Summary
- We keep your store domain, an access token, the offers you create, and your widget settings.
- We can read your products and orders and manage discounts. From each order we keep only its totals, currency, date and the Kitalo discounts it used, for your offer reports. We cannot read your customers.
- We collect no personal data about your customers.
- The storefront script sets no cookies, does no tracking, and sends no data to us or anyone else.
Who we are
Kitalo: Bundles & Discounts is a Shopify app built and operated by CleverBooster (“we”, “us”). This policy explains what information the app handles when a merchant installs it, and what happens on the merchant’s storefront. Questions can be sent to admin@cleverbooster.com.
Information we collect
When you install the app, Shopify shares the following with us, and we store it:
| Data | Why | Where it lives |
|---|---|---|
| Store domain (e.g. your-store.myshopify.com) | To know which store a request comes from | Our session database |
| Access token, its expiry, and granted scopes | To save your settings through Shopify’s API | Our session database |
| Offers you create: names, discount rules, schedule, texts, and the IDs, titles, handles and images of the products and collections you pick | To create the matching Shopify discounts and show offers on your storefront | Our database, and a copy of active offers in a metafield of your store |
| For each new order: order ID, creation date, currency, subtotal, total, and the Kitalo discounts it used (offer, code, amount). No customer, address or product details. | To report how your offers perform (in the app and when you ask Shopify Sidekick) | Our database |
| Widget settings (colors, corner radius, custom CSS) | To style the offer box and progress bars | Our database, and the same store metafield |
The app requests the write_discounts, read_products and read_orders scopes. It receives new orders through Shopify's order webhook and keeps only the fields listed above; it cannot read your customers. If you use Shopify Sidekick, Kitalo answers it with your offers and these order totals, inside your Shopify admin. Paid plans are billed by Shopify; we never see payment details.
Your storefront visitors
The offer widgets run entirely in your visitors’ browsers. The script is served from Shopify’s CDN, reads offers from your store’s own data, and talks only to your store (its cart, product and Storefront API endpoints). It:
- does not set cookies; it uses session storage only to remember a gift the shopper removed and which collections cart products belong to, cleared when the browser tab closes;
- does not track, profile, or fingerprint visitors;
- makes no network requests to us or to any third party.
Discounts are calculated by Shopify at checkout. If you target an offer to customer segments or markets (Pro), Shopify applies that rule; customer information never reaches us.
How we use information
We use the store domain and access token only to authenticate you in the app admin and to create, update and remove the discounts and data the app manages in your store. We do not sell, rent, or share this information, and we do not use it for advertising.
Service providers
The app runs on Shopify’s platform and on a cloud hosting provider that stores our database. These providers process data only to run the app, under their own security and privacy commitments. We do not use analytics or advertising services.
Retention and deletion
- When you uninstall the app, we delete your session records at once.
- When Shopify sends the shop redaction request (48 hours after you uninstall), we delete your offers, settings and stored order totals.
- Shopify removes the app’s discounts, metafields and theme embed from your store automatically.
- We honor Shopify’s privacy webhooks (customer data requests, customer redaction, and shop redaction). Because we store no customer data, customer requests have nothing to return or delete.
Security
All traffic to the app is encrypted with HTTPS. Access tokens are stored only in our database and are used only to call Shopify’s API on your behalf. Requests from Shopify, including webhooks, are verified before they are processed.
Your rights
Depending on where you live, laws such as the GDPR and the CCPA give you the right to access, correct, or delete your personal information, and to object to its processing. To exercise these rights, email admin@cleverbooster.com. Uninstalling the app also deletes the data we hold about your store.
Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change affects how your data is handled, we will tell you inside the app before it takes effect. See also our terms of service.
Contact
Questions about privacy: admin@cleverbooster.com.