Packtier - Privacy Policy

Effective date: 31 August 2026

Packtier is a Shopify app that shows a quantity-tier ("buy more, save more") widget on the product page and makes sure the bundle the shopper chose reaches the cart, checkout and order unchanged. This policy explains what data the app processes and how.

1. Who is responsible

The Shopify merchant who installs Packtier is the data controller. Packtier (operated by the app developer) acts as a data processor on the merchant's behalf and only processes data to provide the app's features.

2. What data Packtier processes

From the Shopify Admin API (read access unless noted):

• Product, variant and collection data, and inventory levels - to build offers and check availability.
• Orders (read only) - to attribute added revenue for analytics and to count bundle orders for billing.
• Shop locales, markets and translatable offer text - for multi-language / multi-currency display.
• Theme templates (read only) - the health check confirms the widget block is installed. Packtier never writes to your theme.
• Offer configuration stored as Shopify metaobjects and app-owned metafields.

From the storefront (via a Shopify web pixel and the app's own beacon):

• A pseudonymous visit identifier (visitId), a random value stored in the visitor's browser and rotated every 24 hours. It lets Packtier count widget views and bundle conversions without identifying anyone.
• Aggregated widget, cart and checkout events (view, tier change, bundle added, bundle purchased) with coarse counters only.

3. Why Packtier processes this data

• To render the quantity-tier widget and price it correctly.
• To reassemble and re-price the bundle on Shopify's servers so cart, checkout and order all match.
• To give the merchant analytics (visits, bundle orders, conversion, added revenue).
• To bill the merchant based on the number of orders that contain a bundle - a figure the merchant can verify in their own order list.

4. Legal basis

For the merchant as controller: performance of the contract with the merchant, and legitimate interest in aggregate store analytics. Packtier processes personal data only under the merchant's instructions.

5. Retention

• Daily analytics aggregates: kept while the app is installed.
• Pixel de-duplication rows (visitId + event type): 7 days, then deleted automatically.
• Resolved health / alert log entries: 90 days.
• Billing event log: 450 days (so the merchant keeps over a year of self-serve billing history).
• Webhook delivery log (no personal data): 30 days.
• Everything for a shop is deleted on shop/redact(~48 hours after the app is uninstalled).
• A GDPR request audit record (ComplianceLog) is retained as an accountability record. It contains only a shop domain, a webhook topic, timestamps and row counts - no personal data. The Shopify customer id, when present, is stored only as a keyed one-way digest.

6. Hosting and sub-processors

Packtier runs on Hetzner Cloud infrastructure located in Germany (EU), managed with Coolify. Each Packtier app uses one dedicated PostgreSQL database, isolated from other apps.

7. Shopify mandatory privacy webhooks

Packtier implements the three required Shopify webhooks:

• customers/data_request - Packtier holds no shopper personal data. The only records that can relate to a customer are order identifiers used for revenue attribution and billing; those are returned.
• customers/redact - the billing usage rows that reference the redacted orders are anonymised in place (identifiers stripped; the bundle count and billing period are kept so the merchant's usage total stays auditable). No other shopper-linked data exists to delete.
• shop/redact - all Packtier data for the shop is deleted (offer index, analytics aggregates, pixel de-dup rows, A/B assignments, billing usage, alert and admin-notice logs, sessions, the shop record). Only the PII-free accountability log is retained.

8. Data subject rights

Shoppers exercise their rights through the merchant. The merchant can trigger the webhooks above from the Shopify admin, and can contact Packtier directly at support@modulehub.dev.

9. Contact

Privacy questions and general support: support@modulehub.dev (see the support page)

10. Changes to this policy

If Packtier changes how it handles data, the effective date above is updated and merchants are notified with an in-app notice before the change takes effect.