Privacy Policy

1. The short version

• We don't sell personal information, and we don't share it for advertising.
• Our website uses no analytics or advertising cookies.
• In stores, the app works with random, pseudonymous IDs. It doesn't collect shoppers' names, email addresses, phone numbers, postal addresses or IP addresses.
• The app sends measurement data to us only when the store's privacy settings show that the shopper allows analytics.
• Detailed shopper activity is deleted after 90 days, and a store's data is deleted from our systems after the merchant uninstalls.
• Our AI models are our own. Each store gets its own model, trained only on that store's data, and we don't send personal information to outside AI providers.

2. Who we are and our role

Rethink Software, LLC is a Delaware limited liability company. Our address is 2261 Market Street, STE 86828, San Francisco, CA 94114, United States, and you can reach us at nikil@rethinkbundles.com.

For website visitors, demo bookings and merchant accounts, we decide how personal information is used. Under the GDPR we are the controller, and under US state privacy laws we are the business.

For shoppers in a store that uses the app, the merchant decides how their shoppers' information is used, and we process it on the merchant's behalf. Under the GDPR the merchant is the controller and we are a processor; under US state privacy laws we are the merchant's service provider. If you're a shopper, the store's own privacy policy applies, and the store is the best first contact for questions or requests (see Your rights).

3. What we collect

Website visitors

• Technical data. Our website is hosted by Vercel, which processes the technical information needed to deliver each page, such as your IP address, browser type and the page requested, in its server logs. We don't run analytics or advertising tools on the website.
• Demo bookings. When you book a demo, our scheduling tool, HubSpot, collects what you enter, such as your name, email address, chosen time and any notes, and adds the meeting to our calendar.
• Emails. When you email us, we receive your email address, your message and anything you attach.

Merchants and their staff

• Store and account data: your store's Shopify domain, plan and billing status, install and uninstall dates, and the settings you create in the app, such as bundles, templates, designs, tests and personalization rules.
• Access credentials: the access token Shopify issues when you install the app and, if you connect Recharge, your Recharge credentials, which we store encrypted.
• Order and revenue data: to report bundle performance and work out usage-based plan charges, we read paid orders and refunds through Shopify, including order and line item IDs, products, amounts, currency and the bundle details the app added to the cart. We keep the figures, not the buyer's contact details.
• Support and sales contact: your messages, demo calls and the contact details you share with us.

Shoppers in stores that use the app

The app doesn't request, collect or store shoppers' names, email addresses, phone numbers, postal addresses or IP addresses. Depending on the features a merchant turns on, it processes:

• A pseudonymous visitor ID: a random ID created in the shopper's browser, used to count visitors, keep A/B test versions consistent and connect a bundle to the order it ended up in.
• Store activity: the type of page viewed (home, product, collection or other), when a bundle was shown or added to the cart, the products picked or removed while building a bundle, timing signals such as time since the last pick, device type (phone or desktop), whether the visitor is new or returning, and which test or offer version was shown.
• How the visit started: the landing page path, campaign (UTM) parameters, the referring website's domain, and which ad platform sent the visit (the fact only, not the click ID).
• Order links: when an order is placed, its order ID linked to the visitor ID. The bundle and offer details the app adds to the cart become part of the order in the merchant's Shopify store.
• Shopify customer IDs: for subscription features (where the merchant connects Recharge) and future-gift features, the shopper's Shopify customer ID with their subscription box contents, changes and gifts. For signed-in shoppers we also read whether they have ordered before, as a yes or no.
• Quiz and scratch-card answers: when a shopper answers a bundle quiz or reveals a scratch card, the result is saved on the order and may be added as a tag on the shopper's customer record in the merchant's store, so the merchant can follow up.

The app's request logs, kept by our hosting provider, record each request the app receives. For storefront events, that can include the visitor and session IDs and campaign parameters sent with the event and, for signed-in shoppers, the Shopify customer ID that Shopify attaches to the request.

4. How we use information

We use personal information to:

• provide the app: show bundles and offers, apply discounts at checkout, and run the tests, personalization and pop-ups a merchant sets up;
• report bundle performance to the merchant and calculate plan charges, which Shopify bills;
• reply to demo bookings, emails and support requests;
• keep the Services secure and working, prevent abuse and fix problems;
• handle data requests and deletions, and meet our legal obligations and Shopify's requirements; and
• improve the Services, using information that is aggregated or de-identified wherever possible.

We don't use personal information to advertise, and we don't sell it.

Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies and we are the controller, we rely on: contract, to provide the app to merchants and to take steps you ask for before signing up, such as a demo; legitimate interests, to secure and improve the Services and to reply to messages, where those interests aren't overridden by yours; legal obligation, to keep records and answer lawful requests; and consent, where we ask for it. For shopper data, the merchant chooses the legal basis and we act on the merchant's instructions.

5. AI and automated decisions

Rethink Bundles includes AI features that we build and run ourselves:

• Smart Trigger (abandonment rescue). A model scores live activity in a Mix & Match bundle builder, such as progress, idle time, removed picks, scrolling away and whether the tab is hidden, to predict when a shopper is about to leave a half-built box, and then shows the merchant's rescue pop-up. The scoring runs in the shopper's browser. Each store has its own model, retrained daily on that store's last 90 days of bundle-building activity, starting from preset weights.
• Smart Testing. Compares versions of a bundle that the merchant has approved, and declares a winner only when it beats the others by the merchant's minimum improvement with 95% confidence, after at least 7 days. If there's no winner within 30 days, the current version stays.
• Personalization. Chooses which version of an offer to show to a group of visitors, for example by device or traffic source, using results recalculated daily from that store's own data.

