Privacy Policy

BUNDLEME ("BUNDLEME", "the app", "we", "us", "our") is a Shopify application developed and operated by Joykek, an independent software company based in Türkiye. Joykek is the data controller for all personal data processed in connection with BUNDLEME.

Contact: info@joykek.com

This Privacy Policy describes how Joykek collects, uses, stores, and protects information when a Shopify merchant installs and uses BUNDLEME on a Shopify store. It also covers visitor information collected through this website (bundleme.joykek.com).

This policy does not cover the privacy practices of Shopify Inc. or any third-party service you connect to BUNDLEME.

3.1. Information from your Shopify store

When you install BUNDLEME, Shopify grants the app permission to access the following data via the Shopify Admin API:

• Shop information - store domain, name, primary currency, contact email, plan name.
• Products and collections (read only) - used to let you select which products customers can bundle.
• Orders (read only) - to track usage against your monthly plan limit.
• Metaobjects (read/write) - to sync your bundle configurations.
• Cart Transforms (read/write) - to register the discount engine.

3.2. Information you provide inside the app

• Bundle configurations (titles, descriptions, conditions, discount type and value).
• Bundle status (Active, Draft, Archived).

3.3. Authentication and session data

BUNDLEME stores an encrypted shop session record (shop domain, access token, scope, expiry) required to authenticate API requests.

3.4. Website visitor data

This website is served as static HTML and does not run any tracking scripts, analytics, or advertising pixels. Your hosting provider may collect standard web server logs only.

BUNDLEME deliberately limits the data it processes. We do not:

• Collect or store your customers' personal information (names, emails, addresses, payments).
• Read or store individual customer cart contents at the personal level.
• Sell, rent, or trade any data to third parties for marketing or advertising.
• Use your data to train machine learning models.
• Use cookies on this website for tracking, profiling, or advertising.

Under GDPR and KVKK, our legal bases for processing are:

• Contract performance - processing necessary to provide BUNDLEME.
• Legitimate interest - minimal logging and security monitoring.
• Legal obligation - compliance with applicable laws, including Shopify's GDPR webhooks.

We use the data we collect strictly to operate BUNDLEME:

• Display your store's products and collections inside the app.
• Sync bundle configurations to Shopify Metaobjects and Cart Transform Functions.
• Apply bundle discounts in your store's cart.
• Track your monthly bundle order count.
• Provide customer support when you contact us.
• Detect and prevent abuse, fraud, or technical errors.
• Comply with our legal obligations.

We share data only with trusted subprocessors who provide BUNDLEME's infrastructure. Each is bound by a data processing agreement.

• Shopify Inc. - Hosts your store and provides the Admin API, Billing API, and Cart Transform Function.
• Hetzner Online GmbH (Germany) - Provides the dedicated server infrastructure.
• Cloudflare, Inc. - Provides DNS, edge security, and TLS termination.
• PostgreSQL (self-hosted on Hetzner) - Stores bundle configurations and session records.

We do not share your data with any third party for marketing, advertising, or analytics.

We retain your bundle configurations and shop session data for as long as BUNDLEME is installed on your Shopify store. When you uninstall, all data associated with your shop is deleted within 48 hours, in accordance with Shopify's app/uninstalled webhook and GDPR data minimization principles.

Aggregated, anonymized statistics may be retained indefinitely for operational reporting and do not contain personally identifiable information.

Joykek operates from Türkiye. Our primary infrastructure provider (Hetzner) operates data centers in Germany and Finland. Your data may be transferred to and processed in these regions.

Transfers between Türkiye and the EEA are conducted under the European Commission's Standard Contractual Clauses where applicable, and within the safeguards provided by KVKK and GDPR.

• All traffic to and from BUNDLEME is encrypted in transit using TLS 1.2 or higher.
• Shopify access tokens are stored encrypted at rest.
• The database is hosted in a private network, not exposed to the public internet.
• Webhook requests from Shopify are verified using HMAC signature validation.
• Access to production infrastructure is limited to authorized Joykek personnel via SSH key authentication.
• We follow Shopify's app review security checklist.

While we take reasonable measures, no system can be guaranteed 100% secure. If a security incident affects your data, we will notify you and the relevant supervisory authority without undue delay.

Depending on your jurisdiction (GDPR, CCPA, KVKK), you have the following rights:

• Access - request a copy of the personal data we hold.
• Rectification - request correction of inaccurate data.
• Erasure - request deletion ("right to be forgotten").
• Restriction - limit processing.
• Portability - receive your data in a structured format.
• Objection - object to processing based on legitimate interest.
• Withdraw consent - where processing is based on consent.

To exercise any right, contact info@joykek.com. We respond within 30 days.

When you uninstall BUNDLEME from your Shopify store:

• Shopify sends the app/uninstalled webhook immediately.
• BUNDLEME marks your shop session as inactive and queues your data for deletion.
• All bundle configurations, conditions, discount rules, session records are deleted within 48 hours.
• Bundle Metaobjects and Cart Transform Function registrations in your Shopify store are removed.

To verify deletion or request manual confirmation, contact info@joykek.com.

This website (bundleme.joykek.com) does not set any cookies, run any analytics, or use any tracking scripts. The Shopify-embedded admin app uses session cookies strictly necessary for authentication, per Shopify's App Bridge requirements.

BUNDLEME is a business-to-business tool intended for Shopify merchants and their authorized staff. The app is not directed to children under 16, and we do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date at the top of this page and, where appropriate, by notifying you inside the app or via the email address associated with your Shopify Partner account.

If you have any questions about this Privacy Policy or how we handle your data:

• Joykek
• Email: info@joykek.com
• Website: joykek.com

For data protection inquiries, please use the same email with subject "Privacy Request - BUNDLEME".