Privacy Policy — Comboo

This Privacy Policy explains how Orbit Lab Co ("Comboo", "we", "us"), the developer of the Comboo app for Shopify, collects, uses, and protects information when a merchant installs and uses Comboo (the "App").

Comboo is a product of Orbit Lab (orbitlabco.com).

1. Who this applies to

This policy applies to Shopify merchants who install the App and to the visitors/customers of those merchants' stores who interact with the Comboo widget. We act as a data processor on behalf of the merchant for store data, and as a data controller for our own account/operational data.

2. Information we collect

From the merchant's store (via the Shopify API), to provide the service:

• Store/account data: store domain, shop ID, and the access token needed to operate the App.
• Product data: product titles, images, variants, prices, type and vendor — used to display and configure kits.
• Order data (aggregated): when a kit is purchased we store the order ID and the kit's revenue, quantity and the products included, to power your sales analytics. We do not store customer personal data (no names, emails, addresses or payment details).
• Theme data: read-only access to your published theme's files to detect whether the Comboo widget is installed.

From store visitors (anonymous):

• Usage events: anonymous counts of widget views and add-to-cart actions per kit. These are not linked to any individual and contain no personal data.

We do not collect or store buyers' personal information, browsing history across sites, or sensitive data.

3. How we use information

• To provide, operate and maintain the App's features (building kits, applying discounts, showing analytics).
• To create or update the automatic discount that applies kit discounts at checkout.
• To detect whether the widget is installed in your theme.
• To diagnose problems and improve the App.
• To comply with legal obligations.

We do not sell your data or use it for advertising.

4. Sub-processors and sharing

We share data only with the infrastructure providers needed to run the App:

Sub-processor	Purpose	Location
Shopify	Platform / source of store data	Global
Neon (PostgreSQL database)	Stores app data (kits, settings, aggregated sales)	AWS, US East (us-east-1)
Fly.io	Application hosting	AWS US East (Virginia)

We may also disclose information if required by law. We do not otherwise share data with third parties.

5. Data retention and deletion

• App data is retained while the App is installed.
• On uninstall: we immediately delete the store's session/credentials.
• Full deletion: in line with Shopify's requirements, when Shopify sends the shop/redact request (~48 hours after uninstall) we permanently delete all of the store's data from our systems.
• Customer redaction: when Shopify sends a customers/redact request, we delete any sales records associated with the specified orders.
• Customer data request: because we store no buyer personal data, a customers/data_request returns no personal information.

We implement Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact).

6. Your rights (GDPR / CCPA and similar)

Depending on your location, you (or your store's customers, via you) may have the right to access, correct, delete, or restrict processing of personal data, and to data portability. To exercise these rights, contact us at oscar.ortiz@orbitlabco.com. For your store's customers, requests are handled through Shopify's data request flow described above.

7. Security

We use industry-standard measures to protect data, including encrypted connections (HTTPS/TLS), encrypted database connections, and restricted access to credentials. No method of transmission or storage is 100% secure, but we work to protect your information.

8. International data transfers

Data may be processed in the United States and other countries where our sub-processors operate. Where required, we rely on appropriate safeguards for international transfers.

9. Children's privacy

The App is for businesses and is not directed to children under 16. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date. Material changes will be communicated where appropriate.

11. Contact

Orbit Lab Co
Email: oscar.ortiz@orbitlabco.com
Address: Carrera 87a #32-46, Medellín, Antioquia, Colombia
Website: orbitlabco.com/comboo