Kumi Commerce

Terms of Service

Kumi Commerce — Kumi Bundle Builder for Shopify

Effective date: 2026-10-12
Last updated: 2026-11-12

These Terms are a contract between Kumi Commerce, a sole proprietorship based in Tokyo, Japan ("we", "us"), and the business that installs our app ("you", the "Merchant").

Part A covers the service. Part B is a Data Processing Agreement and governs how we handle personal data on your behalf. Both parts apply from the moment you install the App. If you do not accept them, uninstall the App.

---

Part A — The service

1. Definitions

1.1 Service terms

1.2 Data protection terms

These apply throughout, and especially in Part B.

2. What the App does

The App lets you build "build your own bundle" offers: a Customer picks a set number of products from a selection you define, and the bundle price is adjusted at checkout by a Shopify Cart Transform function.

The App also lets you set quantity breaks: a discount when a Customer buys more of the products or collections you choose, applied at checkout by a Shopify discount function.

To do this, the App asks for five Shopify access scopes. This is the permission list you see on the install screen:

Our app configuration also names read_publications, which is the read half of write_publications. Shopify folds a read_ scope into the matching write_ scope, so it does not appear separately on the install screen and grants nothing beyond the five above. We list it here so that the configuration and this table can be reconciled.

If you choose to use quantity breaks, the App asks for one optional scope as well. It is not on the install screen: the App asks for it only when you select Allow in the App, and bundles keep working whether or not you allow it.

We do not request access to Shopify's protected customer fields — name, email, phone or address. See the Privacy Policy, section 4.3, for the complete list of what we read from an order.

3. Eligibility and your account

You must have an active Shopify store and the authority to install apps on it. Your access to the App depends on your Shopify account; if your Shopify store is closed or suspended, the App stops working.

You are responsible for everything done through your Store's access to the App, and for keeping your own Shopify credentials secure.

4. Fees and billing

Charges for the App are handled by Shopify Managed Pricing. Shopify presents the plans, takes your approval, and bills you through your Shopify invoice. We never see or handle your payment card details.

• The plans, their prices and what each includes are shown on the App's Shopify App Store pricing page and in the App. Those pages are authoritative; this document deliberately does not restate the numbers.
• Plan tiers are based on Attributed Revenue (section 6.2).
• If a free trial is offered, its length is stated before you approve the charge.
• Charges are billed and refunded under Shopify's billing rules. If you believe you have been charged on the wrong tier, email us and we will look at the underlying order records with you.
• If you uninstall the App, it stops working for your Store right away and Shopify stops billing future periods. Proration when you change plans is applied by Shopify's billing, not by us. Apart from that, we do not refund part of a period that has already been billed, unless the law requires it.
• If we change prices, we will give installed Merchants at least 30 days' notice by email and Shopify will ask you to approve the new charge. You are never moved onto a higher price without approving it in Shopify.

5. Your responsibilities

You agree that:

• You will not use the App for anything unlawful, or to sell anything you are not permitted to sell.
• You have the right to use the Merchant Content you put into the App, including product names and images.
• Your bundle configuration, pricing and discounts are your decisions. You are responsible for whether they comply with the consumer, pricing and advertising law that applies to you.
• You will maintain your own privacy notice to your Customers, and you have a lawful basis for the processing you instruct us to perform.
• You will not attempt to access another Merchant's data, reverse-engineer the App's backend, or probe our systems without written permission.
• You will not resell or sublicense access to the App.

6. How the App behaves, stated plainly

6.1 Discounts

Bundle discounts are applied by a Shopify Cart Transform function that re-evaluates the whole cart at checkout. If a cart does not meet a bundle's conditions, no discount is applied. This is deliberate: it means a Customer who changes their cart after building a bundle cannot keep a discount they no longer qualify for.

Where you configure a fixed bundle total, the discount is applied as a percentage derived from that total, because Shopify's merge operation supports percentages only. Rounding differences of a minor currency unit can therefore occur, and are expected behaviour.

