Privacy Policy

1. Overview & Commitment to Zero-PII

At FlatBulk (operated by DevOryx - Ilja Kling, "we", "us", or "our"), we respect your privacy and are committed to protecting the personal data of merchants and their end-customers.

FlatBulk is engineered with a privacy-by-design architecture. Our native Shopify Function executes server-side within Shopify’s secure infrastructure at checkout. We do not collect, store, profile, or sell end-buyer Personally Identifiable Information (PII), including names, email addresses, payment methods, or physical addresses.

2. Information We Collect

To provide volume discount automation and campaign configuration, we collect and process the minimum necessary merchant data:

• Merchant Store Identification: Shopify store domain (e.g. store.myshopify.com) and OAuth access tokens required for Shopify Admin API communication.
• Campaign Configurations: Tier thresholds, discount percentages, fixed monetary amounts, and product/collection target GIDs.
• App Settings: Conflict resolution strategy preferences (Specificity, Maximum Discount, Priority) and pooling options.

We do not access, read, query, or store any order data, customer records, transaction histories, payment information, or any other Personally Identifiable Information (PII) belonging to your store's end-buyers. FlatBulk does not use the Shopify Orders API, Customer API, or any API that exposes individual customer or purchase data. Discount logic is executed entirely within Shopify's own infrastructure via native Shopify Functions, with no customer data ever transmitted to or processed by FlatBulk's servers.

3. How We Use Merchant Information

We use collected merchant information strictly for:

• Syncing and updating volume discount rules on your Shopify store via Shopify GraphQL Admin API.
• Serving active discount metadata to the storefront web component to render tiered pricing tables.
• Providing customer support and debugging merchant-reported campaign configuration issues.

4. Data Security & Storage

Merchant session tokens and discount rule definitions are stored securely in an encrypted SQLite database on an isolated IONOS virtual private server (Frankfurt, Germany). We enforce TLS/SSL encryption for all data in transit and adhere to least-privilege access controls.

5. Third-Party Services & Subprocessors

FlatBulk integrates strictly with authorized service providers necessary to operate the service:

• Shopify Inc.: Authentication, billing, and GraphQL Admin APIs.
• Hosting Infrastructure: IONOS VPS (Germany, EU) compliant with GDPR/DSGVO requirements.

6. Merchant Rights & GDPR Compliance

Under the European General Data Protection Regulation (GDPR / DSGVO) and applicable privacy laws, merchants have the right to access, rectify, or request deletion of their account configuration data at any time. When you uninstall FlatBulk, mandatory Shopify compliance webhooks (CUSTOMERS_DATA_REQUEST, CUSTOMERS_REDACT, SHOP_REDACT) automatically purge stored session records within 48 hours.

7. Contact Our Privacy Officer

For privacy inquiries, data subject access requests, or questions regarding our data practices: