Privacy Policy

LAST UPDATED: JULY 14, 2026

Provider: Innowebative Solutions (“we”, “us”, “our”). App: Hitch: Bundles & Upsells.

This policy describes what data Hitch collects when you install Hitch from the Shopify App Store, how we use it, who helps us process it, and what happens when you leave. We act as a data processor (service provider) on behalf of the merchant, who is the controller of store data.

What we collect

Hitch accesses store data only through the official Shopify Admin API, using the scopes you grant at install:

Order history (Level 1 protected customer data): order IDs, product references on line items, quantities, and discounted line totals. Depending on plan, we read between 30 and 90 days of recent history (read_orders / read_all_orders). We use this for co-purchase matching and for attributing revenue to Hitch widgets when shoppers add via stamped line properties.
Product catalog: titles, descriptions, types, vendors, tags, variants, prices, images, and inventory status.
Merchant account data: your shop domain, and staff email when you take actions in the app (audit log) or submit the in-app support form.

We do not collect shopper names, emails, phone numbers, shipping or billing addresses, or payment card details. We have not requested Shopify protected customer fields for name, email, phone, or address.

How we use it

We process this data only to provide Hitch:

Analytics: co-purchase patterns and widget-attributed order and revenue stats in your dashboard.
Personalization: bundle and upsell recommendations on your storefront.
AI enrichment (Starter and up): we may send product title, description, type, vendor, and existing tags to OpenAI to generate helpful tags for matching. We do not send order data or shopper personal data to OpenAI, and we do not use your data to train models shared across stores.

What we never do

We never sell your data, or any data derived from it.
We never share your order data with other merchants for their own use.
We never use your data for advertising or cross-context behavioral advertising.

Data retention and deletion

While Hitch is installed, we retain store data needed to run the app. On uninstall we erase stored order-derived data, catalog caches, bundles, sessions, and related records. We honor Shopify’s mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact). Because we do not store shopper personal data, customer data-request and redact webhooks typically confirm there is nothing to export or erase for an individual customer.

Trial ledger exception: after uninstall we may retain only your shop domain and a flag that a free trial was already used. This prevents claiming a second free trial on reinstall. It does not include order contents, catalog data, or shopper personal data. You can ask us about this record at the contact below.

Subprocessors and security

Data is encrypted in transit (TLS) and at rest in our database. We use these subprocessors to operate Hitch:

Shopify: source of store data via the Admin API; Billing API for app charges.
Fly.io: application hosting for the Hitch server.
Supabase (Postgres on cloud infrastructure): application database for catalog indexes, co-purchase associations, bundles, shop settings, and audit logs.
OpenAI: optional product-tag enrichment from catalog metadata only (Starter plans and above).
Resend: delivery of messages from the in-app support form (shop domain, optional shop email, and your message text).

Subprocessors process data only to help us provide Hitch. Database hosting may involve international transfers; where required we rely on appropriate safeguards such as Standard Contractual Clauses.

Your responsibilities as merchant

You remain the controller of your customers’ data. You should maintain your own storefront privacy policy and handle customer rights requests. We will support you when Shopify sends us a compliance webhook.

Contact

Questions about this policy or a deletion request: hello@joinhitch.com.

Innowebative Solutions