Privacy Policy

Omnigrow Labs (“we,” “our,” or “us”) operates the Omnigrow Bundles Shopify application (“the App”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you install and use the App — and the choices you have about that information.

1. Who this policy applies to

This policy applies to:

• Merchants — Shopify store owners who install the App.
• Store visitors — customers who interact with bundle widgets on a merchant’s storefront.
• Website visitors — people who browse https://omnigrowlabs.com.

2. Information we collect

2.1 Information you provide directly

• Store & account data — when you install the App through Shopify, we receive your .myshopify.com domain, store name, store owner email address, and Shopify plan details.
• Support communications — any information you send when you contact us via email or chat (name, email address, message content, and any attachments).

2.2 Information we collect automatically

• Product & order data — via the Shopify Admin API we read products, variants, collections, and orders so we can generate bundle suggestions and display analytics. We do not store full customer‑identifying order details.
• Bundle interaction data — when a customer views or adds a bundle to their cart on your storefront, we record the anonymous event (bundle ID, discount applied, timestamp).
• Usage analytics — anonymized page views, feature clicks, and session durations within the App admin, collected via a privacy‑focused analytics tool.

2.3 Information we do NOT collect

• We do not store customer names, email addresses, phone numbers, shipping addresses, or payment details.
• We do not scrape or export your customer lists.
• We do not use session recording or heat‑mapping tools that capture keystrokes or mouse movements on your storefront.

3. How we use your information

We use the information we collect to:

• Deliver the App’s features — creating bundles, quantity breaks, AI suggestions, analytics dashboards, and storefront widgets.
• Generate AI bundle suggestions based on your product catalog and order patterns.
• Calculate and display analytics (revenue, orders, AOV, conversion rate) tied to your bundles.
• Communicate with you about your account — support replies, product updates, and billing notices.
• Improve the App — we analyze anonymized usage data to fix bugs, tune performance, and build features merchants ask for.
• Comply with legal obligations, enforce our terms, and prevent fraud or abuse.

4. Legal bases for processing (UK / EEA / CH)

If you are located in the UK, European Economic Area, or Switzerland, we rely on the following legal bases:

• Contractual necessity — processing your store data to provide the App’s core functionality.
• Legitimate interests — improving the App, securing our systems, and responding to support requests in a way that does not override your rights.
• Consent — where required by law (e.g. optional marketing communications). You may withdraw consent at any time.

5. Data sharing & third parties

We share data only in the following circumstances:

• Shopify — your store data flows through Shopify’s APIs. Shopify’s own privacy practices govern the data you host on their platform. See Shopify’s Privacy Policy.
• Service providers — we use sub‑processors for cloud hosting (e.g. AWS, Vercel), database hosting, monitoring, and customer support tools. Each sub‑processor is bound by a data‑processing agreement (DPA).
• Legal & compliance — if required by law, court order, or governmental authority, or to protect the rights, property, or safety of Omnigrow Labs, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, your data may be transferred as a business asset, subject to the same protections.

We never sell, rent, or trade your personal data — or your customers’ data — to third parties.

6. Data retention

• Active stores — store configuration, bundle definitions, and analytics data are retained while the App is installed.
• Uninstalled stores — within 48 hours of uninstallation, we delete all store‑specific data (bundles, settings, analytics). Anonymized, aggregate analytics that cannot be tied back to your store may be retained for product‑improvement purposes.
• Support communications — retained for up to 24 months after your last interaction for continuity of service.
• Backups — encrypted backups may retain data for up to 30 days before being permanently destroyed.

7. Data security

We implement and maintain appropriate technical and organizational measures to protect your data:

• All data is encrypted in transit (TLS 1.3) and at rest (AES‑256).
• Shopify API access tokens are encrypted and scoped to the minimum permissions the App requires.
• Access to production data is limited to authorized personnel and logged.
• We conduct regular security reviews and apply patches promptly.
• We follow Shopify’s app‑security best practices.

No method of electronic transmission or storage is 100% secure. We strive to protect your data but cannot guarantee absolute security.

8. Your rights

8.1 For merchants (depending on your jurisdiction)

• Access & portability — request a copy of the personal data we hold about you in a structured, machine‑readable format.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations.
• Restriction & objection — restrict or object to certain processing of your data.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at support@omnigrowlabs.com. We will respond within 30 days.

8.2 For store visitors (end customers)

Our App displays bundle widgets on merchant storefronts. We do not collect or store personal data about store visitors. If you are a customer of a store that uses Omnigrow Bundles and you have a privacy concern, please contact the merchant directly — they are the data controller for your shopping experience.

9. CCPA / CPRA notice (California residents)

Under the California Consumer Privacy Act and California Privacy Rights Act:

• We do not sell or share personal information as defined by the CCPA.
• We do not use or disclose sensitive personal information for purposes other than providing the App.
• California residents may request access to, correction of, or deletion of their personal information by emailing support@omnigrowlabs.com.
• We will not discriminate against you for exercising your CCPA rights.

10. International data transfers

Omnigrow Labs is based in Pakistan, and we use cloud infrastructure located in the United States and European Union. When we transfer personal data across borders, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) where required — so your data receives an equivalent level of protection wherever it is processed.

11. Cookies & similar technologies

Our website (https://omnigrowlabs.com) may use strictly necessary cookies for session management and security. The App’s admin dashboard uses a secure session token stored in your browser. The storefront bundle widget does not drop cookies on your customers’ browsers.

We use a privacy‑focused analytics tool that does not rely on third‑party cookies or fingerprinting. You can opt out of analytics collection by enabling “Do Not Track” in your browser.

12. Children’s privacy

The App is not directed at individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@omnigrowlabs.com and we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and notify active merchants via the App dashboard or email for material changes. Your continued use of the App after changes are posted constitutes acceptance; we encourage you to review this page periodically.

14. Contact us

If you have questions, concerns, or want to exercise your data rights, reach out to:

15. Supervisory authority

If you are in the UK, EEA, or Switzerland and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local data‑protection supervisory authority. In the UK, that is the Information Commissioner’s Office (ICO).

Need a Data Processing Agreement (DPA)? Email support@omnigrowlabs.com and we’ll send you a signed copy within two business days.