Privacy Policy

Effective Date: September 1, 2026 • App: Stackr: Bundles & Upsell • Provider: ConfirmFlow

1. Introduction & Commitment

ConfirmFlow ("we", "us", or "our") operates Stackr: Bundles & Upsell ("the App"), a Shopify application designed to help e-commerce merchants configure volume discounts, tiered pricing, and automated bundles.

We are committed to maintaining the highest standards of data privacy, security, and transparency. This Privacy Policy outlines what information we collect, why we collect it, how it is stored, and your rights under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and Shopify’s Partner Program Requirements.

2. Information We Collect

When you install and authorize Stackr from the Shopify App Store, we access specific store information authorized by your permissions:

  • Merchant Information: Store permanent domain (e.g. store.myshopify.com), merchant contact email, shop currency, and shop timezone.
  • Product Catalog Data: Product titles, variant IDs, SKU codes, prices, and inventory availability to enable bundle creation and tier calculations.
  • Discount & Cart Information: Cart line items and promotional discounts applied via Stackr to verify volume tier eligibility.
  • Aggregated Analytics: Bundle impression counts, add-to-cart clicks, and upsell revenue generated. This data is strictly aggregated and non-identifiable.
We Do NOT Collect Sensitive Personal Data: Stackr does NOT process or store customer credit card numbers, payment credentials, personal home addresses, or customer identity information. All checkouts are processed exclusively through Shopify’s secure native checkout engine.

3. How We Use Collected Data

We process information solely for the following operational purposes:

  • To display customized volume discount tiers, BOGO offers, and bundle builders on your storefront.
  • To sync automated discount rules with Shopify’s native checkout and cart APIs.
  • To present performance analytics (AOV lift, conversion rate, total upsell revenue) in your merchant admin dashboard.
  • To provide customer support, troubleshoot theme extension conflicts, and release feature updates.

4. Data Sharing & Third Parties

ConfirmFlow does NOT sell, rent, monetize, or trade your store data or customer data to advertisers, data brokers, or third parties under any circumstances.

We only share data with trusted infrastructure service providers strictly required to host and run the application:

  • Hosting & Cloud Infrastructure: Highly secure cloud VPS and database servers with automated TLS 1.3 encryption at rest and in transit.
  • Shopify APIs: For token authentication, theme app extension assets delivery via Shopify CDN, and webhook processing.

5. Compliance with Mandatory Shopify Webhooks

In accordance with Shopify Partner requirements, Stackr fully implements and responds to mandatory privacy webhooks:

  • customers/data_request: If a customer requests their data via your store, we retrieve and provide any associated bundle usage logs.
  • customers/redact: When a customer deletion request is issued, we permanently purge any identifiable reference within 48 hours.
  • shop/redact: 48 hours after an app uninstall, our automated system erases all merchant store tokens, bundle campaigns, and associated database records.

6. Security & Data Retention

We employ industry-standard administrative, technical, and physical security measures to safeguard all stored records. All communication between Shopify, your store, and our servers is strictly encrypted using HTTPS / TLS 1.3.

Data is retained only as long as you maintain an active installation of Stackr. Upon app removal, records are scheduled for complete deletion pursuant to Shopify's shop/redact protocol.

7. Contact Information

If you have any questions about this Privacy Policy, your rights, or wish to exercise data subject rights, please contact our data protection team: