Effective 1 September 2026

Who we are

Supr Bundle & Subscription App ("the App"), lets merchants who use Shopify sell subscriptions and bundles. It is provided by Point Blank Engineering Limited, company number 11639094, of Kemp House, 152-160 City Road, London EC1V 2NX, United Kingdom ("we", "us").

Our role

For information about merchants and their staff, we are the controller. For information about a merchant's customers, the merchant is the controller and we process it on the merchant's behalf, only to provide the App. If you are a customer of a store that uses the App, please contact that store to exercise your rights; we help merchants respond.

Information about merchants

• Store details from Shopify: store name and domain, store and contact email addresses, the store owner's name, country and Shopify plan.
• App settings, offers and configuration.
• The access token Shopify issues at install, and API keys for integrations you connect. Klaviyo API keys are stored encrypted.
• A record of actions taken in the App's admin (the page or action and the Shopify staff user ID), kept for security and support.
• Messages sent to us through the in-app support chat.
• Usage analytics and session recordings of the App's admin interface, used to fix problems and improve the App.

Information about your customers

Customer names, email addresses, postal addresses and payment details are held by Shopify. The App reads them from Shopify when needed and does not keep its own copy, except as follows:

• Subscription records: Shopify customer, subscription and order IDs, plan and status, renewal and billing outcomes, and pause and cancellation history, including any reason or comment a customer gives.
• Subscription history: a new shipping address a customer enters in the customer portal, the email address a notification was sent to, and notes merchants add to a subscription.
• Imported subscriptions: when we move a merchant's subscriptions from another app, the imported details, which can include names, addresses and email addresses.
• Notifications: customer details are used to write and send subscription emails, and are sent to the merchant's own Klaviyo account if the merchant connects one.

The App never processes payment card details; payments are handled by Shopify. The App's storefront widgets set no tracking cookies and collect no customer identifiers. If a widget fails to load, it sends an anonymous error report with the page path and error message.

How we use it

• To provide the App: creating and managing subscriptions, processing renewals, sending notifications and running the customer portal.
• To support merchants and resolve problems.
• To keep the App secure and prevent misuse.
• To understand how the App is used and improve it.
• To communicate with merchants about the App.

We process merchant information to perform our agreement with you, and for our legitimate interests in supporting, securing and improving the App. For customer information, the merchant determines the legal basis as controller.

Service providers

We do not sell personal data or share it for anyone else's own purposes. These providers process data only on our instructions:

We may also disclose information where the law requires it, or to protect our rights.

Where data is stored

The App's servers, background processing and database run in the European Union, in Ireland and France. Our team accesses these systems from Bulgaria, in the European Union. Where personal data is processed outside the European Economic Area or the United Kingdom, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses. More detail is on our GDPR and data processing page.

Cookies

The App's admin interface uses cookies and similar storage for analytics (PostHog) and support chat (Crisp). The storefront widgets and customer portal set no tracking cookies. The super-simple.co website measures page views, clicks and scrolling with PostHog without cookies.

How long we keep it

• Store and subscription data is kept while the App is installed.
• 48 hours after a merchant uninstalls, Shopify asks us to erase the store's personal data. We delete the App's access tokens and integration credentials, and redact the personal data described above. Subscription records and App configuration are kept, so the setup can be restored on reinstall.
• When Shopify sends us a request to erase an individual customer's data, we redact the personal details we hold about that customer. Merchants can also ask us directly, and we act within 30 days.
• Records of actions taken in the App's admin are kept for 13 months.
• A copy of App settings taken at uninstall is kept for 12 months.
• Anonymous storefront error reports are kept for 30 days.

Security

Connections to the App are encrypted with TLS, and the database and file storage are encrypted at rest. The App accesses a store only through the Shopify permissions the merchant grants at install. Admin requests are verified as signed Shopify sessions, webhooks from Shopify are verified by signature, and each store's data is kept separate.

Your rights

If you are in the European Economic Area or the United Kingdom, you can ask to access, correct or delete your personal data, restrict or object to its processing, and receive it in a portable format. Merchants and their staff can contact us directly. Customers of a store should contact that store; if you contact us instead, we will work with the store to respond. You can also complain to your local data protection authority, or in the United Kingdom to the Information Commissioner's Office.

Changes

We may update this policy when the App or the law changes. The effective date at the top shows when it last changed.

Contact

For privacy questions or requests, email support@subscriptions.super-simple.co or write to: