Privacy Policy.

Last updated: 9 October 2026

1. Who we are, and our role in your data

Vunda is a product operated by Blue Sky PPC Ltd, a company registered in England and Wales (company number 13739023), with its registered office at Suite GA, St George's House, Lever Street, Wolverhampton, WV2 1EZ. For any privacy-related enquiry, contact us at support@vunda.app.

We handle two different kinds of data, and our role is different for each. It matters, because it determines who you should go to about your data.

Data we control. For merchant account details, the app configuration you build, visitors to this website, and our marketing waitlist, Blue Sky PPC Ltd is the data controller. We decide why and how that data is used, and this policy is our notice to you about it.
Data we handle for a merchant.For a merchant's own customers' data, meaning the shopper information the app features in section 5 produce, we act as a processor and the merchant is the controller. We only receive that data because the merchant switched on the feature that produces it, we act on their instructions, and we do not use it for our own purposes or sell it.

If you are a shopper using a merchant's app and you want your data seen, corrected or deleted, the merchant who runs that app is your first point of contact. You can also contact us at support@vunda.app and we will pass your request to them.

Our Data Processing Addendum covers the processor role described above and forms part of our Terms of Service. Merchants can request a signed copy from support@vunda.app.

2. Information we collect

We collect the following categories of information:

Account information - your store owner name and email address, obtained from Shopify when you install the app, together with the Shopify session and store identifiers used to authenticate you inside the Shopify admin.
Shopify store data - when you install the app, you authorise Vunda to access your store information, products and collections through the Shopify Admin API, along with an access token, stored encrypted, that keeps your app in sync.
App content you create - the app design, layout, branding, colours and any media you upload while building your app. Section images, video and logos are uploaded to your own Shopify Files; app build assets such as custom fonts and app icons are stored on Vercel Blob. Your app configuration is stored in our database.
Your customers' data, for the features you enable - if you turn on push notifications, Judge.me reviews or Google Analytics, shopper data is collected and shared with the relevant provider. Section 5 sets out exactly what, for each feature. None of it is collected if you leave those features off.
Marketing waitlist - if you join our pre-launch waitlist on this site, we store the email address you give us so we can tell you when Vunda is available.
Website usage and device data - IP address, browser type, operating system, pages visited, referring URLs and interactions with this site.
Abuse-prevention data- we keep short-lived counters keyed to the IP address of the device making a request, or to a merchant identifier on authenticated calls, so we can rate limit and block abuse. This covers our public mobile API, so it includes shoppers using a merchant's app, as well as public forms on this site. These records expire automatically a short time after the rate-limit window they belong to, and are not used for anything else.
Product analytics data - interactions, clicks, page views, and session recordings and error reports, collected via PostHog. On this website, none of this is collected unless you accept analytics. See sections 6 and 9.
Crash diagnostics from published apps- when a merchant's app crashes or errors, a diagnostic report is sent to our error-tracking provider, Sentry, in our own account. It is configured not to send personal information by default, and the only identifying detail we attach is which merchant's app it came from. We cannot rule out that a crash report incidentally contains data from the moment of the crash.

3. How we use your information

To provide, maintain and improve the service.
To connect your Shopify store and keep your app in sync with your products and collections.
To build, preview, and publish your app to the Apple App Store and Google Play.
To set up the push notification provider you choose to enable, so your app can receive the push you send from that provider.
To authenticate you and secure your account.
To send you service and account communications, and to contact waitlist subscribers about launch.
To measure how our funnel and product are used, where you have accepted analytics, so we can improve them.
To diagnose crashes and errors in published apps so we can fix them.
To detect fraud, rate limit our public API, prevent abuse, and maintain security.

4. Legal basis for processing (UK GDPR)

Under UK GDPR, we process your personal data on the following legal bases:

Contract - processing necessary to provide the service you signed up for, including connecting your store, building your app and publishing it.
Consent - for analytics on this website, and for marketing communications including the waitlist. Analytics on this site are switched off until you actively accept them, and you can decline or later withdraw consent without losing any functionality.
Legitimate interest - for security, fraud prevention, rate limiting, crash diagnostics and improving the service, where these interests are not overridden by your rights.

Where we act as a processor for a merchant, as described in section 1, we process on that merchant's instructions. The merchant is responsible for having a lawful basis for the shopper data their app collects, and for telling their shoppers about it in their own privacy policy.

5. Your Shopify store and your customers' data

Vunda's standing access to your Shopify store is limited to the data needed to build and run your app, primarily your products, collections and store information. Beyond that, shopper data is only collected by the features you choose to switch on. Each one is set out below, so you can match your own privacy policy and your App Store and Google Play data disclosures to it.

Abandoned-cart reminders (discontinued).Vunda no longer collects cart activity or sends reminder pushes. Records collected before 24 September 2026 (a signed-in shopper's Shopify customer identifier and a short cart summary) are no longer used and are deleted as described in section 10.
Push notifications. If you enable a push provider (OneSignal or Klaviyo), your app identifies each signed-in shopper to that provider directly. It sends their Shopify customer identifier, email address, phone number(used to create the provider's SMS subscription) and first and last name, along with their device push token. Your app also reports their shopping behaviour to that provider, so it can target and personalise sends. With OneSignal that is stored against the shopper as profile tags: the last product viewed (identifier and name) and when, cart updates and the product involved, and whether checkout was started together with the checkout value and item count. With Klaviyo the equivalent is sent as viewed product, added to cart and started checkout events, carrying the product identifier and name, price, currency and quantity, and the checkout item count and item names. If you do not enable a push provider, none of this is sent, and guest shoppers are never identified.
Vunda push.If you choose Vunda push as your push provider, the app asks each shopper whether they want notifications. Only for shoppers who say yes, it sends us their device push token, the device platform (iOS or Android), the app version, the device language and time zone and, when they are signed in, a pseudonymous reference derived from their Shopify customer identifier (we never store the identifier itself). We use this to deliver the notifications you send, from campaigns and automated flows, and we record which notifications each phone was sent and whether it opened them, so you can see how many were opened. To deliver them, the token and the notification content pass through Expo's push service, which hands them to Apple or Google. When a shopper asks to be told about a drop or a sold-out size, we also keep, against that phone's push token, the drop reminders they set (the drop and the lead times they chose), the alerts they asked for (a sold-out product and the size or option, a collection, or the search words they typed when nothing matched), and the notification types they turned off. We also keep a copy of the title and text of each notification a phone was shown, so the app's Notifications screen can list the last 30 days of them. An alert request is used once, when the item or a match arrives, and deleted after 90 days at the latest; a reminder is deleted 30 days after its drop opens, or when the drop is archived. All of it is deleted with the token when the shopper turns notifications off. If the shopper also asks for a restock email, the app sends their email address straight to the merchant's Klaviyo account; we never receive or keep it.
Vunda push in-app activity.This applies only when in-app activity tracking is turned on for your store; until then the app does not send it and we store none of it. Once it is on, and only for shoppers who allowed both notifications and usage analytics, the app tells us when the shopper views a product, adds a product to their wishlist, adds items to their cart, starts checkout and completes an order. Each event holds the time, the Shopify product ids involved, a pseudonymous reference to the phone and, when the shopper is signed in, the pseudonymous customer reference described above. Checkout and order events also hold a pseudonymous cart or order reference, and order events hold the order total and currency and, if the shopper opened one of your notifications in the 24 hours before, which one. We never store the shopper's name, email address, phone number, postal address or product titles with it. We use it only to run your automated flows (such as browse abandonment, abandoned checkout, back in stock, price drop and post-purchase) and to show you how many orders followed a notification. You see totals only, never an individual shopper's activity.
