Privacy policy

Last updated 19 October 2026

BulkPro Advanced Account ("the app") gives Shopify stores better customer sign-in, account pages, rewards, back-in-stock alerts and returns. This policy explains what the app collects, where it is kept and how it is used. "Merchant" means the store that installs the app; "customer" means a shopper of that store.

What the app collects

From the merchant: the store's name, email, domain, currency and plan; the app's settings and designs; and, if the merchant connects them, keys for their SMS, WhatsApp or email (SMTP) provider and their Google sign-in Client ID.

About customers, to provide the features the merchant switches on: name, email, phone number, addresses, orders and order status (to sign in, show the account page, track parcels, credit rewards points and request returns), the fields of the store's register form, wishlist items, rewards points and referral codes, and back-in-stock requests (email or phone and the product).

Where it is kept

Almost everything is stored inside the merchant's own Shopify store (as customer, product and store data and metafields), not on our servers. Our server keeps only:

• the store's Shopify access token, encrypted;
• one-time sign-in codes, stored only as a hash together with the email or phone they were sent to and the requester's IP address (for rate limiting), deleted within 24 hours;
• sign-in statistics (method, success, date; no names, emails or phones), deleted after 400 days;
• when Shopify notifications last arrived, and the store's trial start date.

Provider keys are encrypted before they are saved in the merchant's store.

How it is used

Data is used only to provide the app's features to the store that installed it: signing customers in, showing their account, sending the messages the merchant set up, and support. We don't sell data, don't use it for advertising and don't combine data from different stores.

Sharing

Data is shared only with the services needed to run the features the merchant chooses:

• Shopify, where the data lives;
• the SMS or WhatsApp provider the merchant connects (Twilio, Meta, Vonage and others), which receives the customer's phone number and the message;
• the email service that sends back-in-stock emails (our email provider, or the merchant's own SMTP server), which receives the customer's email and the message;
• Google, when a customer chooses "Continue with Google" (the sign-in happens with Google directly);
• our hosting provider, which runs the server and database.

Retention and deletion

When the app is uninstalled, its access to the store ends at once and our server deletes the store's access token. Shopify then asks us to delete the store's data, and everything on our server about the store is deleted. Data the app saved inside the store stays with the merchant in Shopify.

When Shopify sends us a customer data request or a customer deletion request, we answer it or delete that customer's data on our server (pending sign-in codes) right away.

Security

All traffic uses HTTPS. Access tokens and provider keys are encrypted at rest. Each store can only reach its own data, and storefront requests are checked with Shopify's signature.

Customers' rights

Customers who want to see, correct or delete their data should contact the store they shop with, which can do it in Shopify; we help the store with any request.

Contact

Questions about this policy or your data: gmmr.mostakim@gmail.com or WhatsApp +91 98367 65748.

Home · Support · Privacy policy · Terms