Privacy Policy
Build a Box · Last updated: September 28, 2026
Build a Box: Bundle Builder ("the App") is developed by Digital Cartel ("we", "us", "our"). This policy explains what data the App handles, what we store, and your rights.
Summary
No shopper personal data is collected by the App. We store your box templates, your plan, the access token Shopify issues at install, and anonymous daily counts of how your box builders perform. We delete all of it after you uninstall.
What the App Does on Your Storefront
The box builder is a theme app block. When a shopper opens a box page, the builder loads your published box template through your store's own app proxy (a Shopify address on your domain), and the shopper chooses products in their browser.
- Anonymous counts only. The builder reports funnel events (viewed, started, item added, completed, added to cart) and which variants were picked. We store these only as daily totals per box template. No event carries a shopper identifier.
- No cookies and no browser storage are used by the App on shopper devices.
- No tracking. No third-party analytics, no pixels, no fingerprinting, no advertising networks.
- No shopper data. Requests reach us through Shopify's app proxy, so we never see a shopper's IP address. The App does not read, collect, transmit or store customer names, email addresses, addresses, payment details or order history.
When a shopper adds a box to the cart, the App adds hidden line item properties that describe the chosen products, and Shopify's checkout uses them to list each product on the order. Those properties are stored by your store on the cart and order, in your own admin.
What We Store
Billing runs through Shopify's own subscription system. We never see or handle card details. Per installed store we store:
- Your myshopify domain, install date and plan
- The access token and refresh token Shopify issues at install, used only to act on your own store (create and update the box products you publish, keep your box configuration in sync, check your plan)
- Your box templates: names, sizes, prices, steps, the product and collection IDs you choose, and layout settings
- Setup guide progress (whether you dismissed it or confirmed a step)
- Anonymous daily counters per box template and per picked variant, as described above
- Short-lived request counters used to rate-limit storefront traffic
That is the complete list. It is store-level configuration and aggregate statistics, not personal data about your shoppers.
What We Do Not Collect
- Customer data (names, emails, addresses, payment information)
- Order contents or revenue figures
- Individual shopper behaviour or sessions
- Shopper IP addresses
- Any personal information of your shoppers
Data Storage & Security
Data is held in an encrypted PostgreSQL database operated by our hosting provider, reachable only by our server over TLS with a private credential. Storefront requests are verified with Shopify's app proxy signature, and webhooks with Shopify's HMAC signature, before we act on them.
Data Retention
When you uninstall the App we delete your access tokens straight away. Forty-eight hours later Shopify asks us to erase your store's data, and we delete your box templates, statistics and store record. Shopify removes the theme app block automatically. Box products the App created in your admin stay in your store until you delete them.
Third-Party Services
The App integrates with no third-party analytics platforms or advertising networks. Our server runs on Vercel and the database on Neon, which host the service described above. Billing is handled entirely by Shopify.
Your Rights
You can:
- Unpublish or delete any box template at any time
- Cancel a paid plan at any time from your store's app subscriptions
- Uninstall the App, which deletes everything we hold for your store
- Contact us with any question about this policy or to request deletion sooner
GDPR, CCPA & POPIA
No shopper personal data is processed or stored by the App, so no consent banner or data processing agreement is required in relation to Build a Box. We answer Shopify's mandatory customer data request, customer redaction and shop redaction webhooks: we hold no customer records, and a shop redaction erases everything we hold for the store.
Changes to This Policy
We may update this policy occasionally. Changes will be reflected on this page with an updated date. Continued use of the App after changes constitutes acceptance.
Contact Us
For privacy questions, please contact us at:
support@digitalcartel.online