Understanding customer data permissions in Simple Bundles
Simple Bundles customer data permissions: What's changing and what you need to know
Simple Bundles follows a privacy-first approach to handling customer data. Starting June 19, 2026, the app no longer requests customer data permissions at the time of installation. Instead, the app only requests access to customer data when you enable a specific feature that requires it.
🔒 Summary for security reviewers and auditors
- Customer contact details are not stored. Simple Bundles does not keep customers' email addresses, shipping addresses, or phone numbers in its database. The source of truth is Shopify.
- Customer data access is opt-in. For stores installed on or after June 19, 2026, the app only asks for customer data permission when you turn on associated orders or the Judge.me integration.
- Store access tokens expire after about an hour. The refresh token that renews them is encrypted in our database.
- Vendor reviews: see the Simple Bundles security center or email hello@simplebundles.io from your company email address.
In this guide:
- Does this affect my store?
- What customer data does Simple Bundles access?
- Does Simple Bundles store my customers' data?
- How does this limit risk in a security incident?
- Which features require customer data?
- How to approve customer data permissions
- How to check your current permissions
- What happens if I decline the permission?
- Can I revoke access later?
Does this affect my store?
This change only applies to merchants who installed Simple Bundles on or after June 19, 2026.
If you installed Simple Bundles before June 19, 2026, your permissions are already in place. Nothing has changed and no action is needed. All features continue to work as expected.
If you installed Simple Bundles on or after June 19, 2026, customer data permission is not included by default. The app will prompt you to approve access only when you enable a feature that requires it.
What customer data does Simple Bundles access?
When granted permission, Simple Bundles can access:
- Customer name
- Customer email address
- Customer shipping address
This data is used solely in the context of the two features described below. Simple Bundles does not use customer data for marketing, analytics, or any purpose outside of these features.
Does Simple Bundles store my customers' data?
Simple Bundles does not save your customers' email addresses, shipping addresses, or phone numbers in its database. When associated orders or the Judge.me integration need customer details, the app reads them through Shopify's API only when that task runs and does not keep a copy.
| Data | Stored by Simple Bundles? |
|---|---|
| Customer email address | No |
| Customer shipping or billing address | No |
| Customer phone number | No |
| Payment or card details | No. The app never has access to them. |
| Shopify customer ID | Yes. A reference number that links a bundle order to the customer in Shopify. It contains no personal information on its own. |
| Order details (order number, line items, order note, and cart attributes) | Yes, so the app can break bundles into their items. Order notes and cart attributes are free text, so they contain whatever you or your customers enter at checkout. |
How does this limit risk in a security incident?
Because your customers' details stay in Shopify, Simple Bundles does not hold a stored list of your customers that could be exposed in a breach of our systems. Getting customer data would require a live connection to your store through Shopify's API.
Those connections use Shopify's expiring offline access tokens. Each access token stops working after about an hour and is renewed automatically, so a stolen token is only useful for a short time. The refresh token used to renew them is encrypted in our database, so a copy of the database alone would not give anyone a working, long-term connection to your store.
Together with customer data permission being granted only when you turn on a feature that needs it, this keeps the app's exposure to customer data small.
If you are completing a vendor security review, see the Simple Bundles security center or email hello@simplebundles.io from your company email address.
Which features require customer data?
There are two features that require customer data permissions:
1. Creation of associated Orders
When Shopify cannot edit an original order (e.g., orders created by third-party apps or certain sales channels), Simple Bundles can create an associated order containing the bundle's child items. These associated orders include customer shipping details so that fulfillment can be completed correctly.
📝 For merchants who installed on or after June 19, 2026, associate orders are disabled by default.
Learn more: Associated Orders being created with an "A"
Settings location: App Settings → Advanced Settings → Cart Transform and Order Editing Fallbacks
2. Judge.me Reviews Integration
The Judge.me integration sends review requests to customers after bundle fulfillment. This requires access to customer email addresses so that review emails reach the right person.
Learn more: Judge.me Reviews + Simple Bundles 2.0
Settings location: App Settings → Integrations → Judge.me Reviews
How to approve customer data permissions
When you enable either of the features above, Shopify will automatically display a permission prompt asking you to approve customer data access for Simple Bundles.
- Enable the feature in your Simple Bundles settings (associate orders or Judge.me integration)
- Shopify will display a permissions prompt showing what data the app is requesting
- Click Update to approve and grant permission
- The feature is now active
📝 This is a one-time approval. Once granted, you will not be prompted again unless you reinstall the app.
How to check your current permissions
You can review which permissions Simple Bundles currently has at any time:
- Go to your Shopify Admin
- Navigate to Apps → Simple Bundles
- Click Manage app
- Under the Permissions section, you'll see a list of data the app has access to
If customer data is not listed, the app does not currently have access to it and cannot read or use any customer information.
What happens if I decline the permission?
If you choose not to approve customer data access:
- Associated orders will not be created. If an order cannot be edited by Shopify, the bundle contents will not be broken down for that order.
- The Judge.me integration will not send review requests for bundles.
All other Simple Bundles features continue to work normally, including bundle creation, Cart Transform checkout breakdown, inventory sync, pricing, and all other integrations.
Can I revoke access later?
Shopify manages app permissions. If you no longer need associate orders or the Judge.me integration, you can disable those features in your Simple Bundles settings. While the permission scope will remain on your Shopify Admin until the app is reinstalled, Simple Bundles will no longer actively use customer data once both features are disabled.
To fully remove the permission, you would need to uninstall and reinstall the app. Note that reinstalling will reset the app to the new default (no customer data access), and you'll need to re-approve permissions if you re-enable either feature.
Need Help?
If you have any questions about customer data permissions or need help with your settings, don't hesitate to reach out to our support team at hello@simplebundles.io.