Privacy policy
IntentBundle is a service of Digiten Ai, Admiraliteitslaan 982, 5224 EX 's-Hertogenbosch, the Netherlands, Chamber of Commerce 42074801. This policy explains which personal data we process, why, how long we keep it and what your rights are. Questions? Email info@intentbundle.com.
1. Two roles
We process data in two roles:
- As controller for data of merchants (our customers), of people who use our website and of people who email us. That is mostly what this policy covers.
- As processor for data of visitors to stores that use IntentBundle. The store is responsible for that data; we follow their instructions under the data processing agreement. Section 4 explains what happens when you visit such a store.
2. Merchant data
| What | Why | Legal basis | How long |
|---|---|---|---|
| Store data from Shopify: domain, store name, store email, plan | Running the app, applying your plan, contacting you about the service | Performance of the contract | Until 48 hours after you uninstall; Shopify's deletion request then removes everything |
| Login details of the staff member who opens the app (name, email, language), via Shopify | Signing in, showing the app in your language | Performance of the contract | While the session is valid, at most until you uninstall |
| Settings, campaigns, statistics and your (encrypted) Klaviyo key | Running the app and showing your results | Performance of the contract | Until 48 hours after you uninstall |
| Support tickets and emails | Helping you and solving problems | Performance of the contract; legitimate interest | 24 months after the last message, or until you uninstall |
| Billing data | Shopify bills you; we only see which plan you have | Legal obligation (bookkeeping) | 7 years, insofar as we hold it |
3. Our website
- Contact form: your name, email, store and message. We use them to contact you (legitimate interest, or at your request before you become a customer). We keep them for 24 months.
- Waiting list: while the app is being reviewed by Shopify, you can leave your email (and optionally your store) to hear when it is available. We only use it for that (consent) and keep it for 24 months, or shorter if you ask.
- Live preview: when you enter a domain, we store the domain, the time, your IP address and the page you came from, to prevent abuse and see which stores viewed the preview (legitimate interest). We keep this for 12 months.
- Storage: messages, waiting list sign-ups and viewed previews are stored on our own server and viewed in our secured admin. We may notify ourselves of a new message via Discord or Slack; these contain the same data.
- Server logs with IP addresses are used only for security and troubleshooting. Our hosting provider keeps them briefly.
- The website uses no cookies, no trackers and no ad networks. Fonts are served from our own server.
4. You visit a store that uses IntentBundle
The store is responsible for your data; please direct questions and requests to the store. On their behalf we process:
- In your own browser: which products you viewed and for how long, a random code (no name or email) and your language. This stays on your device to build the bundle. If the store runs an A/B test and you consented to analytics, we also set a cookie
_ib_xp(90 days). See the cookies and storage statement. - Counts without personal data: how often the bundle was shown, opened and used.
- A bundle you save: if you enter your email yourself, we store it with the products, the discount and whether you agreed to receive email from the store. If the store uses Klaviyo, we send this to the store's own Klaviyo account. We keep this for 24 months after the last change, or shorter if the store or you ask.
- Orders: for an order with a bundle we store the order number, products and amounts, without your name or address. During an A/B test we also store the random code and the group, for 13 months.
We do not sell data, do not use it for ourselves and do not combine it across stores.
5. Who we share data with
- Shopify (Shopify International Ltd., Ireland, and affiliates): the app runs in Shopify; Shopify also handles payment of your subscription.
- Railway (Railway Corporation, United States): hosting and database for the app and the website.
- Klaviyo: only if the merchant enables the integration, and then to the merchant's own account.
- Discord or Slack: only for the internal notifications in section 3.
- Authorities, where the law requires it.
Where data is processed outside the European Economic Area, this is based on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
6. Security
We use encrypted connections (HTTPS), encrypt API keys in the database, limit access to those who need it, protect our admin with a password and a second factor, and keep no more than necessary. If you notice a security issue, please report it to info@intentbundle.com.
7. Your rights
You may access, correct or delete your data, restrict processing, object, and receive your data in a common format. Where you gave consent, you can withdraw it at any time. Email us at info@intentbundle.com; we respond within one month. If the request concerns data we process for a store, we forward it to that store and help them.
If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or the authority in your country.
8. Changes
We update this policy when the app or the law changes. The date at the top shows which version applies. We announce important changes to merchants in the app.