Shopify customers and orders for push. Only if you grant Vunda access to your Shopify customers or orders, which Vunda does not ask for today, we will also keep, for each customer, a pseudonymous customer reference, the time of their last order and an order count, to run win-back and post-purchase flows and to credit orders to notifications.
Rewards tiers in Shopify.This applies only if you run a rewards programme with tiers, turn on "Mirror tiers to Shopify" and grant Vunda write access to your Shopify customers. We then write each member's tier onto their Shopify customer record: a customer tag (for example vunda-tier-gold), replaced when the tier changes, and a Vunda app field on the customer (the $app:tiercustomer metafield) holding the tier id, so your segments, discounts, Shopify Flow, POS, theme and customer accounts can use it. Your storefront and the customer's own account can read that field. We identify members by a pseudonymous reference derived from their Shopify customer identifier and do not store the identifier itself. If you also turn on enforced free delivery, we create one customer segment on those tags and one automatic free-shipping discount scoped to it. The tag and the field live in your Shopify store, under your control; our own copy of a member's tier is deleted when Shopify asks us to erase that shopper's data.
Rewards redemption.This applies only if you let shoppers spend rewards points and grant Vunda access to create discounts. When a signed-in member redeems a reward, we keep a redemption record: the member's pseudonymous reference (never their Shopify customer identifier), the reward, its points, the single-use discount code issued to them, its expiry and whether it is held, spent or released. When an order is paid, we read the discount codes on it to match a reward code and mark those points spent; if the order's customer is not the member the code was issued to, the redemption is flagged for your review. Codes live in your Shopify store under one discount per reward; a used or released code is deleted from Shopify. Redemption records are deleted 400 days after they settle, and when Shopify asks us to erase that shopper's data.
Drop purchase limits. This applies only if you turn on checkout enforcement for a drop with a per-customer limit and grant Vunda access to your orders and customers. To know how many units of each drop a customer has already bought, we keep a running count on their Shopify customer record (a Vunda app field, the $app:vunda.drop_purchasescustomer metafield, holding drop ids and unit counts only), which our checkout rule reads at checkout. To keep that count right when an order is created, cancelled or refunded, we keep, for each counted order, the order identifier, a pseudonymous reference derived from the customer identifier (never the identifier itself) and the units it added. Those order rows are deleted after 400 days, or sooner when Shopify asks us to erase that shopper's data. The checkout rule reads only the customer's id, tags and that field, never their name, email address or postal address.
Drop sales counts.This applies only if you turn on "bought" wording or "bought in the last hour" for drops and grant Vunda access to your orders. From each new order we read only the product identifiers and quantities, and keep per-product unit totals in short time buckets, deleted after 2 days. We keep nothing about who placed the order.
App-only offers.If you run an app-only offer, each app install can claim one single-use discount code. We keep the code with an opaque id for the app install that claimed it and when, to give each install one code. We do not receive the shopper's name or contact details with it.
Collect in store.If you turn on Collect in store, the store a shopper chooses is kept on their phone only and is passed to Shopify checkout as their pickup preference; we do not receive it. In app builds that may use the phone's location, and only after the shopper allows it, the app sends their position straight to Shopify to sort your stores by distance; we do not receive or keep it.
