Video Memberships privacy policy
Last updated: 6 October 2026. Video Memberships ("the app") is operated by Iconic For Software and Multimedia.
What the app does
The app lets Shopify merchants sell access to videos hosted in the merchant's own Bunny Stream account. When a customer buys a mapped product, the app records that the customer may watch those videos and serves them a members-only library inside the merchant's store.
Data we store
- Merchant data: the store domain, an offline API access token issued by Shopify, the merchant's Bunny Stream library ID, and the Bunny API and token keys. Bunny keys are encrypted at rest with AES-256-GCM.
- Product data: the IDs and titles of Shopify products the merchant maps to videos, and Bunny video IDs, titles, durations and thumbnail URLs.
- Customer data: the Shopify customer ID, product ID, order ID and purchased quantity for each purchase that grants video access; refund and line-item IDs and refunded quantities; and customer data request IDs, receipt dates and completion dates. We do not store customer names, emails, addresses or payment details.
How we use it
Only to decide which customer may watch which video, to mint short-lived playback links, and to show the merchant usage counts. We do not sell data, run advertising, or share data with anyone except as needed to run the service (Shopify, and the merchant's own Bunny account).
Webhooks and deletion
The app subscribes to Shopify's orders/paid and refunds/create webhooks to grant and revoke access, and to the mandatory compliance webhooks. Customer data requests appear in the app's Customer data screen, where the merchant can download an export to respond to the customer. On customers/redact we delete that customer's access records, related refunds and data requests; on shop/redact or app uninstall we delete everything stored for the store.
Retention and security
Data is kept while the app is installed and deleted within 48 hours of uninstall. Shopify access tokens and Bunny keys are encrypted at rest with AES-256-GCM, all traffic uses TLS, and the database is reachable only from the application server and the operator.
Your rights and contact
Merchants can export or delete their data at any time by contacting support@videomemberships.com. Customers should contact the store they bought from; the store owner can then request deletion through Shopify.