Privacy Policy

Nova Bundles (“Nova Bundles”, “we”, “us”) is a Shopify app that lets merchants create and manage bundle deals and product discounts on their store. This policy describes what data the app collects, how it is used, and the choices you have. Effective date: July 23, 2026.

Data we collect from your store

When you install Nova Bundles, Shopify shares your store domain, store name, and store contact email with us, along with an API access token that lets the app work on your store. The app requests access only to the store resources it needs to operate: products, discounts, draft orders, markets, locales, themes, and order data.

Order data

To measure how much added revenue your bundle deals generate, the app receives an order-created notification from Shopify for each order. It reads only the line items that carry a Nova Bundles deal tag and records the attributed revenue amount, the order’s currency, and the Shopify order ID. The app does not collect or store your customers’ names, email addresses, shipping addresses, or payment details.

Storefront analytics

The bundle widget on your storefront reports simple interaction events (a bundle was viewed, an option was selected, or a bundle was added to cart). To de-duplicate these events, the widget generates a random identifier and stores it in the visitor’s browser (localStorage). This identifier is a random value only — it is not linked to a customer’s identity, and the app does not collect IP addresses, set advertising cookies, or track visitors across other websites.

Data the app creates and stores

• The bundle deals and discount configurations you create with the app.
• Aggregate deal statistics: view, add-to-cart, and attributed-order counts, plus attributed revenue totals used for your dashboard and billing.
• Subscription and usage-charge status for billing. All payments are handled by Shopify Billing; we never see or store payment card details.

Where data is stored

The app is hosted on Render, a cloud hosting provider, with data stored in a managed Postgres database (Supabase). Data is transmitted over encrypted connections (HTTPS).

Sharing

We do not sell or rent your data. Data is shared only with the service providers needed to run the app (Shopify for platform and billing, Render and Supabase for hosting and storage) to the extent required to operate the service.

Retention and deletion

Your data is kept while the app is installed. When you uninstall, your API access token is deleted and Shopify cancels your subscription. A minimal shop record (store domain and billing history) may be retained for accounting and to prevent free-trial reuse. You can request full deletion of this record at any time by emailing us.

GDPR and compliance requests

The app implements Shopify’s mandatory compliance webhooks (customer data requests, customer redaction, and shop redaction). Because the app stores no customer personal data, customer data requests and redaction requests are satisfied automatically; shop redaction removes the store’s records.

Changes

If this policy changes, we will update this page and revise the effective date above.

Contact

Questions or deletion requests: support@pandaworks.io