Privacy Policy — BundleBoost

Last updated: November 1, 2026

BundleBoost ("the App") is provided by Outernest (outernest.co.uk) ("we", "us"). This policy explains what information the App accesses, how it is used, and your rights. It applies to merchants who install the App and to their customers.

Information the App accesses

From merchants (store owners and staff)

• Basic store information provided by Shopify when you install the App, such as your store domain and currency.
• A login session for the App inside Shopify admin (session and access tokens, and, if Shopify provides them, the staff member's name, email and locale). This is used only to authenticate requests from the Shopify admin.
• Product, variant and collection names, images and prices, read only to show them in the deal editor, to build your deals and to check that a deal doesn't use a gift card.

Deals and settings you create (offers, bars, discounts, texts, colors and widget settings) are stored in your own store, as app-owned Shopify metaobjects, metafields and discounts. They are not stored on our servers.

On our servers we keep only:

• your store domain, install and uninstall dates and plan;
• deal analytics: for each deal, counts of views, clicks and add to carts, with the deal ID, the event type and the time.

From your customers The App does not collect, store or sell personal information about your customers. Discounts are calculated inside Shopify's own infrastructure (Shopify Functions). The storefront widget runs in the customer's browser and talks to your store's own cart. When a deal is viewed, clicked or added to the cart, the widget sends only the deal ID and the event type to us through your store's app proxy. Shopify may add the logged-in customer's ID to app proxy requests; we don't store it. The widget sets no cookies; it keeps a note in the browser's session storage so each view or click is counted once per visit.

How we use information

• To provide the App's features: building deals, applying discounts, showing the widget on your storefront and showing analytics in the App.
• To authenticate staff using the App.
• To respond to support requests you send us.

We do not sell information, use it for advertising, or share it with third parties except our hosting provider (Hostinger), which stores the App's database on our behalf. Like any web host, it may keep standard request logs (such as IP addresses) for security and troubleshooting.

Retention and deletion

• Login sessions are deleted when you uninstall the App.
• Your store's analytics are kept for 48 hours after uninstalling, so a quick reinstall keeps them. Shopify then sends us a shop/redact request and we delete all remaining data for your store.
• Deals and settings stored in your store are managed by Shopify; app-owned data is removed by Shopify when the App is uninstalled.
• Because we hold no customer personal data, customer data and deletion requests (customers/data_request, customers/redact) require no action beyond confirming this.

Security

Data is transmitted over HTTPS. Access to the App is authenticated through Shopify, and storefront events are accepted only when Shopify's app proxy signature is valid.

Your rights

Depending on where you live (for example under the GDPR or CCPA) you may have the right to access, correct or delete your personal information. Contact us at the address below. Merchants can also uninstall the App at any time.

Changes

We may update this policy. Material changes will be announced in the App.

Contact

Outernest — outernest.co.uk
13 Shakespeare Road, Luton, LU4 0HT, United Kingdom
Email: outernestshop@gmail.com