Privacy Policy
Last updated 4 August 2026 · GiftBow is published by Found.
The short version. GiftBow stores your store's settings, the gift messages your shoppers write, and a list of the orders that bought gift wrapping. It never sees card details. It does not collect shopper email addresses, names or postal addresses. Everything is scoped to your store, and nothing is ever sold or shared for advertising.
Who this covers
This policy covers GiftBow (the "app"), an application for OpoShop stores published by Found. It applies to the merchant who installs GiftBow and to the shoppers who use the gift-wrap toggle on that merchant's storefront.
Merchant store data
When you install GiftBow you authorise it through OpoShop's OAuth. GiftBow receives an access token scoped to your store and uses it only to:
- read your store's name, subdomain and currency;
- create and maintain one gift-wrap product — the only product GiftBow ever writes to;
- read your collections and product names so you can choose what is giftable;
- read your orders, to find the ones that bought gift wrapping and to read the gift message on them.
GiftBow never places, cancels or fulfils an order, never modifies a product it did not create, and never emails your customers.
Buyer-written gift messages
When a shopper turns on the gift toggle, GiftBow stores what they type: the gift message and, if you have enabled them, the "To" and "From" lines. These are stored against the shopper's cart while they are shopping, and — because OpoShop carries the note onto the order itself — they also appear on the order in your own OpoShop admin.
GiftBow does not store a shopper's email address, postal address, phone number, IP address or payment details. The buyer's display name shown in your Gift Queue comes from the order and is only ever read, never stored separately from it.
Gift messages attached to carts that never become an order are automatically deleted after 60 days.
Payment data
GiftBow never touches money. The gift-wrap fee is a normal product line on the order, charged by your store through OpoShop's own checkout. GiftBow holds no card details, no balance, no payment credentials, and takes no cut.
Where data is stored
GiftBow's data lives in its own database, hosted on MongoDB Atlas, and the app runs on Fly.io. Every record is scoped to a single store: one store cannot read another store's settings, queue or gift messages.
Analytics
GiftBow records anonymous product events (for example "settings saved" or "gift marked wrapped") through PostHog so we can tell which parts of the app are used. These events are keyed to a store identifier, never to a shopper, and carry no personal data and no message content.
Sharing
GiftBow does not sell data and does not share it for advertising. The only third parties involved are the infrastructure providers named above (Fly.io, MongoDB Atlas, PostHog) and OpoShop itself, which is where your store data comes from and goes back to.
Retention and deletion
- Uninstalling GiftBow pauses your store immediately; your settings and queue are kept so that reinstalling restores them.
- Unconverted cart gift messages are deleted automatically after 60 days.
- To have your store's data deleted permanently, email us and we will remove it.
- The gift-wrap product GiftBow created stays on your store after uninstall — it is yours; delete it from OpoShop whenever you like.
Your rights
You can request a copy of the data GiftBow holds for your store, ask for corrections, or ask for deletion, by emailing us. We respond to requests within 30 days.
Changes
If this policy changes materially we will update the date at the top of this page and, for anything that affects how data is used, note it in the app's What's New page.