Quantity break discounts are applied by a Shopify discount function that reads the cart at checkout. The highest tier the cart reaches applies to every item counted. A quantity break never applies to bundles made with the App, gift cards or subscription purchases, and those items do not count toward its quantities. An amount off each item is converted into the Customer's currency and rounded down, and never exceeds the item's price. If a cart is too large for the processing limits Shopify sets for discount functions, no quantity break discount is applied to that cart. Which discounts can apply together is decided by Shopify from the combination settings you choose for each quantity break.

6.2 How Attributed Revenue is measured

Because your price tier depends on this number, here is exactly how it is produced.

1. When Shopify tells us an order was created, we ask the Shopify Admin API which of the order's line items belong to a bundle, using the bundle grouping Shopify records on each line. Shopify records a bundle as its component lines, not as one line, so this grouping is what tells us which lines came from a bundle you configured and enabled in the App. A line that Shopify did not group — the case where a bundle's own parent variant was bought directly — is matched on that line's own variant instead, so the sale is not missed.
2. For each line that belongs to one of your bundles, we take the line's unit price in your Store's currency, multiply by quantity, and subtract the discounts Shopify allocated to that line.
3. For each line that Shopify reports as discounted by an automatic discount whose title is a name the App gave one of your quantity breaks and Shopify accepted (its current name or an earlier one), we calculate the same amount: unit price times quantity, minus the discounts Shopify allocated to that line. Shopify gives the discount's title on the order, not its ID. If the App sees another automatic discount in your store using one of those names, whether it is active, scheduled to start later or turned off, it stops counting that name and tells you in the App, with how many orders and how much it removed, until you dismiss the notice. It removes the lines it already recorded under that name from the time that discount started, but only within the current calendar month (UTC). Months that have already been used to determine your plan tier are not changed. A discount from another app may show a name the App cannot read. Quantity break lines are counted only if the App had the optional permission to manage discounts (section 2) when the order was placed and still has it when the order is recorded: orders placed while it is missing are not counted, even if Shopify delivers them after you allow it again; bundle lines still are; orders placed after you allow it again are counted. For this the App keeps the times the permission was removed and granted again. A line that belongs to a bundle is counted once, as a bundle.
4. Only matching lines count. The rest of the order does not.
5. If we cannot read a line's discount reliably, we skip that line entirely rather than count it at full price. This can understate your Attributed Revenue. We prefer that to over-billing you.
6. We record the amount in your Store's currency. Separately, a background job converts it to US dollars using the European Central Bank reference rate for the order's date, obtained from api.frankfurter.app. If a rate cannot be obtained, the order stays unconverted and is reported as unconverted rather than as zero.
7. Monthly totals are recalculated from the recorded orders, not accumulated, so a retried webhook or a late currency conversion cannot double-count.

Attributed Revenue is our own measurement for pricing. It is not an accounting figure, not a statement of your profit, and may differ from Shopify's own analytics. Where an order is refunded, cancelled or edited after it was recorded, we reduce the recorded amount automatically: we subscribe to Shopify's refund, cancellation and order-update webhooks for that purpose, and we only ever lower a recorded amount afterwards, never raise it. If you still believe a figure is wrong, tell us and we will correct it.

6.3 What the App does not do

• The storefront blocks make no requests to our servers, so they add no dependency on our uptime to your product pages.
• The App does not modify your theme beyond the blocks you place yourself, and does not inject anything into your checkout.
• The Cart Transform function and the discount function run inside Shopify and have no network access.

7. Availability and support

We aim to keep the App available, but we do not promise a service level, an uptime percentage or a response time. We are a small operation and we will not commit to numbers we cannot guarantee.

Support is by email at [email protected], in English or Japanese. We will try to respond within two business days (Japan time). Merchants on the Growth and Scale plans get priority support: we answer their requests before others.

If the App's backend is unavailable, bundles you have already published keep working at checkout, because the discount rules live in Shopify. What stops working is the admin interface and the recording of new order attributions. Order webhooks that we fail to process are retried by Shopify up to 8 times over about 4 hours, and our processing is designed so a retry is safe. An order whose webhook still fails after those retries is not counted toward your plan tier.

