Privacy Policy

Effective date: September 21, 2026
Last updated: September 23, 2026

This Privacy Policy explains how Bulki, LLC (“Company,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information in connection with BulkiApps, its modules and integrations, BulkiApps.com, and our support services (collectively, the “Services”).

1. Our privacy roles

Merchants generally control the purposes of processing through their stores and enabled modules. Bulki, LLC acts as their processor/service provider under the DPA, including for direct widget submissions. Merchants provide their own notices. Company separately controls its own account administration, website, business communications and necessary legal/security records. That role does not authorize repurposing merchant-controlled Shopper data. See Shopper information.

2. Information we may collect

Collection depends on enabled features, authorized access and the information submitted:

• Merchant accounts: names, business contacts and roles; Shopify store/account identifiers; locale/time zone; installation, permissions, configuration, plan and billing metadata. App charges are billed through Shopify; Company does not receive or store payment-card details.
• Commerce: products, collections, variants, inventory, discounts, themes, fulfillment and relevant cart/order or transaction-status information needed for enabled functions.
• Shoppers: submitted contacts, subscriptions and choices, product preferences, referrals, form/quiz answers, public contributions, and authorized customer/order data described in the Schedule.
• Content: text, ratings, questions, answers, photos, videos, customization files, attachments and metadata. Free text and uploads may reveal personal information even when not requested.
• Technical records and analytics: IP addresses, browser/device information, timestamps, referring pages, views/clicks, authentication, diagnostics, errors and security events; on BulkiApps.com, analytics data and session recordings of mouse movements, clicks and scrolling, with input fields masked; and in the app, records of how merchant staff use features.
• Browser storage: cookies, local/session storage, pixels and service workers described in Cookie Policy.
• Communications: support messages, feedback, surveys and related correspondence or meeting notes where applicable.

3. Feature and Data Schedule

This Schedule forms part of the DPA. Processing depends on enabled features and authorized access; shared Shopify permissions do not mean each module reads every available field. Protected customer data remains subject to Shopify approval. Schedule version: 2026-09-23. Company retains accepted versions; expanded purposes require the DPA's instructions, notices and permissions.

Unless specified below, Merchant configuration and catalog records are retained for the active service purpose. All periods are subject to earlier purpose expiry, valid requests and Section 9's deletion limits. Shopify and the listed infrastructure providers process data needed for their functions; public exposure and additional recipients are identified below. See Cookie Policy for browser-storage duration and choices.

Shared technical processing: features may send views, clicks, named events and page/surface context through the app proxy; Company stores daily shop/feature counts. Shopify and hosting providers may process IP addresses and request metadata for delivery, rate limiting and diagnostics. This activity is not inherently anonymous. Notification delivery and preference records follow Section 9.

4. Sources of information

Sources are Merchants and staff, direct Shopper submissions and browser interactions, authorized Shopify APIs/events, lawful imports, selected integrations and necessary service providers. The Schedule identifies feature-specific sources. We do not treat Shopify API access as a substitute for a required notice, lawful basis or Shopify approval.

5. Why we use information

We use data to provide enabled features and chosen communications; authenticate and administer accounts; synchronize authorized records; provide support; maintain security and reliability; handle valid requests and legal obligations; and keep necessary business records. Company may communicate with its own business contacts where lawful. We also use analytics to understand and improve how our website and app are used, and advertising technologies on BulkiApps.com to measure and target our own ads (Sections 8 and 11). Shopper data from Merchant stores is never used for these purposes.

Merchant-controlled data is not available for Company's unrelated advertising, competitive benchmarking, unrestricted product development or cross-merchant profiling. New incompatible uses require the necessary notice, lawful basis and consent. If we de-identify data, we take reasonable measures to prevent re-identification, and Shopify and DPA restrictions, including the AI-training restriction, still apply.

6. Who receives information

Recipients include Shopify; infrastructure, communications and other contracted providers; Merchant and its authorized recipients; Merchant-selected integrations; and, for Company's own website and app, the analytics providers and advertising partners listed in the Cookie Policy. Public submissions expose only the fields approved for publication and may be indexed. We may also disclose necessary information to confidential professional advisers, lawful authorities or recipients protecting legal rights and safety, and transaction counterparties in a merger, financing, reorganization or asset sale, subject to applicable privacy protections.

7. AI and machine-learning use

No AI-provider integration is used. Merchant Data, Customer Data and derived information are not used to train or improve AI/ML models without separate written, feature-specific authorization satisfying DPA Section 7, Shopify requirements and law. Ordinary recommendations or automation do not supply that authorization.

8. Sale, sharing, targeted advertising, and profiling

Company does not sell or share Personal Data processed solely for a Merchant, as those terms are defined by applicable privacy law, or use it for Company's targeted advertising. This includes exchanges for non-monetary value. Company does not use that data for its own decisions producing legal or similarly significant effects about Shoppers.

