Privacy
1. Who we are
iUROP Bundles is an app for Shopify stores that creates packs, multipack formats, build-your-own boxes, volume discounts, frequently-bought-together offers and upsells. It is provided by:
Controller: iUROP SLU
Tax registration number (NRT): L-717465-P
Address: Carrer Prat de la Creu 59-65, Escala D, Planta 1, 4DEF, Espai 2, AD500 Andorra la Vella, Andorra
Contact (privacy included): contact@iuropagency.com
In this policy, “we” means iUROP SLU; “you” or “the merchant”, the person or company that installs the app on their store; “your customers”, the people who buy in your store. We process data under Andorra’s Qualified Law 29/2021 of October 28 on personal data protection and, where applicable, Regulation (EU) 2016/679 (GDPR). Andorra has an adequacy decision from the European Commission.
For your customers’ data that reaches us through Shopify, you are the controller and we act as processor, following your instructions (the ones you give when setting up the app) and Shopify’s terms for apps.
2. What data we process
When you install the app you give us permission, through Shopify, to read and write only what is needed:
Products (read_products, write_products)
Read your products and create or update pack products, boxes and multipack variants.
Inventory and locations (read_inventory, write_inventory, read_locations)
Work out and set the stock of formats and packs from their products’ stock.
Discounts (write_discounts)
Create the automatic discount of each offer.
Cart transform (write_cart_transforms)
Break packs, boxes and formats into their products in the cart and the order.
Sales channels (read_publications, write_publications)
Publish pack products and boxes on your channels.
Orders (read_orders)
Know which orders include a bundle, for analytics.
Specifically, we store:
Store data: the
.myshopify.comdomain and the interface language.Your bundles’ setup: name, type, products, prices and discounts, dates and settings, plus the IDs of what the app creates in Shopify (discounts, products, variants).
Sales totals for analytics: per day, the number of paid orders and their amount, for the whole store and for each bundle (amount, discount and A/B test group), and what was refunded per bundle by refund date. Shopify sends us the order when it is paid, and the first time you open the analytics we read the orders of the last 60 days; from each order we only add its amounts to the day’s total. We don’t store individual orders, order numbers or your customers’ personal data (name, email, address, phone or payment data). So as not to count one Shopify notice twice, we keep its technical ID for 7 days.
Anonymous storefront statistics: when a shopper views an offer or adds it to the cart, the app’s blocks send only the bundle ID, the event type (“view” or “add to cart”) and, if they take part in an A/B test, their group (A or B). We store no identifier of the shopper or their device.
A/B tests: if you run an A/B test and the shopper accepts your store’s analytics cookies (Shopify’s customer privacy API), the blocks store in their browser (
localStorage, keyiurop_ab) whether they see version A or B, so they always see the same one. Without that consent nothing is stored and they see version A.Access credentials: the token Shopify gives us to act on your store. It is a store access, not a person’s.
AI assistant connections (if you use them, section 4): the name of the assistant you connect, when it was last used and its credentials, which we store only as a one-way hash: they can’t be recovered from our database.
Technical logs: the usual server logs (time, IP address and path of requests) and error logs. They are deleted on their own as their reserved space fills up.
3. What we use them for, and on what basis
Providing the service you sign up for (creating and keeping your offers in Shopify, showing you their analytics): performance of the contract.
Billing through Shopify: performance of the contract.
Security, abuse prevention and fixing errors: legitimate interest.
Legal obligations (for example, tax): legal obligation.
We don’t sell data, don’t use it for advertising and don’t profile your customers.
4. Who we share them with
Shopify
What the app creates in your store; billing
It is your platform
Under your agreement with Shopify
OVH (hosting)
Everything described in section 2
Hosting the app and its database
France (European Union)
Google (Google Drive)
A daily, encrypted copy of the database: Google can’t read its contents
Keeping a backup outside our server
Google’s servers, under its data processing agreement
AI assistants (MCP). If you connect an AI assistant (for example Claude, ChatGPT/Codex or Cursor), that assistant can read and change your bundles, search your products and see the analytics, only when you ask it to and with the access you approve inside Shopify. You can disconnect it at any time in “Connect AI”.
You choose and contract the assistant: what we send it (product, bundle and analytics data, never your customers’ personal data) is processed by its provider under your agreement with them. iUROP Bundles doesn’t send data to any AI provider on its own.
If we ever add a new provider, we will say so in this policy before using it (section 9). We may disclose data to authorities when a law requires it.
5. How long we keep them
While the app is installed: everything needed to provide the service.
When you uninstall: we stop accessing your store and disconnect AI assistants at once. Shopify removes the app’s discounts and pack breakdown. The products and variants the app created stay in your store.
48 hours after uninstalling, Shopify sends us the
shop/redactnotice and we delete all your store’s data from our database: bundles, analytics, settings, connections and credentials.Backups: the database has a daily copy on our server, kept for 14 days, and an encrypted one outside it (the last 2 are kept). Deleted data disappears from the copies as they expire.
Shopify issues the subscription invoice; we keep no separate billing data.
6. Your customers’ privacy requests
Shopify forwards us your customers’ access and deletion requests (customers/data_request and customers/redact). Since the app stores no customer personal data, there is nothing to hand over or delete: we reply to Shopify confirming receipt. All these calls are verified with Shopify’s signature.
7. Security
Encrypted connections (HTTPS) between your store, Shopify, our server and AI assistants.
Access to your store only with the token Shopify gives us and only with the permissions in section 2.
AI connections are approved inside the Shopify admin and can be disconnected from the app; the ones connected by signing in expire and renew on their own. We store their credentials only as a hash.
The server can only be accessed with cryptographic keys (never a password) and the database can’t be queried from outside the server.
Discounts and the pack breakdown run inside Shopify (Shopify Functions). The theme blocks set no cookies and only store the A/B group in the browser when the shopper has accepted analytics cookies.
8. Your rights
You can ask us for access, rectification, erasure, objection, restriction and portability of your data by writing to contact@iuropagency.com. Uninstalling the app triggers full deletion after 48 hours (section 5); if you want us to delete sooner, write to us.
If you think we haven’t handled your data properly, you can complain to the Andorran Data Protection Agency (APDA, www.apda.ad) or, if you live in the European Union, to your country’s data protection authority.
9. Changes to this policy
If we change something important (for example, a new provider), we will tell you inside the app before it applies and update the date above.