8. Intellectual property

We own the App and everything in it. These Terms grant you a non-exclusive, non-transferable right to use it on your Store while you are properly subscribed, and nothing more.

You own your Merchant Content. You grant us the limited right to process it to operate the App for you. We may describe the App's use in aggregate and anonymous form (for example, "stores using the App created N bundles"), and we will not identify your Store or publish your figures without your permission.

Feedback you send us may be used to improve the App, without obligation or payment to you.

9. Disclaimers

The App is provided "as is" and "as available". To the extent permitted by law, we disclaim all implied warranties, including merchantability, fitness for a particular purpose and non-infringement.

We do not warrant that the App will be uninterrupted or error-free, that every bundle configuration will behave as you expect in every theme, or that Attributed Revenue will match any other system's figures.

We are not responsible for Shopify's platform, for changes Shopify makes to its APIs, or for your theme and any other app installed on your Store.

10. Limitation of liability

To the maximum extent permitted by law:

• Neither party is liable for indirect, incidental, special or consequential loss, or for loss of profit, revenue, goodwill or data, even if advised of the possibility.
• Our total liability arising out of or related to these Terms is limited to the greater of (a) the fees you paid us for the App in the twelve months before the event giving rise to the claim, or (b) US$100.

Nothing in this section limits liability that cannot be limited by law, including liability for fraud or wilful misconduct, or either party's liability for administrative fines imposed on it directly under Data Protection Law for its own breach.

11. Indemnity

You will defend and indemnify us against third-party claims arising from your Merchant Content, your products, your pricing and discount decisions, your breach of these Terms, or your failure to meet your own obligations under Data Protection Law.

12. Suspension and termination

You may terminate at any time by uninstalling the App.

We may suspend or terminate your access if you materially breach these Terms, if your use threatens the security or stability of our systems or another Merchant's data, if required by Shopify or by law, or if you fail to pay. Except where the breach is serious or urgent, we will tell you and give you a reasonable chance to fix it first.

We may discontinue the App. If we do, we will give installed Merchants at least 60 days' notice by email, and we will not charge for a period that the App is not available.

On termination, data is deleted as described in Part B, section B.8.

13. Changes to these Terms

We may change these Terms. For changes that materially affect you — including any change to Part B — we will notify installed Merchants by email at the address Shopify provides for the Store at least 30 days before the change takes effect. Continuing to use the App after that date accepts the change. If you do not accept it, uninstall the App before it takes effect.

We will not make a change to Part B that lowers the protection given to personal data without your agreement.

14. General

• Governing law: the laws of Japan.
• Jurisdiction: the Tokyo District Court has exclusive jurisdiction over disputes under these Terms. This does not affect any right you have under mandatory law to bring a claim in your own country.
• Relationship: these Terms are between you and us. Shopify is not a party to them.
• No assignment by you without our consent. We may assign these Terms to a successor of our business, on notice to you.
• Severability: if a provision is unenforceable, the rest stands.
• Entire agreement: these Terms and the Privacy Policy are the whole agreement about the App and replace earlier discussions.
• Language: the English version of these Terms governs.

---

Part B — Data Processing Agreement

This Part is the agreement about personal data processing required by Article 28 GDPR and by equivalent provisions of other Data Protection Law. It takes effect when you install the App and ends when all personal data has been deleted under section B.8.

The terms defined in section 1.2 apply here.

B.1 Which data this covers

This Part applies to personal data we process on your behalf because the App is installed on your Store. That is the data described in sections 4.2 to 4.5 of the Privacy Policy.

It does not cover data for which we are the Controller in our own right — the record that your Store installed the App, which plan it is on, and our billing records (Privacy Policy section 4.1). We process that under section 4.1 of the Privacy Policy and the legal bases set out there, not on your instructions.

B.2 Roles and responsibilities

You are the Controller. We are the Processor. Under the CCPA, you are the business and we are a service provider.

You are responsible for:

• having a lawful basis for the processing you instruct;
• the accuracy and lawfulness of the Merchant Content and instructions you give us;
• giving your Customers the notices Data Protection Law requires, and handling their requests as Controller;
• your own configuration choices in the App.

