This Privacy Policy explains how KLYX ("we", "us", "our") collects, uses, and protects information when you install and use the KLYX Bundler Shopify application ("the App"). By installing the App, you agree to this policy.
1. Information We Collect
When you install and use the App, we collect the following information:
- Store domain and owner email — to identify and authenticate your Shopify store.
- Shopify OAuth access token — stored encrypted to make API calls on your behalf. Never exposed in plain text.
- Offer configurations — the volume discount, bundle, Buy X Get Y, Mix and Match, Spend X Get Y, and Build Your Own offers you create, stored as Shopify metaobjects and in our database, including the products, collections, and discount rules you configure.
- Product, collection, and discount data — read via the Shopify Admin GraphQL API to let you select products/collections for offers and to create the corresponding native Shopify discount functions.
- Order data — read where needed to evaluate cart spend thresholds for Spend X Get Y offers.
- Theme app extension settings — the widget configuration you set in your theme editor (placement, styling preferences).
- Basic usage analytics — offer views and conversions, used to power the in-app Analytics page for your own offers only.
2. How We Use Your Data
We use collected information solely to provide the App's services:
- Create, update, and run volume discount, bundle, BXGY, Mix and Match, Spend X Get Y, and Build Your Own offers on your store.
- Create and manage the native Shopify Functions discounts that apply your offers at checkout.
- Render the storefront offer widget via the Theme App Extension with the correct products, pricing, and bundle contents.
- Display offer performance analytics in the app dashboard.
- Process Shopify billing, if and when paid plans are introduced, via the Shopify Billing API.
We do not sell, rent, or share your data with third parties for marketing purposes.
3. Data Storage & Security
- Encryption at rest: OAuth access tokens are encrypted before being stored in the database.
- Database: Offer configurations and app data are stored in a PostgreSQL database hosted on our own infrastructure (Dokploy VPS), accessed only over encrypted connections.
- Transmission: All data is transmitted over HTTPS only. No unencrypted connections are permitted.
- Isolation: All database queries are scoped to your shop — merchants cannot access other shops' data.
4. Data Retention
- Active offers: Offer configurations persist for as long as the App remains installed on your store.
- Upon uninstall: All your shop data is scheduled for deletion within 30 days of uninstalling the App, per our GDPR uninstall webhook handler.
- Customer data processed via Shopify GDPR webhooks is handled per the timelines in Section 6 below.
5. Third-Party Services
The App relies on the following third-party infrastructure. Each has its own privacy policy:
- Dokploy (self-hosted VPS infrastructure) — Application and database hosting for the App's backend.
- Shopify — Platform APIs (Admin GraphQL, Functions, Billing) that the App is built on. shopify.com/legal/privacy
6. GDPR Compliance
For merchants and customers in the European Economic Area (EEA), we respect all rights under GDPR:
- Right to access — Contact us to receive a copy of all data we hold for your store.
- Right to rectification — Contact us to correct inaccurate data.
- Right to erasure — Uninstall the App to trigger deletion, or contact us to request complete deletion at any time.
- Right to portability — Contact us for a machine-readable export of your offer configurations.
- Right to object — Object to certain types of processing by contacting us.
We fully support all three mandatory Shopify GDPR webhooks: customers/data_request, customers/redact, and shop/redact.
To exercise any of your GDPR rights, contact us at contact@klyx.agency.
- Email: contact@klyx.agency
- Phone: +91-8279555123
- Developer: KLYX — klyx.agency
- Address: Durga Vihar, Lane no 4, Vikasnagar, Dehradun - 248198, Uttarakhand, India