Privacy Policy
Updated 9 October 2026
This Privacy Policy explains how Vendkit (“we”, “us”) handles data when a Shopify merchant uses Kitwell (the “App”), an app that lets a merchant sell products together as bundles, with a saving that Shopify applies automatically at checkout.
1. Who we are and our role
The App is operated by Vendkit. When a merchant installs Kitwell, the merchant is the data controller and Vendkit acts as a data processor: we process data only to provide the App's features to that merchant, on their instructions. Our processing terms are set out in the Data Processing Addendum in our Terms of Service.
2. Data we access in your store
Kitwell asks Shopify only for the permissions it needs:
| Shopify data | Permission | Why we need it |
|---|---|---|
| Products | read_products | Show product names, photos and prices when you build a bundle, and find the products a bundle contains. |
| Products (write) | write_products | Create one hidden product per bundle that you show as one cart line, keep its name up to date, and delete it when you delete the bundle. It is not sold on any sales channel and holds no customer data. |
| Cart rules | write_cart_transforms | Switch on the Kitwell function that shows a complete bundle as one line in the cart. It only reads the cart's products and quantities; it reads nothing about the shopper. |
| Discounts | write_discounts | Create, update and remove one automatic discount for each live bundle. |
| Orders | read_orders | See which bundles sold and for how much, so we can show you bundle sales. We read the order ID and the prices and discounts of the bundle items only. |
Shopify includes some customer fields (such as name and email) in the order notifications it sends us. We ignore them and never save them.
3. Data we store
| What | Details | Kept for |
|---|---|---|
| Bundles | Each bundle's name, products, discount, schedule, placement and look, plus any translated headings and buttons you add. | Until you delete the bundle or uninstall. |
| Bundle order records | For each order that contains a bundle: the order ID, the bundle, the amount paid for that bundle's items and the currency. No customer details. | 13 months, then deleted automatically. |
| View counts | How many times each bundle was viewed and added to the cart. No viewer, device or IP address is recorded. | 13 months, then deleted automatically. |
| Store settings | Your plan, accent colour, widget look and setup progress. | Until you uninstall. |
| Session details | The access token Shopify gives the App to act on your store. | Until you uninstall. |
Product details are read from Shopify when needed and are not stored by us.
4. Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Creating bundles and their discounts | Performance of our contract with the merchant |
| Bundle sales and view counts shown to the merchant | Performance of contract; the data holds no customer details |
| Keeping the App secure and fixing errors | Our legitimate interest in running a reliable service |
| Billing your plan through Shopify | Performance of contract |
5. Who we share data with
We never sell or rent data. We use these providers (sub-processors) to run the App:
| Provider | What they do | Location |
|---|---|---|
| Shopify | The platform the App runs on; source of product and order data; billing. | Canada / global |
| Railway | Hosts the App's servers. | United States (East) |
| Supabase | Database, encrypted at rest. | Canada (Montréal) |
| Sentry | Error monitoring. Personal data is removed from error reports before they are sent. | United States |
6. International data transfers
Data may be processed in Canada and the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on the safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses and Canada's adequacy decision.
7. Retention and deletion
- Bundle order records and view counts are deleted automatically after 13 months.
- When you uninstall, we remove your session details straight away. Shopify then asks us, about 48 hours later, to delete your store's data, and we permanently delete everything we hold for your store.
- We respond to all of Shopify's mandatory privacy requests (customer data request, customer redact and shop redact). Because Kitwell holds no customer names or contact details, customer requests have nothing to return beyond order IDs, which we delete on request.
8. Cookies
Kitwell sets no cookies and uses no tracking on your storefront. Bundle items are added to the cart with a hidden line property (_kitwell) that tells Shopify which bundle they belong to.
9. Your rights
Depending on where you live, laws such as the GDPR and CCPA give you rights to access, correct, delete, restrict or port your personal data, and to object to processing. Shoppers should send requests to the store they bought from (the merchant, who is the controller). Merchants can exercise these rights by contacting us or by uninstalling the App. You may also complain to your local data-protection authority.
10. Security
All data is sent over HTTPS and stored in encrypted databases. Every request from Shopify, and every request from your storefront widget, is verified with its signature before we act on it, and a bundle can only be changed or counted by the store that owns it. Access to production systems is limited to the App's operator, and we keep daily database backups.
11. Children
The App is a business tool and is not directed at children. We do not knowingly process children's data.
12. Changes to this policy
We may update this policy as the App changes. The “Updated” date at the top shows when it last changed; for significant changes we will notify merchants in the App.
13. Contact us
Vendkit — vendkit.support@gmail.com. We reply within one business day.