Members early access.This applies only if you give a drop an early window or make it members only for your rewards tiers. When a signed-in shopper opens that drop, the app sends their Shopify customer account sign-in token to our server so we can confirm with Shopify who they are; we do not store or log the token. We then answer with their rewards tier and how many units of each drop they have already bought, from the records described under "Rewards tiers in Shopify" and "Drop purchase limits". We keep nothing new for this. If you turn on checkout enforcement, our checkout rule reads the customer's tier tag at checkout.
Draws.This applies only if you run a draw (a raffle) for a drop. When a shopper enters, we keep an entry with a random entry code, the size they chose, an opaque id for their app install, and, if they are signed in, a pseudonymous reference derived from their Shopify customer identifier (before a win, never the identifier itself). If you allow entries without signing in, the shopper gives their email address, and we keep only a one-way keyed hash of it, never the email itself, so the same email cannot enter twice and a win can later be matched to the account that owns that email. For a members-only draw we read the shopper's tags from your Shopify store to check their tier. A winner gets a claim written to their Shopify customer record (a Vunda app field holding the size and deadline), which our checkout rule reads. While that claim is open, and until it has been cleared from their customer record, we also hold the winner's Shopify customer identifier on their entry; it is removed once the claim is spent or expires, or when Shopify asks us to erase that shopper's data. To confirm a claim we read the claiming order's customer, items, payment status and original cart token, never their name or address. Before opening a draw checkout, we verify the cart's customer and item and retain an encrypted cart identifier and a pseudonymous cart reference on the entry so an interrupted checkout can resume the original cart and cannot spend two awards. This private identifier is not shown in public draw results and is deleted with the entry. A separate payment-allocation receipt keeps pseudonymous customer, device, order and original-cart references, the purchased variant and award code for 90 days after the payment order was created. This prevents a paid order being reused after an entry expires. It contains no cart access key or customer name. Turning notifications off keeps this receipt; customer or store erasure deletes it. To match a guest win, we ask Shopify for the signed-in account's email address, compare its hash and do not keep it. Turning notifications off does not delete an entry. Entries are deleted when the shopper withdraws before the draw runs, 90 days after the draw closes, or sooner when Shopify asks us to erase that shopper's data or the store's data. If removal of an active purchase claim from Shopify fails during customer erasure, its entry and cleanup ownership are retained for retry until Shopify confirms removal; the entry cannot start another claim or checkout during cleanup. The public results page for a draw shows entry codes only, never who entered.
Sign-up forms. If you add a sign-up form to your app, a shopper who signs up gives their email address and, only if your form asks for them, their first name and mobile number, with their email and (separately) SMS marketing consent. These go to the destination you choose: with a Klaviyo list, the app sends them directly to Klaviyo; with Shopify customers, a signed-in shopper is subscribed through their own Shopify customer account, and a shopper who is not signed in (once Vunda supports it) is passed through our server to your Shopify store. We do not keep the email address, name or mobile number. To give each app install one reward code, we keep the code with an opaque id for the app install that claimed it. For a sign-up that passes through our server we keep only a pseudonymous reference derived from the email address, to stop the same person signing up twice, and a record that the sign-up was sent. Both are deleted when Shopify asks us to erase that shopper's data.
Judge.me reviews.If you connect Judge.me, our server fetches your reviews on the app's behalf using your Judge.me credentials, so review text and reviewer names pass through our systems on the way to your app. Your Judge.me private token is stored encrypted and is not shown back to you or anyone else through our admin.
Google Analytics 4. If you enable Google Analytics, your app sends shopper activity events (screen views, product views, add to cart, begin checkout and purchase) to your ownGoogle Analytics property, using Google's Firebase SDK. Google processes that data for you, not for us, and we do not receive it.