We are responsible for:

• processing personal data only as set out in section B.3 and on your documented instructions;
• the obligations in section B.4;
• our Sub-processors' performance of these obligations.

Your instructions. Your documented instructions consist of these Terms, the Privacy Policy, the settings you choose in the App, and any further written instruction you send to [email protected] that we accept. We will tell you if, in our opinion, an instruction would breach Data Protection Law, and we may suspend performance of it until it is resolved. If an instruction requires work materially beyond providing the App, we may charge a reasonable fee, agreed in advance.

Independent controller obligations. Neither party relies on the other to meet its own obligations as a controller under Data Protection Law.

B.3 Scope and details of the processing

This section is the record required by Article 28(3) GDPR.

B.4 Our obligations

We will:

a. Process only on instructions. Process personal data only as described in section B.3 and on your instructions, and not for our own purposes. We will not sell personal data, share it for cross-context behavioural advertising, retain or use it outside our direct business relationship with you, or combine it with data from another source — except where a law applying to us requires otherwise, in which case we will tell you unless prohibited from doing so.

b. Keep it confidential. Limit access to personnel who need it to provide the App. Today that is one person, the owner of Kumi Commerce, who is bound by confidentiality.

c. Secure it. Maintain appropriate technical and organisational measures having regard to the risk, including: TLS for all data in transit; encryption of the production database at rest; HMAC verification of every Shopify webhook before its contents are read; access control limiting database access to the App's backend and the administrator; per-Store authorisation checks on every write so that one Store cannot reach another Store's data; keeping only the type of an error, never its message, in the webhook records we retain, so that an identifier quoted inside an error cannot enter them; and removal of email addresses and phone numbers from privacy-request payloads before storage. The measures in force are described in section 10 of the Privacy Policy, which forms part of this Agreement. We may change a measure but will not reduce the overall level of security.

d. Engage Sub-processors properly. Only engage a Sub-processor under a written contract imposing data protection obligations no less protective than this Part, and remain liable for its performance. The current list is in section B.6. We will give you at least 30 days' notice by email before adding or replacing one. If you reasonably object on data protection grounds within that period, we will work with you to find a solution; if we cannot, you may terminate by uninstalling the App and we will refund the unused portion of any period already billed.

e. Help you answer data subjects. Promptly tell you if a data subject contacts us directly, and not respond to them ourselves except to direct them to you. Shopify's customers/data_request and customers/redact webhooks are handled automatically as described in section 11 of the Privacy Policy. Because we hold no Customer name, email, phone or address, there is normally nothing for us to disclose or erase about an individual.

f. Help you with your own obligations. Give you reasonable assistance, with the information available to us, for data protection impact assessments, consultations with a supervisory authority, and breach notifications.

g. Report breaches. Notify you of a personal data breach affecting your data without undue delay and in any event within 48 hours of becoming aware of it, with the information we have at the time, and keep you updated as we learn more. We will not notify your Customers on your behalf unless you ask us to in writing.

h. Allow verification. On reasonable written request, and no more than once a year unless Data Protection Law or a breach requires otherwise, give you the information reasonably needed to confirm our compliance with this Part. Because the App's backend is single-tenant to us and holds other Merchants' data, we satisfy audit rights by providing written answers and documentation rather than site access.

i. Delete or return. On termination, delete personal data as described in section B.8.

B.5 Your obligations

You will:

• only give instructions that comply with Data Protection Law;
• not send us personal data beyond what section B.3 describes, and not use the App to route special category data to us;
• keep your Shopify access secure, and tell us promptly if you believe your Store's access to the App has been misused;
• respond to your Customers' requests as Controller.

B.6 Sub-processors

Our hosting and database provider is Render Services, Inc., and the App runs in Render's Frankfurt, Germany region. Because that region is inside the EEA, no transfer outside the EEA arises from our choice of hosting.