We don't send personal information to third-party AI or large language model providers, we don't use generative AI on shopper data, and we never use one store's data to train or tune a model for another store.

Automated decisions and profiling

These features decide which bundle, offer or pop-up a visitor sees. They don't make decisions with legal or similarly significant effects on people, such as about credit, employment, housing, insurance or access to essential services. They don't raise prices for individuals, and nobody is refused a purchase. They are therefore not the kind of solely automated decision covered by Article 22 of the GDPR, and we don't use automated decision-making technology to make significant decisions as defined in California's regulations.

Predicting from a shopper's activity that they may leave a half-built box is a form of profiling. It's pseudonymous and limited to the store being visited, and the activity data is deleted after 90 days. Shoppers can decline analytics in the store's privacy settings, and the app then sends us no measurement data about their visit. Where the GDPR applies, shoppers can also object through the store.

AI regulation

Our AI features don't use biometric data, emotion recognition or manipulative techniques, and shoppers don't talk to an AI system: pop-ups show messages and offers the merchant designs or approves. Based on how they work, we don't consider them high-risk AI systems under the EU AI Act, and they aren't used to make consequential decisions under the Colorado AI Act. We review this as the features and the rules change, and merchants must not use the features for any purpose these laws prohibit or treat as high-risk (see our Terms of Service).

6. How we share information

We don't sell personal information or share it for cross-context behavioural advertising, and we haven't done so in the last 12 months. We share it only with:

• The merchant, for shopper data processed in their store. Merchants see reports in the app, and the tags and order details the app writes live in their Shopify store.
• Service providers that process it for us under contract, listed below.
• Authorities or others when the law requires it, or to protect the rights, safety or security of our users, us or others.
• A buyer or successor, if our business is merged, sold or reorganised, on terms that keep this policy's protections.

7. Cookies and similar technologies

Our website sets no cookies of its own and uses no analytics or advertising trackers. In merchants' stores the app uses no cookies; it uses the shopper's browser storage, and its measurement waits for the store's consent settings. Our Cookie Policy lists every item and how to control it.

8. How long we keep it

• Shopper activity (page views, arrival records, bundle-building events and the links between visitor IDs and orders): deleted after 90 days. After that, the visitor ID is also removed from the app's order records. Daily totals that contain no identifier are kept while the app is installed.
• Merchant data: kept while the app is installed. When a merchant uninstalls, we delete the store's login sessions straight away. Shopify then sends a deletion request about 48 hours later, and we delete all of the store's data from the app's database.
• Backups: kept for up to 14 days, then overwritten.
• Data in the merchant's Shopify store: customer tags, order details and bundle products the app created stay in the store, under the merchant's control, after uninstalling.
• Demo bookings and emails: kept while we're in touch and for as long as our business relationship needs them, then deleted. You can ask us to delete them sooner.

9. Security

Data travels over HTTPS between browsers, Shopify and our servers. The app's database sits on encrypted storage and isn't reachable from the public internet, Recharge credentials are encrypted again by the app, Shopify webhooks are signature-checked, and access is limited to the people who need it. No system is perfectly secure; if a breach affects your information, we'll tell the affected merchants, and you or the authorities where the law requires.

10. Your rights

You can ask us what personal information we hold about you, ask us to correct or delete it, or ask for a copy, by emailing nikil@rethinkbundles.com. We may need to confirm your identity first. We reply within one month, or within 45 days where US state law applies, and we won't treat you differently for using your rights.

If you're a shopper

Your information in the app is held for the store you shopped with, so please contact the store first. When a store or Shopify passes us a request, we act on it: for a data request we prepare a copy of what the app holds about that customer for the merchant, and for a deletion request we delete the data the app holds that is linked to that customer. If you contact us directly, we'll pass your request to the store and help them handle it.

EEA and UK

You have the right to access, correct, delete, restrict or port your personal information, to object to processing based on legitimate interests (including profiling), and to withdraw consent at any time. You can also complain to your local data protection authority.

US states

Residents of California and of states with similar laws, such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia, can ask to know, access, correct and delete their personal information. You can also opt out of the sale or sharing of personal information and of targeted advertising, but we don't do either, and we honour Global Privacy Control signals. We don't collect sensitive personal information. You may use an authorised agent, and if we decline your request you can appeal by replying to our decision.

California notice

In the last 12 months, as a business, we collected identifiers (such as name, email address and IP address, as described above), professional information (your business and role, if you share them), commercial information (merchants' plans, orders and bundle revenue) and internet activity (website server logs). As a service provider to merchants we also processed pseudonymous identifiers, store activity and inferences (the prediction that a shopper may leave a half-built box). The sources, purposes and recipients are described above. We didn't sell or share any of it.

11. International transfers

We're based in the United States, and the app's servers are in the US. Booking details are held in HubSpot's EU data centre. When personal information from the EEA, the UK or Switzerland is transferred to the US, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) in our providers' data processing terms, or on a provider's certification under the EU-US Data Privacy Framework. Merchants who need a data processing agreement can contact us.

12. Children

Our Services are for businesses and aren't directed at children. We don't knowingly collect personal information from anyone under 16, and the app doesn't ask for anyone's age. If you think a child has given us personal information, contact us and we'll delete it.

13. Changes to this policy

When we update this policy we'll change the effective date above. If a change is significant, we'll tell merchants by email or in the app before it takes effect.

14. Contact

Rethink Software, LLC, 2261 Market Street, STE 86828, San Francisco, CA 94114, United States. Email: nikil@rethinkbundles.com.