Your push provider, and Judge.me and Google where you connect them, act as processors for you, under your own agreements with them. See OneSignal's privacy policy at onesignal.com/privacy, Klaviyo's at klaviyo.com/legal/privacy-notice, Judge.me's at judge.me/privacy, and Google's at policies.google.com/privacy.

Because you publish your app under your own developer accounts, disclosing all of this to your shoppers is your responsibility. Keep your privacy policy, your App Store privacy details and your Google Play Data safety form in step with the features you turn on.

6. Analytics and your choices

We use PostHog for funnel and product analytics, session replay and error tracking, to understand how people use the service and to find and fix issues. PostHog may collect interaction data, page views, session recordings (which can capture mouse movements, clicks and page content) and error reports. Our PostHog data is stored in the EU (Frankfurt).

Analytics are off by default and stay off until you accept them. PostHog starts opted out on every visit to this website: nothing is captured and no analytics storage is written to your device until you accept the banner. If you decline, that choice is remembered and we do not ask again, and nothing is captured. If you accept, you can withdraw consent at any time by clearing this site's data in your browser, which returns you to the opted-out state, or by contacting support@vunda.app.

Vunda's admin runs embedded inside the Shopify admin, where we do not show a consent banner. Because there is no way to ask you there, analytics stay switched off entirely on those screens.

We do not use advertising pixels such as the Meta Pixel or Google Ads tracking on this site. For more information, see PostHog's privacy policy at posthog.com/privacy.

7. Third-party services and sub-processors

We rely on the following providers to operate the service:

Shopify - store integration via the Shopify Admin API, and authentication via the App Bridge session token, under your authorisation.
MongoDB Atlas - hosting for the database holding your account, app configuration and the feature data in section 5.
Vercel - web hosting, infrastructure, and storage for app build assets (Vercel Blob).
Expo (EAS) - the build and submission service that compiles and ships your app. It receives your merchant identity, your store domain, your app configuration and branding, and the build credentials and secrets needed to produce and upload your app. For Vunda push only, it also delivers your notifications: it receives the shopper's device push token and the notification content, and passes them to Apple or Google. Otherwise no shopper data is sent to Expo. United States.
PostHog - product analytics, session replay and error tracking on this website, only after you accept analytics (EU / Frankfurt).
Sentry - crash and error reporting from published apps, into Vunda's own account, so we can fix faults. EU / Germany.
OneSignal - mobile push delivery and shopper push profiles, used only where you select it as your push provider; acts as a processor for you.
Klaviyo - the alternative mobile push provider, used only where you select it instead; acts as a processor for you.
Judge.me - product reviews, used only where you connect it. Review content and reviewer names pass through our server on the way to your app.
Google - Firebase and Google Analytics 4, used only where you enable analytics in your app and sending to your own property; and Google Play, where your app is published under your own developer account.
Apple - the App Store, where your app is published under your own developer account.

When you pay to publish your app, billing is handled by Shopify App Pricing on your Shopify invoice; we do not process or store your card details.

8. International data transfers

Vunda is operated from the United Kingdom. Our PostHog analytics data is stored in the EU (Frankfurt) and our Sentry crash data in the EU (Germany). Expo, which runs our app builds, is based in the United States, and several of the other providers in section 7 operate internationally, including from the United States. Where we have not named a region for a provider above, we are not making a claim about where that provider stores data; contact support@vunda.app if you need current details for a specific one.

When your data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Extension to the EU Standard Contractual Clauses, or adequacy decisions where applicable. By using the service you acknowledge that your data may be processed in the UK, the EU, the US and other countries where our providers operate.

9. Cookies and similar technologies

Essential cookies - required for authentication, session management and security. These cannot be disabled.
Analytics storage - set by PostHog to understand product usage and to capture session recordings and error reports. None of it is written until you accept analytics on the banner. Decline and nothing is stored.
Your consent choice- we record whether you accepted or declined in your browser's local storage rather than in a cookie, so that remembering your answer does not itself place a cookie. It stays on your device and is not sent to us.

We do not set advertising cookies. Inside the embedded Shopify admin there is no banner and no analytics storage is written at all. You can control cookies through your browser settings, though disabling essential cookies may affect how the service works.

10. Data retention and deletion

We retain your account and app data for as long as your account is active, except where we are required to keep something longer for legal, accounting or security reasons. Specifics:

