Rethink Bundles is a Shopify app that lets merchants build product bundles and offers. It does not read or store shopper names, email addresses, phone numbers, or postal addresses. To report how bundles perform, it keeps anonymous usage counts, described below.The data controller for the app is Rethink Software, LLC.Last updated: 17 October 2026.When a merchant configures a reward rule, the app's discount function reads the following about the signed-in shopper at the moment their cart is priced:Number of previous ordersLifetime amount spentWhether the shopper carries the customer tags the merchant named in the ruleWhen a merchant limits a bundle's pop-up to past buyers, the bundle builder also checks, while Shopify builds the store page, whether a signed-in shopper has at least the number of previous orders the merchant set. Only that yes or no reaches the page, to decide whether the pop-up can show; the order count itself is not sent to the app. Against the anonymous token only, the app's measurement records whether the pop-up could show for that visit, which for such a pop-up reflects that yes or no.These values decide which reward the shopper qualifies for and, for the pop-up, whether it can show. They are used for nothing else. The app does not read shopper names, email addresses, phone numbers, or postal addresses, and it does not request access to those fields.Shoppers who are not signed in match no customer-based rule and receive the merchant's default reward.When a merchant adds a short quiz to a bundle's reward (a free gift or a scratch card), the shopper's answers travel with the order as line item properties. When that order is paid, the app reads the order's customer reference and adds the answers to the shopper's customer record in Shopify as tags, so the merchant can segment customers in their own admin. The app keeps neither the answers nor the customer reference; the tags live in the merchant's Shopify store, where the merchant can remove them.When a shopper visits the merchant's store, the app's storefront script keeps a random identifier in the shopper's browser storage. The browser generates it; it is not derived from a name, an email address, an IP address, or an account, and it is sent to no one but the app.Against that identifier the app records that a bundle was seen and that it was added to the cart, with the bundle and the time. It also records each page view, through the theme app embed when the merchant enables it and through a Shopify web pixel otherwise: the kind of page (home, product, collection, other), where the visit came from (a search engine, a named social network, direct, or other), and whether the device is a phone. The page address and the full referring address are never recorded. Nothing about the shopper's name, contact details, address, or location is recorded.The script sends nothing until the store's Shopify customer privacy settings report that analytics processing is allowed for that shopper. Where a merchant shows a cookie banner, nothing is sent until the shopper accepts, and a refusal is honoured.These records are deleted after 90 days. The daily totals derived from them contain no identifier and are kept while the app is installed.When an order containing a bundle is paid, the app records the order's identifier, the bundle involved, and the amounts needed to bill the merchant for usage. This is how merchant billing is calculated. For analytics it also records, for every paid order, the order total, whether the buyer had ordered before (a yes or no, never who they are), and the anonymous visitor identifier when the cart carried it, so the merchant can see that a visitor who saw a bundle later bought. That identifier is removed from the order record after 90 days. No shopper identity is recorded.To measure bundle widgets and learn which version works best for which audience, the app's storefront scripts keep an anonymous random token in the shopper's browser and record, against that token only: widget views and add-to-cart clicks, and how the visit arrived (the landing page path, any UTM tags on the link, the referring website's host name, whether an ad click id such as gclid or fbclid was present, and phone vs desktop from the screen width). The same arrival details can decide, in the shopper's browser, whether a bundle's pop-up is shown to them. The token is not linked to a name, email address, customer account, or order, and nothing is shared with any third party. Merchants can turn the every-page arrival tracking off by disabling the Rethink arrival tracking app embed in their theme.When a bundle's pop-up asks the shopper a few questions, the answers are used only in the shopper's browser, to pick products for their box. The answers themselves are never stored, never sent to the app or anyone else, and never added to the shopper's customer account as tags. Against the anonymous token, the app records that the questions were started and finished and, as for any product added in a bundle builder, which products the shopper then added to their box. Because the pop-up picks those products from the answers, they can hint at the answers given. The reward quiz described earlier is different: its answers do become customer tags.This measurement honours the store's cookie consent settings through Shopify's Customer Privacy API: where a shopper has not allowed analytics, nothing is stored in their browser or sent to the app, and they see the bundle as it is configured today. Known bots and automated browsers are excluded the same way.The shopper fields read for reward rules are read at the moment they are needed and are never written to the app's database. The anonymous measurement and visitor records described above are deleted after 90 days.Merchant configuration (bundles, rules, and settings) and the usage records used for billing are kept while the app is installed. When a merchant uninstalls, the app deletes its stored sessions for that shop at once and stops processing. Forty-eight hours later Shopify sends the app a shop data erasure request, and the app then deletes every record it holds for that shop.When a shopper asks a merchant for their data or for its deletion, Shopify notifies the app. For a data request the app records the request (the shop, Shopify's request reference, the shopper's customer reference and the orders named) together with a snapshot of the records it holds about that shopper, so the merchant can be answered. For a deletion request the app removes the shopper's customer reference from the usage records it must keep for billing, deletes every other record about that shopper, and clears the anonymous visitor identifier recorded against the orders named.The app does not sell, rent, or share shopper or merchant data with any third party. Data moves only between the merchant's Shopify store and the app.All traffic runs over HTTPS. The app's database is encrypted at rest and is not reachable from the public internet. Backups are encrypted with it.Merchants can ask what data the app holds for their shop, or ask for it to be deleted. Uninstalling the app stops all data processing for that shop.Contact: nikil@rethinkbundles.com