Mix and Match Products is operated by add-ons.org.
The app reads the products a merchant chooses for a bundle (titles, handles, images, prices, SKUs and availability) and writes each bundle onto its container product as a product metafield so the storefront and checkout can use it. It writes the merchant's display settings to an app metafield, registers a cart transform function that turns a bundle in the cart into the products the customer picked, and reads the published theme's settings to tell whether the app embed is switched on.
To apply the Free plan's monthly limit, the app receives a notification when an order is created and checks whether the order contains a bundle. It keeps only the order ID and order number of such orders. Customer name, address, email, phone and payment details in that notification are not read, stored or displayed.
The app stores bundle definitions with product snapshots, the display settings, the shop's plan, the order IDs and numbers described above and Shopify authentication sessions. The customer's selection travels only as a line item property inside the merchant's own Shopify cart and order.
Paid plans are billed by Shopify through the merchant's Shopify invoice. The app never sees payment details.
Data is exchanged with Shopify only. No other service receives store data.
Bundles and order IDs remain until the merchant deletes the bundles, uninstalls the app and Shopify requests shop data erasure (48 hours after uninstall), at which point everything for that shop is deleted. Authentication sessions are deleted on uninstall. Product metafields the app wrote remain in the merchant's Shopify store and can be removed from the product page.
For privacy questions, use the contact form.