Company's own website, BulkiApps.com, uses advertising technologies from Google and Meta, and Microsoft Clarity, whose data Microsoft also uses for advertising (see the Cookie Policy). Under California law and some other state laws, letting these partners collect identifiers and browsing activity on BulkiApps.com can be a “sale” or “sharing” of personal information, or targeted advertising. You can opt out as described in Section 15, and we treat a Global Privacy Control signal as an opt-out. Company may also upload email addresses that people give it directly, such as through website sign-ups, demo requests or support, to Google and Meta, which match them in hashed form to show Company's ads or to reach similar businesses; opting out under Section 15 removes your address. Company never uploads data it receives through Shopify, and does not sell or share Shopper data or app usage data, or use them for targeted advertising. Categories, recipients and choices appear below and in the Cookie Policy.

9. Retention and Shopify deletion requirements

We retain data for the stated purpose and the period or objective criteria in the Schedule and collection notice. Purpose expiry, withdrawal or valid requests may require earlier deletion.

Shopify-covered Merchant Data, including originals and copies in backups and logs, is deleted within 30 days of uninstall, no longer being needed, or an enforceable deletion request, except where law prohibits or varies the requirement. Backups and routine retention do not extend this deadline, and if we restore a backup we re-apply deletions. Records we must keep by law are used only for that purpose and deleted when the obligation ends.

Company keeps its own records as follows: billing and tax records for 7 years; contracts, acceptance records and arbitration opt-outs while the app is installed and for 4 years afterwards; support emails for 2 years after the conversation ends; server and security logs for 30 days; and website and app analytics for up to 14 months. We do not use these records to keep Merchant Data that must otherwise be deleted. Return/export assistance follows DPA Section 15.

Terminal sent/failed/bounced notification records use 90 days; old event payloads use 30 days when no active send depends on them. Subscription/suppression records remain only as needed for the request or choice. Removing a name or contact detail does not remove personal information written into review or question text or shown in media; where a deletion request requires it, we also remove or edit that content, working with the Merchant.

10. Security

We maintain safeguards appropriate to the information and risks, including the commitments in DPA Annex B for merchant-controlled Personal Data. Access is restricted to authorized purposes. No system can guarantee absolute security. Security concerns may be reported to support@bulkiapps.com. We provide legally and contractually required incident notices and assistance.

11. Cookies, browser storage and choices

Our cookie and browser-storage information is set out in the Cookie Policy. It lists each technology we use, what it stores, how long it lasts and how to change your choices.

12. Privacy requests and general U.S. privacy rights

Depending on applicable law, individuals may request access, correction, deletion, portability, restriction, objection, withdrawal, sale/sharing or targeted-advertising opt-out, sensitive-data limits, opt-outs from certain profiling producing legal or similarly significant effects, and appeals. Exceptions and proportionate verification depend on the right; opt-outs are not subject to verification where prohibited. Authorized agents may act as permitted by law.

For Merchant-controlled data, contact the store; Company will assist and route requests received. For Company's own processing, email support@bulkiapps.com. We meet applicable deadlines, explain lawful extensions or refusals, and provide required appeal and authority routes. Use "Privacy Appeal" in the subject for an appeal. We do not unlawfully discriminate or retaliate for exercising rights.

13. California Notice at Collection

This Notice at Collection addresses Company's processing as a covered California business, where applicable. The following table identifies categories, purposes, sale/sharing status and retention. Merchant-controlled collection is also explained by the Merchant's own notice and the Feature and Data Schedule. The applicable collection point links to the relevant notice at or before collection.

We do not use or disclose sensitive personal information for purposes requiring a California right to limit unless expressly disclosed and supported by legally required controls.

If we begin collecting a new category or using information for a materially different or incompatible purpose, we will provide an updated notice and obtain consent where required before the new collection or use.

14. California preceding-12-month disclosure

The following table describes Company's relevant practices during the preceding 12 months where the CCPA applies to Company as a business. A category marked “Not collected” is not collected in that context. Merchant-controlled feature data is separately described in the Schedule and the Merchant's notice.

15. California privacy rights

Where the CCPA applies, California consumers have the applicable access/knowledge, correction, deletion, sale/sharing opt-out, sensitive-data limitation and nondiscrimination rights described above, subject to lawful exceptions. We do not knowingly sell or share information of under-16s without required affirmative authorization.

To opt out of the sale or sharing of your personal information on BulkiApps.com, use the “Do Not Sell or Share My Personal Information” link in the website footer, which turns off the advertising technologies listed in the Cookie Policy for your browser, or email support@bulkiapps.com with the subject “Do Not Sell or Share.” We treat a Global Privacy Control signal as a valid opt-out for that browser. An emailed opt-out also removes your address from any email list Company uploads to advertising partners. Restrictions on Merchant data do not replace disclosures about Company's own activities.

Company offers no financial incentives, such as sign-up or referral rewards, for providing personal information. Merchants separately organize their own rewards and provide any required terms, opt-in, withdrawal route and data-value notice. Company does not disclose personal information to third parties for their own direct marketing. California residents may contact us about applicable Civil Code Section 1798.83 rights.

