Privacy policy

Last updated 8 Oct 2026

Last updated: 8 October 2026

We keep only what we need to sell, deliver and support our products. We don't sell your data, and we don't use advertising trackers.

This policy covers both kinds of Nanflows products:

WordPress plugins (Nanflows Popup, Nanflows Sliding Cart and Nanflows Bundles), bought on nanflows.com.
Shopify apps (Nanflows Bundles for Shopify), installed and paid for through Shopify.

WordPress plugins

What we store

Account: your email address and a hashed password (we never see the password itself).
Purchases: order number, plan, amount, currency and status, and the Polar customer id. Card details are handled by Polar and never reach us.
Licences: the site addresses (domains) you add, their licence keys and when each site last checked its licence.
Licence and update checks: when your WordPress site checks its licence or an update, we log the domain, the result, the time and the server's IP address, to stop abuse.
Downloads: which plugin version was downloaded and when.
Support tickets: your messages and the files you attach.

What the plugins send

Free plugins send nothing to us.
Pro plugins contact nanflows.com only to check the licence and look for updates. They send the plugin name, licence key, version and your site's address. They don't send your visitors', customers' or leads' data to us.
Data your popups, carts or bundles collect stays in your own WordPress database, unless you connect an integration (for example an email service) yourself.

Shopify apps

When you install a Nanflows Shopify app, Shopify shares store data with us under Shopify's own terms, and only what the permissions you approve allow. You don't need a Nanflows account.

What we store about your store

Store details: your store's myshopify.com address, name, contact email, currency and time zone, and the email address you choose for app notifications.
Access: the access token Shopify gives the app, so it can work on your store.
Plan and billing: your plan, free trial and subscription status, and the bundle sales counted towards your plan. Shopify takes the payment and bills you; we never see card details.
Bundles: the bundles you create, with the products, prices, discounts and settings you choose.
Bundle sales: for orders that contain a bundle, the order number, the bundle's line items, quantities, amounts and currency, refunds, and whether the order was prepaid or cash on delivery and which checkout it used. We use these for your bundle analytics and to count your plan's bundle sales.
Bundle funnel: daily counts of bundle views, adds to cart, checkouts and orders, and which products sold in bundles.
A/B tests: the versions of a bundle you test and their results, as counts for each version.
Emails to you: the address, kind and time of each app email we send you, such as a warning that you are near your plan's limit.
Support: the messages you send us. On the Scale plan, the Slack channel we share with you, and the names and email addresses of the people in it.

What we don't store about your customers

The app stores no personal data about your shoppers: no names, email addresses, phone numbers, or shipping or billing addresses.

The app's storefront pixel sends us only bundle ids, products, quantities and amounts for carts that hold a bundle. It sends nothing that says who the shopper is.
From the orders Shopify sends us, we keep only the bundle details listed above.
When you run an A/B test, the shopper's browser remembers which version of the bundle they saw (a random A or B, kept in the browser's local storage), so they keep seeing the same one. It isn't linked to who they are and isn't sent to us.

Uninstalling the app

When you uninstall, the app's access to your store ends and we delete its access token. Your bundles are kept for now, so a reinstall picks up where you left off.
48 hours after an uninstall, Shopify asks us to delete your store's data, and we do: the store, its bundles, bundle sales, analytics and email log. We keep only your store's address and the plan whose free trial it used, so each store gets one free trial.
When a shopper asks Shopify for a copy of their data, or for it to be erased, there is nothing to send or erase, because the app holds no personal data about them.

Why we use it

To create your account, take payment, issue and check licences, deliver updates, run our Shopify apps and their billing, show your bundle analytics, answer support and prevent fraud. The legal bases are performing our contract with you, and our legitimate interest in keeping the service secure.

For a Shopify app, you as the merchant decide what happens to your customers' data in your store. We use your store's data only to provide the app to you.

Who processes it

A small number of providers process data for us, including Shopify for our Shopify apps. See Sub-processors.

How long we keep it

Nanflows account, licences and tickets: until you close your account.
Orders and invoices: as long as tax law requires (usually up to 7 years), even after the account is closed.
Licence check logs: kept for a limited time for security, then removed.
Shopify app data: while the app is installed, and until Shopify's deletion request 48 hours after you uninstall it. Shopify keeps its own billing records.

Cookies

nanflows.com uses one sign-in cookie and nothing for tracking. See Cookies. Our Shopify apps run inside your Shopify admin and sign you in through Shopify. On your storefront, a bundle in an A/B test keeps the shopper's version in their browser's local storage, as described above; no cookie is set.

Your rights

You can ask to see, correct, export or delete your data, or object to how we use it. See Delete your data, or contact us (see below). For a Shopify app, uninstalling it also deletes your store's data 48 hours later. You can also complain to your local data protection authority.

Changes

If this policy changes, the date at the top changes. Important changes are emailed to customers.

Contact

Questions or requests: email support@nanflows.com.