Uninstalling the appends your session and removes the Expo build resources for your app, but it does not by itself erase your stored data. Shopify then sends us a store redaction request, normally about 48 hours after the uninstall, and that request is what triggers the erase of your store's data from our database.
Abandoned-cart reminder data is no longer collected. Any remaining records are deleted automatically within 14 days of their last activity, and immediately when Shopify sends us a customer redaction request.
Vunda push device tokens are deleted as soon as the shopper turns notifications off in the app, when Shopify sends us a customer redaction request for that shopper, and automatically once a token has gone unused for about 270 days. A token that Apple or Google report as no longer valid is never used again. The delivery tickets Expo returns for each send are deleted within two days.
Vunda push campaign and flow recordsare deleted automatically: the record of each notification sent to a phone after 90 days; in-app activity events, when in-app activity tracking is on, 90 days after the event; the products a phone is waiting on for back-in-stock or price-drop notifications 30 days after it last viewed or wishlisted them; a shopper's progress through a flow 120 days after it ends; and orders credited to a notification, and last-order records where you grant order access, after 400 days. When a shopper turns notifications off, everything held for that phone is deleted at once, except a pseudonymous marker that the phone already received a once-per-phone flow such as welcome, kept for up to 400 days so turning notifications off and on cannot repeat it, and the phone's draw entries (below). A customer redaction request from Shopify deletes the shopper's records, including those markers for the phones still registered to them.
Draw entriesare kept when a shopper turns notifications off or their phone stops receiving notifications, because an entry is their place in the draw and may hold a win. An entry is deleted when the shopper withdraws it before the draw runs, automatically 90 days after the draw closes, or when Shopify sends us a customer redaction request for that shopper or a redaction request for your store. A winner's Shopify customer identifier is removed from the entry once the claim is spent or expires. If Shopify cannot confirm removal of an active purchase claim during customer erasure, the entry and its cleanup ownership remain for retry until removal succeeds. Separate payment-allocation receipts expire 90 days after the payment order was created, or sooner on customer or store redaction. Turning notifications off keeps them so a previously paid order cannot be reused.
Customer erasure recovery. To finish a redaction request from Shopify after a failed or interrupted attempt, we retain an encrypted copy of the customer identifier, email and order identifiers needed for that request. These inputs remain while the request is unresolved and are removed when erasure completes, or when Shopify requests erasure of the store. The operational receipt, containing request and store references, dates and retry status without the customer inputs, expires 400 days after completion. Pending requests do not expire automatically before the erasure is finished.
Abuse-prevention records keyed to IP addresses expire automatically a short time after they are written.
Waitlist email addresses are kept until we launch or until you ask us to remove yours. They are not covered by the automated store erase, so email support@vunda.app and we will delete yours.
A small number of older stores that pre-date the current install flow are set up and run by us directly. They are outside the automated erase described above, and we handle deletion for them by hand instead. If this applies to you, contact support@vunda.app and we will confirm what we hold and remove it.

You can request earlier deletion at any time by contacting support@vunda.app.

11. Your rights

United Kingdom (UK GDPR) and EU (GDPR). You have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing or withdraw consent. To exercise these rights contact support@vunda.app; we will respond within 30 days. You may also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority. If your request concerns data we hold for a merchant as their processor, see section 1: the merchant is the controller and we will pass your request to them.

United States (California and other states). If you are a California resident you have the right to know, delete, and correct your personal information, and to opt out of its sale or sharing (we do not sell your personal information). Residents of other states with comprehensive privacy laws have similar rights. Contact support@vunda.app to exercise them.

Canada (PIPEDA) and Australia (Privacy Act 1988). You have the right to access and correct your personal information and to complain to the relevant regulator (the Office of the Privacy Commissioner of Canada, or the OAIC in Australia).

12. Data security

We use reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls, encryption at rest for stored access tokens and provider credentials, and rate limiting on our public API. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Where you have invited us into your Apple Developer or Google Play account so that we can build and upload your app, we also hold the credentials that access gives us, such as App Store Connect API keys and our Google service account key. We keep them encrypted at rest and restrict access to personnel who need it. If we become aware of a compromise of those credentials, or of unauthorised access to your developer accounts obtained through them, we will notify you without undue delay and take reasonable steps to revoke and replace the affected credentials. You can remove our access from your own accounts at any time. See section 5 of our Terms of Service.

13. Children

The service is intended for business use and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated via the email associated with your account or by notice on the site. Continued use of the service after changes take effect constitutes acceptance.

15. Contact

For questions about this Privacy Policy or to exercise your rights, contact us at support@vunda.app.