Data processing agreement

This DPA forms part of the agreement between the Shopify merchant (controller: you decide what data is collected) and J Wilmott, 5 Sovereign Quay, Havannah Street, Cardiff CF10 5SF, United Kingdom (processor: handles data on your behalf, operating as Summette) when the merchant installs or uses the app.

Instructions and purpose

The processor handles personal data only on the merchant’s documented instructions to create, retain and deliver VAT invoices and credit notes, operate the review queue, and satisfy Shopify privacy requests. No sale, advertising, profiling or unrelated use is permitted.

Data and people

Data subjects are buyers and merchant users. Data is limited to buyer identity and contact fields, supplied VAT information, order/refund financial data, the order notes, gift messages, cart attributes and shipment details printed on the order documents the merchant turns on, document and delivery records, and authenticated access audit entries. Phone numbers and payment-card numbers are excluded; receipts name only the card brand or payment method.

Processor commitments

• Apply appropriate technical and organisational security measures and confidentiality restrictions, including an encrypted database volume, encrypted daily backups deleted after 30 days, and server access by SSH key only, as listed on the security page.
• Assist with data-subject requests through Shopify’s mandatory privacy webhooks.
• Notify the merchant without undue delay after confirming a personal-data breach and provide information reasonably needed for the merchant’s obligations.
• Keep documents available for merchant download while the service is active. After uninstall, permanently delete the shop's documents and other service data from the live service when Shopify sends the shop-redaction request, normally about 48 hours later.
• Ensure any subprocessor is bound by materially equivalent data-protection duties and remain responsible for its performance.
• Provide information reasonably necessary to demonstrate compliance and cooperate with proportionate audits.

Subprocessors

The merchant authorises these subprocessors. Summette will tell merchants before adding or replacing one, so they can object.

• Hetzner Online GmbH (Germany), data centre in Helsinki, Finland: hosting, encrypted storage and backups.
• Cloudflare, Inc. (United States): DNS, TLS edge and denial-of-service protection.
• Resend, Inc. (United States), sending through Amazon Web Services: document emails, when email delivery is on.
• Recommand (Belgium): Peppol e-invoice sending, only for a merchant who registers for e-invoicing.
• Arratech AB (Sweden), French accredited platform no. 0153, through Recommand: French business invoices, only for a French merchant who registers.
• Anthropic PBC or OpenAI, L.L.C. (United States): answers from the optional assistant and the template studio's Describe the change, only when used. No customer names, email addresses or street addresses are sent.
• Crisp IM SAS (France; data stored in the Netherlands): in-app chat with our team, only once chat is switched on. No customer data.

International transfers

Where a restricted international transfer occurs, the parties will rely on an applicable lawful transfer mechanism, including the EU Standard Contractual Clauses or UK Addendum where required.

Security and retention controls are described at truevat.app/security.

Retention and termination

The merchant, as controller, is responsible for identifying and meeting its statutory invoice-retention duties and for downloading the records it needs before uninstalling. While the service is active, Summette applies the merchant's declared OSS or IOSS status and the published rule table. Unknown scheme status uses the longer period. On Shopify shop redaction, Summette deletes the shop's documents, settings, logs and exports rather than acting as a post-termination statutory archive.

Only a content-free numbering marker remains in the live service after shop redaction so the same shop cannot reuse an issued number following reinstallation. Residual backup copies may remain temporarily and are not a merchant archive. Backups are kept for 30 days and then deleted.

Optional AI help

When you chat to Ari, Summette sends your message, the recent conversation, the page name and any field explanation you selected to the configured AI provider, currently Anthropic or OpenAI, to generate an answer. Ari reads your records through read-only lookups that return order and document numbers, statuses, dates, amounts and countries; customer names, email addresses and street addresses are never sent. Likely email addresses, phone, card and account numbers and keys are removed from what you type before it is saved or sent. Conversations are saved in Summette's database so our team can help and you can get a copy, and are deleted with your shop's data. The provider may retain API data under its applicable service and abuse-monitoring policies.

When you use Describe the change in the template studio, Summette sends the change you typed and your shop's design settings (colours, typefaces, labels, your own wording and the arrangement of the page) to the same AI provider, to propose the change; no customer or order data is sent.

OpenAI separately processes brand guides you choose to upload for presentation suggestions. These optional features are switched on only once the provider's data-processing terms are in place.

Contact

J Wilmott, 5 Sovereign Quay, Havannah Street, Cardiff CF10 5SF, United Kingdom. Email: [email protected].