Store data we access through Shopify
With the permissions you grant at install, we access your product catalog, orders and order history, customers, discounts, price rules, files, publications, and themes through the Shopify API. We use this data to find the products your shoppers buy together, build and price bundles and discounts, place storefront widgets, and report performance. We access only what is needed to provide the features you use.
Shopper data we collect on your storefront
To measure how your bundles perform, our storefront web pixel records shopper interactions on your store, including page views, product views, collection views, cart activity, checkout started, and completed purchases, tied to the relevant bundle. This powers your analytics and revenue attribution. The pixel runs within Shopify's sandboxed environment and respects the customer privacy and consent settings configured in your Shopify admin. We do not use this data for advertising, and we never sell it.
How we use information
We use the information above to operate xbundle: to read your order history and find products that sell together, build and price bundles, run discounts through Shopify, place storefront widgets and the checkout upsell, power the Connect AI features, and produce your analytics. We also use account information to provide support, send service and billing notifications, and secure the service.
AI features and your data
xbundle's AI features work through an AI assistant you connect yourself, such as Claude or ChatGPT, over a connection you approve in your Shopify admin. When your assistant reads your store's data through xbundle, that data is handled by your AI provider under your own account and their terms. We sell no AI subscription, we store no AI provider keys, and we do not use your data to train our own or any third party's foundation models.
Subprocessors and third-party services
We use trusted subprocessors to run xbundle: Shopify (store data and app platform), our application data and hosting providers, our billing provider, and our email provider for service and billing notifications. Any AI assistant you connect acts under your own account with its provider, not as our subprocessor. Each operates under its own privacy terms, and we share only the data needed to deliver the service. We never sell your data or your customers' data. A current list of subprocessors is available on request.
Customer data requests and deletion
We honor Shopify's mandatory privacy webhooks for customer data requests, customer redaction, and shop redaction. When a shopper or a store owner submits a request through Shopify, we provide or delete the relevant data in accordance with Shopify's requirements and within the required timeframes. You can also contact privacy@xbundle.app.
Data retention
We retain your data for as long as your account is active. Analytics history is kept according to your plan. When you uninstall xbundle, we delete or de-identify your store and shopper data in accordance with Shopify's requirements, except where we must retain limited records to meet legal, tax, or security obligations. You can request deletion at any time at privacy@xbundle.app.
Security
We protect your data with encryption in transit and at rest. We store no AI provider keys, and every AI connection is scoped to the store that approved it. We apply access controls, store-level isolation, and least-privilege access, and xbundle is a certified Shopify Partner application that follows Shopify's data protection requirements. No method of transmission or storage is perfectly secure, but we work to protect your information.
International data transfers
We are based in Canada. Your data may be processed by us and our subprocessors in Canada, the United States, and other countries where they operate. Where required, we rely on appropriate safeguards for cross-border transfers. By using xbundle, you understand your data may be processed outside your country of residence.
Your rights
Depending on where you live, you may have the right to access, correct, delete, and export your personal information, to object to or restrict certain processing, and to withdraw consent. We support these rights under the EU and UK GDPR and Quebec's Law 25, among other laws. To exercise your rights, contact privacy@xbundle.app, and we will respond within 30 days. You may also lodge a complaint with your local data protection authority, including Quebec's Commission d'acces a l'information.
Changes to this policy
We may update this Privacy Policy as the product and the law evolve. We will post the updated version with a new effective date, and significant changes will be communicated in the app or by email.
Contact
Questions or requests: contact privacy@xbundle.app or write to DevOps Crowd Inc., 1275 Av. des Canadiens-de-Montreal, Suite 5-129, Montreal, H3B 0G4, QC, Canada.