Privacy policy

This policy explains what Matrix Bundles collects, why, and for how long. Matrix Health Group Ltd publishes it as the developer of the app. It covers the app itself and this page.

In short

• The app collects nothing at all from shoppers.
• It never reads customer data, and it does not ask Shopify for permission to.
• It sets no cookies and no trackers on a storefront.
• Bundle settings are stored on the merchant’s own Shopify store, not in our database.
• Nothing is sold, shared, used for advertising, or used for profiling.

What we receive from Shopify

When a merchant installs Matrix Bundles, Shopify provides the shop’s domain and an API access token. That token can write products, cart transforms, metaobjects and metaobject definitions, read your existing discounts, and manage which sales channels a product is published to. It carries no permission to read customers or orders, so the app could not reach that data even if it tried.

Alongside the token we hold the permissions it was granted, when it expires, and the token used to renew it. That single record — one row per shop — is the whole of what the app stores about you.

The app uses those permissions to read your products when you are setting a bundle up, and to store your bundle rules on your own shop. When you set a bundle live — not when you save a draft — it creates one hidden helper product in your catalogue to carry the bundled line’s title and price. Shopify labels it “accessible only by direct link”, so it does not appear in your storefront, collections or search. That helper is the only thing the app adds to your catalogue, and it is not removed automatically if you uninstall.

What we receive from the merchant

Nothing that you type. The app contains no forms and asks you to submit nothing.

The record Shopify creates for your shop has spare fields for a staff member’s name and email address. The app signs in with a shop-level token rather than a personal one, so those fields are never filled in. No individual member of your staff is identified to us.

What we collect from shoppers

Nothing at all.

The app operates at Shopify’s protected customer data Level 0. It requests no customer data permissions and never reads customer data. It places no cookies and no tracking scripts on a storefront, so a shopper browsing a store that uses the app is not identified, measured, or profiled by us in any way.

Product and basket data at checkout

Working out a bundle price requires reading what is in the basket. That calculation is performed by a program that runs on Shopify’s own servers during checkout. The product and basket data it reads is never transmitted to us and is never stored by us.

How we use what we hold

Only to operate the app for the merchant who installed it, and to answer support requests. We do not sell it. We do not share it. We do not use it for advertising or for profiling.

No third party receives it either. The app makes no calls to analytics, error-tracking, logging or email services. The only companies involved in running it are Shopify and the company that hosts it.

How long we keep it

For as long as the app is installed. When a merchant uninstalls, the shop domain and access token are deleted. Shopify then sends an automatic deletion request 48 hours after uninstall, and we delete again on receiving it.

Bundle settings are held on the merchant’s own Shopify store rather than in our database, so they remain with the merchant and leave with the app.

Where your data is held

The app and its database run on DigitalOcean, London, United Kingdom. Matrix Health Group Ltd is a UK company, and the only records held are the shop domain, the access token, the permissions it carries and the token used to renew it.

Deletion requests from Shopify

Shopify requires every app to implement three compliance webhooks, and ours are built and cryptographically verified so that a request which does not genuinely come from Shopify is rejected.

• A customer data request returns an empty disclosure, because we hold no customer data to disclose.
• A customer erasure request has nothing to erase, for the same reason.
• A shop erasure request, sent 48 hours after uninstall, deletes any remaining session record for that shop. Uninstalling already deletes it, so this is a backstop that makes the erasure true even if the first signal was missed.

This page

This page runs no analytics and sets no cookies. It loads its typefaces from Google Fonts, which places no cookies but does mean your browser makes a request to Google and Google can see your IP address. Nothing else on this page contacts a third party.

Who we are, and how to reach us

Matrix Health Group Ltd
Registered in England and Wales, company number 17099304
VAT registration number GB 523 7816 82
Paddock Business Centre, 2 Paddock Road, Skelmersdale, Lancashire, WN8 9PL

Questions about this policy, or about data held for your shop: support@matrixhealthgroup.co.uk

For how the app behaves rather than what it stores, see support and common questions.

Changes to this policy

If this policy changes, the date at the top of the page changes with it. Material changes will be described here rather than applied quietly.