CraftFrame Bundle Quiz · Shopify app
Privacy policy
Last updated 3 October 2026
CraftFrame Bundle Quiz is a Shopify app made by CraftFrame WORKS Ltd ("CraftFrame", "we"). It adds a questionnaire to a merchant's storefront that recommends a bundle and opens a pre-filled cart. This page says what the app collects, where it is kept and how to have it removed. The short version: we keep the minimum needed to run the app for a store, and nothing about that store's shoppers.
Who is responsible
CraftFrame WORKS Ltd is the controller for the merchant account data described below. It is a company registered in England and Wales, company number 16669774, with its registered office at Suite 206, Britannia House, 11 Glenthorne Road, London, W6 0LH. For anything in this policy write to contact@craftframe.agency. We reply within two working days.
Merchants: what we collect
| What | Why | Where it is kept |
|---|---|---|
Your shop's myshopify.com domain, the access token Shopify issues when you install, and the permissions you granted | To identify your store and call Shopify's API on your behalf | Our database (Neon, London) |
| If Shopify includes them with your session: the name, email and locale of the staff member using the app | Provided by Shopify as part of signing in; we do not use them for marketing | Our database (Neon, London) |
| Your configuration: questions, rules, wording, colours, and for each linked product its title, price, image link and variant ID | It is what the storefront block shows | In your own Shopify store, as a shop metafield (bundle_configurator.config). Not on our servers |
| How many quizzes shoppers finished on your store each month: a number per month for the store and for each of its quizzes, nothing else | Plans are sized by finished quizzes; it is what the app shows you and checks against your plan | Our database (Neon, London), until 48 hours after you uninstall |
| Technical logs: shop domain, request path, time, IP address and error details | To keep the service running and fix faults | Our hosting provider's logs (Netlify), kept for a short period |
The app reads your products and your published theme's settings when you use the product picker or "Match my store". It reads them at that moment to do what you asked and does not keep a copy, beyond the product details you chose to link, listed above. Subscription charges are handled entirely by Shopify; we never see your payment details.
Shoppers: what we collect
Nothing that identifies a shopper. The questionnaire runs in the shopper's browser on the merchant's storefront.
- Answers are kept in the shopper's own browser storage so that a refresh does not lose them. They are not sent to CraftFrame or to the merchant.
- "Copy a link to this bundle" puts the answers into the link itself. Whoever opens that link sees the same result; nothing is stored anywhere else.
- When a shopper reaches a result, the widget tells the app, through the store's own address, that one quiz was finished for that store and which of the store's quizzes it was. That message carries no answers, no identifier and no cookie; we add one to the store's and that quiz's monthly count and keep nothing else. Once a store on the Free plan reaches its monthly allowance, the widget stops sending these messages until the next month.
- The widget sets no cookies and runs no trackers. Its files are served by Shopify's content network.
- When the shopper continues to the cart, they are on the merchant's Shopify checkout, under the merchant's own privacy policy.
Legal bases
We process merchant account data to perform our contract with you (providing the app) and, for logs and security, on the basis of our legitimate interest in running a reliable service. We do not sell personal data, use it for advertising or make automated decisions about anyone.
Who else handles the data
| Provider | Role | Location |
|---|---|---|
| Shopify | The platform the app runs in; holds your configuration metafield and serves the storefront files | Global |
| Neon | Database holding the session records described above | United Kingdom (AWS London) |
| Netlify | Hosts the app's admin pages and receives Shopify's webhooks | United States and global edge |
Where data leaves the UK or EEA, it does so under the provider's standard contractual clauses or the UK International Data Transfer Addendum.
How long we keep it, and deletion
- Session records are deleted when you uninstall the app, and again when Shopify sends its shop redaction request 48 hours later.
- Your configuration metafield lives in your store and stays under your control. After uninstalling you can remove it in Shopify under Settings, Custom data, Shop.
- Hosting logs expire on the provider's short retention schedule.
- The app implements Shopify's mandatory privacy webhooks (customer data request, customer redaction, shop redaction). Because we hold no customer data, customer requests are answered with nothing to return or erase.
Your rights
You can ask for a copy of the data we hold about you or your store, have it corrected or deleted, or object to how we use it, by writing to contact@craftframe.agency. If you are unhappy with our answer you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
Security
Traffic is encrypted in transit. Access tokens are stored in a database that accepts encrypted connections only, and access to production systems is limited to CraftFrame staff who need it. Requests from Shopify are verified by signature before they are acted on.
Changes
If this policy changes in a way that matters, we will update the date above and tell installed merchants inside the app before the change takes effect.
CraftFrame WORKS Ltd · Company number 16669774 · Registered in England and Wales · Suite 206, Britannia House, 11 Glenthorne Road, London, W6 0LH