Privacy Policy — Wicked Box Builder

Last updated: 7 July 2026 · WickEdCommerce

Wicked Box Builder is a Shopify app that lets a store's customers fill a box across multiple orders and have everything ship together. This policy explains what data the app processes, where it lives, and how it is protected. The short version: your data stays in Shopify — the app keeps no database of its own.

Data the app processes

• Store configuration — programme settings (box size, pricing, messaging, eligibility rules). Stored inside your own Shopify store as app-owned metaobjects and metafields.
• Customer box state — slots used, box status, order references, and box value, stored as metafields on the customer record in your own Shopify store. To show merchants whose box is whose, the app reads customer names, email addresses, and tags through Shopify's Admin API.
• Order contents — when an order is paid, the app reads its line items to count them toward the customer's box, and places a fulfilment hold so the order ships with the rest of the box.
• A per-store API token — the only data held outside Shopify. It is stored encrypted in Cloudflare Workers KV and exists so the app can process order webhooks. It contains no personal data.

What the app does not do

• No customer personal data is stored outside Shopify.
• No data is sold, rented, or shared with third parties.
• No advertising, tracking, or profiling of any kind.
• No automated decisions with legal or similar effects.

Where processing happens

Order webhooks are processed by a Cloudflare Worker (Cloudflare is the app's only subprocessor). Each webhook is authenticated with Shopify's HMAC signature, processed in memory, and the results are written straight back to your Shopify store. All traffic is encrypted in transit (TLS) and all storage is encrypted at rest.

Retention and deletion

• Customer box data lives on the customer record, so it is deleted by Shopify along with the customer — including when a customer requests erasure (GDPR/CCPA). The app holds nothing extra to delete, and acknowledges Shopify's customers/redact requests.
• Customer data access requests (customers/data_request) are fully covered by Shopify's own data export, because all box data lives in your store.
• When you uninstall the app, Shopify's shop/redact request (48 hours after uninstall) triggers deletion of the store's API token — the only thing the app holds. Configuration metaobjects and metafields are removed by Shopify with the app's data.

Merchant responsibilities

You remain the data controller for your customers' data. Wicked Box Builder processes it solely on your behalf, to run your box programme. Include your use of the app in your own store privacy policy where your local law requires it.

Contact

Data questions or requests: mike@wickedcommerce.co.uk. We respond to privacy requests within 30 days.