Privacy Policy
Last updated: 2026-06-17
1. Introduction
This Privacy Policy explains how xbundle, operated by DevOps Crowd Inc. (we, us, our), collects, uses, stores, shares, and protects information when you install and use our Shopify application, our website, and related services. By installing xbundle, you agree to the practices described here. We act as a data processor for the store data and shopper data we handle on your behalf, and you, the merchant, are the data controller for your store.
2. Information we collect from merchants
When you install and set up xbundle, we collect your Shopify store URL and domain, your email address, your account and plan details, and your in-app settings and preferences. If you upload a brand guide, product catalog, or business rules to guide the AI, we store that knowledge to improve its suggestions. If you connect your own AI provider key, we store it encrypted (see Security).
3. Store data we access through Shopify
With the permissions you grant at install, we access your product catalog, orders and order history, customers, discounts, price rules, files, publications, and themes through the Shopify API. We use this data to find the products your shoppers buy together, build and price bundles and discounts, place storefront widgets, and report performance. We access only what is needed to provide the features you use.
4. Shopper data we collect on your storefront
To measure how your bundles perform, our storefront web pixel records shopper interactions on your store, including page views, product views, collection views, cart activity, checkout started, and completed purchases, tied to the relevant bundle. This powers your analytics and revenue attribution. The pixel runs within Shopify's sandboxed environment and respects the customer privacy and consent settings configured in your Shopify admin. We do not use this data for advertising, and we never sell it.
5. How we use information
We use the information above to operate xbundle: to read your order history and find products that sell together, build and price bundles, run discounts through Shopify, place storefront widgets and the checkout upsell, power the AI assistant and agents, and produce your analytics. We also use account information to provide support, send service and billing notifications, and secure the service.
6. AI features and your data
xbundle's AI features process your store data to suggest and build bundles. When you connect your own AI provider key (OpenAI, Anthropic, Google Gemini, DeepSeek, or Grok), the data needed for the feature you requested is sent to that provider under your own account and their terms. We do not use your data to train our own or any third party's foundation models. Your AI provider keys are encrypted at rest and never shared.
7. Subprocessors and third-party services
We use trusted subprocessors to run xbundle: Shopify (store data and app platform), the AI provider you connect, our application data and hosting providers, our billing provider, and our email provider for service and billing notifications. Each operates under its own privacy terms, and we share only the data needed to deliver the service. We never sell your data or your customers' data. A current list of subprocessors is available on request.
8. Customer data requests and deletion
We honor Shopify's mandatory privacy webhooks for customer data requests, customer redaction, and shop redaction. When a shopper or a store owner submits a request through Shopify, we provide or delete the relevant data in accordance with Shopify's requirements and within the required timeframes. You can also contact privacy@xbundle.app.
9. Data retention
We retain your data for as long as your account is active. Analytics history is kept according to your plan. When you uninstall xbundle, we delete or de-identify your store and shopper data in accordance with Shopify's requirements, except where we must retain limited records to meet legal, tax, or security obligations. You can request deletion at any time at privacy@xbundle.app.
10. Security
We protect your data with encryption in transit and at rest. AI provider keys are encrypted with AES-256. We apply access controls, store-level isolation, and least-privilege access, and xbundle is a certified Shopify Partner application that follows Shopify's data protection requirements. No method of transmission or storage is perfectly secure, but we work to protect your information.
11. International data transfers
We are based in Canada. Your data may be processed by us and our subprocessors in Canada, the United States, and other countries where they operate. Where required, we rely on appropriate safeguards for cross-border transfers. By using xbundle, you understand your data may be processed outside your country of residence.
12. Your rights
Depending on where you live, you may have the right to access, correct, delete, and export your personal information, to object to or restrict certain processing, and to withdraw consent. We support these rights under the EU and UK GDPR and Quebec's Law 25, among other laws. To exercise your rights, contact privacy@xbundle.app, and we will respond within 30 days. You may also lodge a complaint with your local data protection authority, including Quebec's Commission d'acces a l'information.
13. Cookies
Our marketing website uses essential cookies to run the site and optional analytics cookies to understand usage, which you can accept or decline. Our storefront web pixel is separate from website cookies and respects the customer privacy settings configured in your Shopify admin.
14. Changes to this policy
We may update this Privacy Policy as the product and the law evolve. We will post the updated version with a new effective date, and significant changes will be communicated in the app or by email.
15. Contact
Questions or requests: contact privacy@xbundle.app or write to DevOps Crowd Inc., 1275 Av. des Canadiens-de-Montreal, Suite 5-129, Montreal, H3B 0G4, QC, Canada.