Shopify is not a Sub-processor of ours: it is the platform you contract with directly and the source of the data, and your relationship with it is governed by its own terms. We do send five kinds of request back to Shopify, and all are named here for completeness: the Admin GraphQL request in section B.3; a Partner API request asking which subscription Shopify currently holds for your Store, which sends Shopify its own identifiers for your Store and for our app and no order or Customer data; Admin GraphQL writes that create and maintain the hidden parent product for each bundle and register the cart transform, which send the bundle settings you entered in the App (its name, the products you chose, the quantity and the discount) and no Customer data; if you use quantity breaks, Admin GraphQL writes that create, update, turn on, turn off and delete the App's automatic discounts and publish the tier table, which send the quantity break settings you entered in the App and no Customer data; and the read-only checks in section 4.6 of the Privacy Policy. The first two and the read-only checks give Shopify nothing it did not already hold.

Not in use. Our codebase contains disabled, unreachable integrations for AI-assisted support drafting (Anthropic) and error monitoring (Sentry). Neither is called by the App and neither has credentials configured. No Merchant or Customer data has been sent to either. We will add them to this table, with notice under section B.4(d), before enabling either one.

B.7 International transfers

We are established in Japan and process your data there, together with our hosting provider Render in Frankfurt, Germany, as named in section B.6.

• EEA, UK and Swiss data transferred to us in Japan relies on the European Commission's adequacy decision for Japan of 23 January 2019, as extended in 2023, and on the equivalent UK and Swiss findings. No further transfer mechanism is required for the transfer to us.
• If we select a hosting region outside Japan and the EEA, we will enter into the Standard Contractual Clauses with that provider — Module Three (processor to processor), with the UK International Data Transfer Addendum where UK data is involved — before any of your data is processed there, and will record it in section B.6.
• If the adequacy decision for Japan is suspended or withdrawn, we will on your request enter into the Standard Contractual Clauses with you, Module Two (controller to processor), with you as data exporter and us as data importer. In that event the Annexes are populated by: section B.3 of this Agreement (Annex I.B, description of processing), section B.4(c) and section 10 of the Privacy Policy (Annex II, technical and organisational measures), and section B.6 (Annex III, sub-processors); the competent supervisory authority is that of your place of establishment, and the governing law is that of your EEA member state, notwithstanding section 14 of Part A.
• Frankfurter receives a currency code and a date only, so no personal data is transferred to it.

B.8 Retention and deletion

What survives, and why. Webhook receipt records (a webhook ID, a topic, timestamps and, where a delivery failed, the type of the error and never its message) are retained with their link to your Store removed, so that a late retry of a webhook already processed is not processed again. They contain no Store domain, order data or Customer data; we record the type of the error rather than the message exactly so that this stays true, because an error message can quote an order identifier or your Store domain. Records for webhooks we finished are deleted 30 days after we finished them; a record for a webhook that never finished is kept, because deleting it would let a late retry be processed a second time. Server logs are retained for our hosting provider's retention period, and invoices and accounting records for as long as Japanese tax law requires; these relate to your business, not to your Customers.

Where a law applying to us requires us to keep personal data longer, we will keep only what that law requires, continue to protect it under this Part, and tell you unless prohibited.

B.9 CCPA / CPRA

For personal information subject to the CCPA, you are the business and we are a service provider. We will:

• process personal information only to perform the services described in section B.3, and for no other purpose;
• not sell or share it, and not retain, use or disclose it outside our direct business relationship with you;
• not combine it with personal information received from another source, except as permitted for a service provider;
• comply with the applicable obligations of the CCPA and provide the same level of protection it requires;
• notify you if we determine we can no longer meet these obligations;
• on your instruction, take reasonable steps to stop and remediate unauthorised use.

You may take reasonable and appropriate steps to confirm that our use of personal information is consistent with your obligations, through the process in section B.4(h).

B.10 Term, liability and precedence

This Part lasts as long as we process personal data on your behalf, and the obligations that by their nature survive — confidentiality, deletion, transfers — continue afterwards.

The limitation of liability in section 10 of Part A applies to this Part, taken together with Part A as a single cap, except for liability that Data Protection Law does not permit to be limited.

If this Part conflicts with another part of these Terms or with the Privacy Policy on the subject of personal data processing, this Part prevails.

---

Contact

[email protected]

Kumi Commerce, Tokyo, Japan — https://kumicommerce.com