16. Other U.S. state privacy rights

Where another U.S. state privacy law applies, residents may exercise its applicable rights described in Section 12, including confirmation of processing, required third-party disclosure information, opt-outs, consent revocation and appeals. Company obtains required consent for sensitive-data processing or refrains from it, and honors legally required universal opt-out mechanisms. Residents can opt out of targeted advertising and sale on BulkiApps.com as described in Section 15. Merchant instructions do not authorize unrelated sensitive-data uses.

17. Sensitive and specially regulated information

General features must not solicit specially regulated health, biometric, precise-location, government-identifier, payment-card, authentication or children's data. Any supported exception requires the separate written approval and safeguards in the DPA. Submit only information appropriate to the feature; incidental sensitive content does not authorize secondary use.

18. Children

The Service is a business tool, not directed to under-13s, and Company does not knowingly permit their direct accounts. Merchant data may include minors' information; lawful instructions, the DPA and applicable child-privacy requirements still apply. Report suspected unsupported child collection to support@bulkiapps.com so it can be restricted, removed or otherwise handled as law requires.

19. Marketing communications

Unsubscribe from Company's marketing through the message or contact us; necessary account, security, billing and legal notices may continue. Merchant messages follow that Merchant's disclosed purpose and choices. Inquiries, orders and alert signups do not authorize unrelated promotions. Use the provided withdrawal mechanism or contact Merchant. Browser settings revoke push permission but do not themselves erase all subscription records.

20. International transfers

Company processes and accesses personal information only from the United States. Vendor locations are in the Subprocessor List. We put required safeguards in place before any restricted transfer. Merchant-controlled transfers follow DPA Section 16, including completed records and valid execution. For Company's controller transfers, mechanisms and copy-request details are: not applicable. Company offers the Service only to U.S. business Merchants and does not offer it to individuals in the EEA or the United Kingdom, so Company relies on no Article 46 transfer mechanism for its own controller processing. If that changes, Company will name the mechanism in this section and provide a copy on request at support@bulkiapps.com. Copies are subject only to permitted redactions. We do not claim certification under a data privacy framework.

21. Do Not Track

Browser Do Not Track signals have no agreed standard, so BulkiApps.com and the app do not change their behavior in response to them. We honor Global Privacy Control as an opt-out of sale and sharing (Section 15). When you visit BulkiApps.com and accept optional cookies, Google, Meta and Microsoft may collect information about your online activities over time and across different websites, as described in the Cookie Policy. The app and storefront features do not use advertising technologies.

22. Changes to this Policy

We post revised notices with an updated date and provide additional notice where required. A materially expanded use of previously collected data requires any legally necessary additional steps; a notice update alone does not supply consent or change the DPA.

23. Contact us and exercise rights

Bulki, LLC
Privacy inquiries and requests: support@bulkiapps.com
For appeals, use the same email with “Privacy Appeal” in the subject line.
Website: BulkiApps.com

24. EEA and UK privacy information

This section applies where EU or UK data-protection law applies to Company's processing as controller. Where Company processes for a Merchant, that Merchant identifies its legal bases and supplies the applicable controller notice; Company assists under the DPA.

Where information is required for a contract or by law, the collection point identifies the requirement and the consequence of not providing it, such as inability to respond or create an account. Optional fields may be left blank. Consent may be withdrawn at any time without affecting prior lawful processing. You may object to legitimate-interest processing on grounds relating to your situation and to direct marketing at any time.

Subject to applicable conditions, rights include access, correction, erasure, restriction, portability, objection and protections relating to solely automated decisions with legal or similarly significant effects. Company's own processing does not use such decisions as described in Section 8. Contact us under Section 23; we respond without undue delay and within the applicable period, ordinarily one month for these rights, with notice of any lawful extension. You may complain to a competent supervisory authority, including where you live, work or believe an infringement occurred, or the UK ICO. You need not contact us first.

Company's representative and data-protection officer contact details, where required: none are required. Company offers the Service only to U.S. business Merchants and does not offer goods or services to, or monitor the behavior of, individuals in the EEA or the United Kingdom, so Article 27 does not require a representative. No data-protection officer is required under Article 37: Company is not a public authority, and its core activities do not involve large-scale regular and systematic monitoring or large-scale processing of special-category data. Privacy questions go to support@bulkiapps.com. Retention, sources, recipients and transfer safeguards are set out above for the relevant context.

25. Information for Shoppers using merchant modules

Your store Merchant generally controls feature submissions. Before submitting a review or question, check which name, text, rating and media will be public and potentially indexed; avoid including private or sensitive information. Contact details used for verification or answer delivery are not intended for publication.

Private forms and customization uploads go to Merchant and its authorized recipients for the disclosed inquiry or order. They are not public or permission for unrelated marketing. Request correction, removal or withdrawal through Merchant, or contact Company for assistance. Required records may have lawful retention rules. Public deletion cannot guarantee removal of independent copies, but legally required follow-up steps still apply.