Last updated: July 29, 2026 · Effective: July 29, 2026
This Privacy Policy explains how OSS Commerce ("OSS Commerce", "we", "us", "our") collects, uses, and protects information through the OSS Bundles app (the "App"), a tool distributed on the Shopify App Store. This policy is designed to comply with GDPR, CCPA, and Shopify's requirements, and applies to both merchants who install the App and their customers who interact with a store using it.
When you install the App, we receive your shop's basic information (myshopify domain, shop name, plan, contact email) and store an access token issued by Shopify so the App can act on your behalf. We also store your App configuration — bundle definitions, discount rules, storefront styling, and onboarding progress.
The App accesses the following data from your store through Shopify's Admin API, limited to what it needs to function:
The App's theme app extension records anonymous impression, view, click, add-to-cart, and purchase events tied to a bundle, product, and session — used solely to power your in-app analytics dashboard. These events are not linked to a named customer and contain no customer contact information.
Your selected plan and subscription status are managed entirely through Shopify's billing system. We never receive or store payment card details.
Like most web applications, our servers log IP addresses, browser type, request timestamps, and error information for security and debugging purposes.
We do not sell data, and we do not use it for advertising purposes.
We share data only with providers who help us operate the App, under confidentiality obligations:
We may disclose information when required by law, legal process, or to protect our legal rights, or those of our merchants or users.
Data is encrypted in transit (TLS) between your browser, Shopify, and our servers. Access to your store is authenticated using Shopify session tokens and OAuth — we do not rely on third-party cookies or browser local storage for authentication. Access to stored data is restricted on a role and need-to-know basis.
We retain store data for as long as the App remains installed, so your bundles and analytics continue to work. If you uninstall the App, we stop accessing your store. In accordance with Shopify's mandatory GDPR webhooks, we permanently delete a shop's data upon receiving a shop redaction request, and delete or anonymize a specific customer's data upon receiving a customer redaction request.
Merchants may request access, correction, deletion, or a copy of their data, or ask us to restrict processing, by contacting us using the details below.
Customers of a store using the App should contact that merchant directly first, since we process customer data on the merchant's behalf. Data requests and deletions are also handled automatically through Shopify's standard customer data request and redaction webhooks.
Where data is transferred internationally, we rely on appropriate safeguards, such as Standard Contractual Clauses, to protect it in accordance with applicable law.
The App is not directed at children and we do not knowingly collect personal data from children under 13 (or 16 in the EU). If we learn we have inadvertently collected such data, we will delete it promptly.
The App is embedded in the Shopify admin and authenticates using Shopify session tokens, not third-party cookies. Our storefront-facing components may use essential, non-tracking browser storage to power bundle display and analytics.
California residents have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information. To exercise these rights, contact us using the details below.
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.
OSS Commerce
Rua Torlogo Dauntre, 74, sala 1207
Campinas, SP, 13025-270, Brazil
Questions about this policy or how we handle your data can be sent to [email protected].