Privacy policy
Last updated 5 November 2026
What's in the Box is a Shopify app that shows shoppers what’s inside a product bundle. This policy explains what the app reads from your store, what it keeps, why, and for how long. It also covers this website.
Who we are
What's in the Box is run by Franco Tanzarella, an individual based in the United Kingdom. Contact us at franco.tanzarella@proton.me about anything in this policy.
What the app reads from your store
When you install the app, Shopify gives it access to your products. It reads:
- Your bundles. Which products and variants each bundle contains, and how many of each.
- The products inside them. Titles, variant names, handles, main photos and whether each one is live on your online store.
The app never reads your customers or your orders. It has no access to names, email addresses, phone numbers or addresses.
What the app changes in your store
The app saves one field on each bundle product: the list of what’s inside, which the product page block shows. You can see it in your Shopify admin but not edit it. The app never changes titles, descriptions, prices, stock or anything else.
What the app keeps on our server
- Your store’s connection details. Your shop domain and the access token Shopify issues to the app.
- Your plan. Whether your store has a paid plan, and your store’s and the app’s Shopify IDs, which we need to ask Shopify. Shopify handles all payments. We never see card details.
Bundle lists live in your store, not on our server.
Why we use it
We use this data only to show what’s in your bundles on your product pages, keep those lists up to date and check your plan. We don’t sell it, share it for advertising or use it to profile anyone. Under UK and EU data protection law, we rely on our contract with you, the merchant, to provide the app.
Where it’s stored and who else handles it
- netcup GmbH hosts our server in Vienna, Austria, inside the European Union.
- Shopify provides the store data and handles billing, under Shopify’s own privacy policy.
Data is sent over encrypted HTTPS connections. Only we can log in to the server.
How long we keep it
- When you uninstall the app, we delete its access token straight away, and the block disappears from your product pages.
- 48 hours after you uninstall, Shopify asks us to erase your store’s data, and we delete everything we hold for it.
- Our server logs record requests, including IP addresses and shop domains, to keep the app secure and fix problems. They are deleted after 30 days.
Your customers’ privacy requests
The app holds no data about your customers. When Shopify sends us a customer’s request to see or erase their data, there is nothing to return or delete. We still answer every request Shopify sends.
This website
This website sets no cookies and uses no analytics or advertising trackers. Fonts load from Google Fonts, which receives your IP address to deliver them.
Your rights
You can ask us for a copy of your data, ask us to correct or delete it, or object to how we use it. Email franco.tanzarella@proton.me and we’ll reply within one month. Uninstalling the app also deletes your data as described above.
If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live.
Changes
If we change what the app collects or how we use it, we’ll update this page and the date at the top before the change takes effect.