Privacy Policy

Effective Date: September 1, 2026 • App: Stackr: Bundles & Upsell • Provider: ConfirmFlow

1. Introduction & Commitment

ConfirmFlow ("we", "us", or "our") operates Stackr: Bundles & Upsell ("the App"), a Shopify application designed to help e-commerce merchants configure volume discounts, tiered pricing, and automated bundles.

This Privacy Policy explains what information we process, why we process it, how it is stored, and how merchants and customers can exercise applicable privacy rights.

2. Information We Collect

When you install and authorize Stackr from the Shopify App Store, we access specific store information authorized by your permissions:

  • Store Information: Store permanent domain, Shopify shop ID, and shop currency.
  • Product Catalog Data: Product and variant IDs, titles, handles, tags, product type, vendor, images, prices, availability, selected options, inventory status, and Cost per item where the merchant has supplied it.
  • Campaign & Discount Data: Bundle rules, selected product IDs, display settings, and identifiers and sync state for discounts created by Stackr.
  • App Analytics: Bundle views, add-to-cart events, item counts, and Stackr-attributed order totals. Stored order events do not include customer name, email, phone, address, payment information, or order notes.
We Do NOT Collect Sensitive Personal Data: Stackr does NOT process or store customer credit card numbers, payment credentials, personal home addresses, or customer identity information. All checkouts are processed exclusively through Shopify’s secure native checkout engine.

3. How We Use Collected Data

We process information solely for the following operational purposes:

  • To display customized volume discount tiers, BOGO offers, and bundle builders on your storefront.
  • To sync automated discount rules with Shopify’s native checkout and cart APIs.
  • To present bundle views, add-to-cart activity, conversion rate, and attributed bundle totals in the merchant dashboard.
  • To provide customer support, troubleshoot theme extension conflicts, and release feature updates.

4. Data Sharing & Third Parties

ConfirmFlow does NOT sell, rent, monetize, or trade your store data or customer data to advertisers, data brokers, or third parties under any circumstances.

We disclose data only to service providers needed to host and operate the application:

  • Hosting Infrastructure: Access-controlled application and database servers used to run Stackr.
  • Shopify APIs: For token authentication, theme app extension assets delivery via Shopify CDN, and webhook processing.

5. Compliance with Mandatory Shopify Webhooks

In accordance with Shopify Partner requirements, Stackr fully implements and responds to mandatory privacy webhooks:

  • customers/data_request: We acknowledge the request and confirm that Stackr does not store customer identity fields.
  • customers/redact: We acknowledge the request and verify that no stored customer identity fields require deletion.
  • shop/redact: When Shopify sends this webhook after uninstall, we delete the store record, access tokens, campaigns, and associated analytics events.

6. Security & Data Retention

We use access controls, signed requests, webhook verification, restricted production secrets, HTTPS encryption in transit, and AES-256-GCM application-level encryption for customer-linked order metrics stored at rest.

Customer-linked conversion analytics are retained for no more than 395 days. Upon app removal, store records, campaigns, access tokens, and associated analytics are deleted pursuant to Shopify's shop/redact protocol.

7. Contact Information

If you have any questions about this Privacy Policy, your rights, or wish to exercise data subject rights, please contact our data protection team: