How this app handles your data

Who is responsible for what

You are the controller of your store's data. FourCore is a processor: the app handles that data on your instructions, for the purpose of running the bundle offers you configure, and for nothing else. We do not sell data, we do not share it for advertising, and we do not use one merchant's data to serve another.

Shopify is the source of most of what the app sees. Its own privacy policy governs the data while it is in Shopify's hands.

What the app stores

The app asks Shopify for the access scopes listed below and keeps only what it needs to draw and price an offer.

Access scopes requested: read_products, read_inventory, read_themes, read_markets, read_locales, read_orders, write_discounts, write_files, write_cart_transforms, write_pixels. write_discounts creates the Shopify discount function that applies your offers in the cart and at checkout; write_pixels installs the pixel that reports checkouts started with a bundle in them; write_cart_transforms is held for a bundled-product feature and is not in use today.

Your customers' data

The app stores no customer personal data. It does not request Shopify's protected customer data, and no name, email, address or phone number is written to its database at any point.

Order events are recorded as an order id, a total, and which deal was involved — figures attached to an order, not to a person. The three mandatory Shopify privacy webhooks are implemented: customers/data_request and customers/redact have nothing to return or erase, because nothing customer-identifiable is held; shop/redact deletes the store's deals, analytics, translations and settings outright.

What the storefront widget does on a shopper's browser

• No cookies and no cross-site tracking. The widget sets one value in localStorage: a random string that keeps a shopper on the same side of an A/B test and lets a view and an add-to-cart be counted once rather than twice. It is tied to no person and is not shared with anyone.
• A countdown timer, when you switch one on, also stores its end time locally so the clock does not restart on every page view.
• Offer views and add-to-carts are sent to the app through your own store's domain, as an app proxy request. No third-party analytics or advertising script is loaded on your storefront.

AI features

Two features send data to Anthropic, and only when you use them.

Start from an image

When you build a deal from a picture, the image you choose and a list of your product titles and prices are sent to Anthropic's API so a bundle can be drafted from them. Nothing is sent unless you press the button, and Anthropic does not train its models on API inputs.

Editing your widget with an AI assistant

If you create an API key for an AI tool, that tool can read and change your deals through the app's MCP endpoint, with your key. What it sees is what you gave it access to: your deals, their layout templates and your product list. Revoke the key in Settings and that access ends.

Who else touches your data

If your store is in the EEA or the UK, data reaching these providers is transferred to the United States under the standard contractual clauses each of them offers.

How long anything is kept

• Uninstall deletes your access token and session immediately, which ends the app's ability to read anything from your store.
• Deals and analytics stay for up to 48 hours after uninstall, so that reinstalling within that window brings your deals back rather than starting you from nothing. Shopify's shop/redact request, which arrives 48 hours after uninstall, deletes them.
• Deleting a deal in the app removes it and its analytics at once.
• Analytics rows are kept for two years, then deleted — long enough to compare a season with the two before it, and no longer. A row holds a bundle's own figures and the id of the order they came from; when Shopify asks us to redact a customer, the order id and visitor id on their orders are erased, leaving the merchant's totals with nothing to trace them back to anybody.
• Server logs, which hold request metadata rather than store data, are kept by Vercel for up to 30 days.

Security

• All traffic runs over HTTPS.
• The embedded admin authenticates every request with a Shopify session token; there is no cookie-based fallback to attack.
• Every webhook is verified against Shopify's HMAC signature before it is acted on.
• API keys for AI tools are stored hashed, never in plain text.
• Access to the production database is limited to the app's maintainers.
• Found a weakness? Tell us at support@fourcore.dev before telling anyone else, and we will fix it and credit you.

Your rights, and how to exercise them

Depending on where you are, you may have the right to access, correct, export or erase the data held about you, to restrict or object to its processing, and to complain to your data protection authority. For store data, the fastest routes are in the app itself: delete a deal to remove it and its analytics, or uninstall to end access altogether.

For anything else — a copy of what is held, an erasure that cannot wait for the uninstall window, or a question about this policy — email support@fourcore.dev and we will respond within 30 days.

Changes to this policy

If what the app collects changes, this page changes with it and the effective date at the top moves. Material changes are announced in the app before they take effect.

Contact

Instant Product Bundles is built and operated by FourCore. Write to support@fourcore.dev with anything about this policy, a request to see or delete what is held about your store, or a data protection question. We answer within 30 days, and usually a good deal sooner.