Legal & Trust

Privacy Policy

Effective: August 27, 2026 • Version 1.0

1. Overview & Commitment

Packmix Inc. ("Packmix", "we", "us", or "our") provides merchandising and bundle tools for Shopify merchants. We operate on principles of strict data minimization: we only process the minimum store and catalog information necessary to create variety packs, compute bundle discounts, and render storefront widgets.

2. Shopify Data We Access & Requested Scopes

When you install Packmix on your Shopify store, we request explicit API permissions through Shopify OAuth. The current active API scopes and their strictly limited purposes are:

read_products & write_products: Required to query your store's catalog products, read variant options and prices, and assign variety pack configurations.
read_discounts & write_discounts: Required to register and configure our automatic discount function (discountAutomaticAppCreate) powered by Shopify Functions WASM.
read_inventory: Required to monitor product variant inventory levels via webhooks (inventory_levels/update) so that out-of-stock items are disabled in real-time.

Customer PII Policy: Packmix does not store or process end-customer personal data (such as customer names, home addresses, phone numbers, or credit card details). All checkout and payment operations occur securely and exclusively on Shopify's native checkout platform.

3. How Discount & Bundle Data Is Processed

Packmix uses client-side Theme App Extension blocks and a compiled Rust WASM Shopify Function. When a customer adds a variety pack to their cart:

Custom line item attributes (such as _pack_id, _bundle_id, and _volume_tier) are attached to cart items.
The WASM discount function evaluates these cart attributes directly inside Shopify Checkout at sub-millisecond execution speeds.
No shopper personal information is transmitted to third-party ad networks or analytics trackers.

4. Shopify GDPR Compliance Webhooks

In accordance with Shopify's mandatory data protection requirements, Packmix implements verified HMAC-authenticated endpoints for all three GDPR compliance webhooks:

customers/data_request: Responds to merchant data requests for customer order history.
customers/redact: Acknowledges customer data deletion requests.
shop/redact: Automatically purges store records and configuration cache within 48 hours of an app uninstall request.

5. Data Retention & Uninstallation

When you uninstall Packmix, Shopify transmits an authenticated app/uninstalled webhook. Upon receiving this webhook:

We immediately deactivate your store's active subscription and API access tokens.
Store merchandising configurations and cached metrics are scheduled for permanent deletion.

6. Security & Infrastructure

All communications between your browser, our servers, and Shopify APIs are encrypted using industry-standard TLS/HTTPS. API access tokens and webhook signatures are validated using cryptographic HMAC-SHA256 verification.

7. Contact & Privacy Inquiries

If you have questions about this Privacy Policy or wish to exercise data rights, please contact our Data Protection team at:

Email: privacy@packmix.app
Mailing Address: Packmix Inc., 100 Innovation Way, Suite 400, Wilmington, DE 19801, USA