Privacy Policy

Applies to: Bulk Product Editor for BigCommerce.
Last updated: 2026-06-01

This Privacy Policy explains what data the Bulk Product Editor app (the "App") for the BigCommerce App Marketplace accesses, stores, and shares. The App is operated by Clockwork Apps ("we", "us"). If you have questions, contact support@clockworkapps.com.

1. What the App accesses

When you install the App on your BigCommerce store, BigCommerce grants the App permission to read and modify your product catalog through the official BigCommerce REST API. Specifically the App can:

• Read product records — names, descriptions, brands, categories, visibility, weight and dimensions, custom fields, tags, and the full variant list (price, sale price, retail price, cost, SKU, MPN, GTIN, UPC, weight, inventory level, bin/picking number).
• Write to those same product- and variant-level fields when you run a bulk edit job, either immediately or on a schedule you configure.

The App does not access customer records, order data, payment information, or any part of your store outside the product catalog.

2. What the App stores

To support previews, scheduled jobs, undo / revert, and activity history, the App persists the following on its own infrastructure:

• Your BigCommerce store hash and OAuth access token, so the App can make API calls on your behalf for scheduled jobs and reverts.
• Job rows — for each bulk edit you create, we store the job name, the filter you targeted, the actions you configured, the scheduled run time, the current status, and per-product activity log entries (success / failure, which fields were updated).
• Pre-edit snapshots — before a job mutates your products, the App captures a snapshot of every product about to be changed (the fields it is about to overwrite, plus the variant fields) and stores it as a gzipped JSON file in encrypted Amazon S3 storage at bcbpe2-undo/{store_hash}/{job_id}.json.gz. This is the data source for the one-click revert feature.
• Payment records — your Stripe customer ID, subscription ID, and subscription status. We do not store your credit card number; that lives only with Stripe.
• A short-lived in-memory cache of matched products while you are configuring a filter, to keep the picker responsive. This cache expires automatically (5-minute TTL) and is rebuilt from the BigCommerce API on demand.

Data is stored in encrypted databases (MySQL) and object storage (Amazon S3), both hosted on AWS. All traffic is encrypted in transit via HTTPS.

3. What the App does not store

• Customer data of any kind (BigCommerce shoppers, end users).
• Order data.
• Payment card numbers.
• Any data unrelated to your BigCommerce product catalog.

4. Support requests

The App includes an in-app support form. When you submit it, the optional reply-to email and the message text are delivered to our support inbox (support@clockworkapps.com) via Amazon Simple Email Service (SES). We retain support emails for as long as necessary to answer your question and for a reasonable period afterwards. To request deletion of a support email, reply to the thread.

5. Third parties

• BigCommerce — hosts the storefront and exposes the product catalog via its API. Your use of the App is also governed by BigCommerce's Privacy Policy.
• Amazon Web Services (AWS) — provides compute (EC2), database (RDS / MySQL), object storage (S3, for pre-edit snapshots), and email delivery (SES). See AWS's Privacy Notice.
• Stripe — handles all subscription billing for the App. Stripe receives your billing details directly; we never see your payment-card information. See Stripe's Privacy Policy.

We do not use analytics SDKs, tracking pixels, or advertising networks in the App.

6. Data retention & deletion

When you uninstall the App from your BigCommerce admin, BigCommerce notifies us via the uninstall webhook. We mark your store as uninstalled and stop processing scheduled jobs for it. Your job rows, activity logs, OAuth token, and pre-edit snapshots in S3 are retained for up to 30 days after uninstall to support reinstallation, then deleted. The S3 lifecycle policy automatically purges snapshot files older than the retention window.

To request immediate deletion of all your data, email support@clockworkapps.com with your store hash and a brief request. We will delete your records within 30 days and confirm by email.

7. GDPR and CCPA

Under GDPR and CCPA, you may have the right to access, correct, or delete personal data we hold about you. Because the App's data is primarily about your store (an organizational entity) rather than individual personal data, the categories of personal data are narrow — your store-owner email address (when you submit the support form) and limited authentication metadata. To exercise any right, contact support@clockworkapps.com and we will respond within 30 days.

8. Security

All traffic between your browser, the App, BigCommerce, and Stripe is encrypted in transit via HTTPS. OAuth access tokens and S3 snapshots are stored encrypted at rest. We follow standard security practices for managed databases, network ACLs, least-privilege IAM roles, and server-side encryption on S3. If you become aware of a security issue, please email support@clockworkapps.com.

9. Children's privacy

The App is a business tool for BigCommerce store owners. It is not directed at children under 13 and we do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated through the App Marketplace listing description.

11. Contact

Clockwork Apps
support@clockworkapps.com