Privacy Policy — Bundle Guard
Who we are. Bundle Guard ("the app") is operated by Matthew Schafer (operating as ARO PCRM), reachable at support@aro-pcrm.com.
What we collect. The app stores only: your shop domain, the app's session tokens, your app settings, the bundle structure and component inventory data (product/variant IDs and titles, SKUs, quantities, inventory levels and policies), and a log of actions the app performed. The app requests read_products, read_inventory, write_products and read_orders. The only thing it ever writes is the status (Active/Draft) of a bundle you switched Auto-protect on for; nothing else in your catalog is touched. Order history is read only as line-item variant IDs and quantities from the last 30 days, to forecast when a bundle will run out; no customer names, emails or addresses are read or stored.
What we never collect. No customer names, emails, addresses, orders, payment data, or analytics identifiers. The app has no storefront component and sets no cookies for your shoppers.
How we use it. Solely to provide the features you configured: showing expiry status, sending your digest email to the address you chose, and applying the tagging/unpublishing automations you enabled. Nothing is sold, shared, or used for any other purpose.
Where it lives. On the app's server database. Digest emails are delivered via our email provider. Data is encrypted in transit (TLS).
Retention & deletion. Uninstalling the app stops all processing. When Shopify sends the shop/redact webhook (48 hours after uninstall), every record for your shop is permanently deleted. You can also email us for immediate deletion.
If you uninstall. We send one email to the store owner's address asking why you left, with one-click answers. We keep that address only until you answer or until Shopify's shop/redact notice arrives (48 hours after uninstall), whichever comes first; the answer itself is kept without your shop or address. Reply to that email or write to us to have the address deleted sooner.
GDPR/CCPA webhooks. customers/data_request and customers/redact are acknowledged automatically; since the app stores no customer data, there is nothing to return or erase. shop/redact triggers full deletion as above.
Changes. We'll update this page and the effective date if practices change.