Redjam Bundles reads no orders, no customer accounts and no payment information. It stores your offer configuration and the token that lets it act on your store, and nothing else.
1. Who processes your data
OA Digital, a sole proprietorship registered in France under SIREN 889 803 060, based in Marseille, France.
Contact: support@redjambundle.com
2. What the app processes
The app collects no personal data about your customers. It cannot read orders, customer accounts or payment details, and it does not request any of the Shopify permissions that would grant that access.
| Data | Why | Retention |
|---|---|---|
Store domainexample.myshopify.com |
Identify the store and attach its configuration to it. | Until uninstall, then 48 hours. |
| Access token issued by Shopify | Act on the store on your behalf: create the discount, write the product metafield the widget and discount function read. | Deleted on uninstall. |
| Your offer configuration (tiers, products, collections) |
Display your offers and apply the discount. | Until uninstall, then 48 hours. |
| Server logs | Diagnose failures. They contain IP addresses and timestamps, never order contents. | 30 days. |
3. Legal basis
Processing rests on performance of the contract formed when you install the app (GDPR article 6.1.b). Without this data the app cannot work.
4. Who else has access
Three processors, all located in the European Union:
| Provider | Role | Location |
|---|---|---|
| Shopify Inc. | Source platform for the data | Per your store |
| Fly.io | Application server hosting | Paris, France |
| Neon | PostgreSQL database | Frankfurt, Germany |
No data is sold, rented, or passed on for advertising. None is transferred outside the European Union by us.
5. Cookies
The app's admin interface uses no advertising or analytics cookies. Authentication runs on Shopify session tokens. The storefront widget sets no cookie and sends no request to our servers: offers are rendered with the page, from Shopify's own product data.
On this marketing site, we measure traffic with Google
Analytics (measurement ID G-0Q1MXDQS4S), and only with your
agreement. Until you accept in the banner shown on arrival, no Google
script is loaded, no cookie is set and no data — not even your IP
address — is sent. If you accept, Google sets measurement cookies
(_ga, _ga_*, kept for up to thirteen months)
used to count visits and see which pages are read. None of it is used
for advertising.
On this marketing site, the demo page shows a still image until you
click it. On click, and only then, the video is loaded from YouTube in
privacy-enhanced mode (youtube-nocookie.com), which at that
point sends your IP address to Google. If you do not play the video, no
data is sent to that service.
6. Erasure
On uninstall your session is deleted immediately. Shopify notifies us 48 hours later, and all of your bundles and offers are then erased from our database.
The app answers the three mandatory Shopify compliance webhooks: customer data request, customer redaction, and shop redaction.
7. Your rights
You have the right to access, correct, erase, restrict and port the data concerning you. Write to support@redjambundle.com — we answer within 30 days.
You may also lodge a complaint with the French data protection authority, the CNIL.
8. Security
Traffic between your browser, Shopify and our servers is encrypted with TLS. Access tokens are stored server-side and never exposed to the browser. Every webhook received is verified by its HMAC signature before being processed.
9. Changes
Any change to this policy will be published on this page with a new update date. A substantial change will be notified by email to the Shopify account address.