TrueVAT Invoicing privacy policy

Effective: 17 September 2026

TrueVAT Invoicing acts as a processor for the Shopify merchant, who remains the controller of customer information. This policy forms part of the service terms and the data processing agreement.

Data and purpose

The app reads only Shopify order and refund data needed to create, retain and deliver VAT invoices and credit notes: buyer name, company, billing and shipping addresses, email, supplied VAT number, order lines, amounts, taxes, currency and timestamps. It does not request phone numbers, payment-card data, browsing behaviour or marketing preferences.

Name and address are used only as statutory invoice content and to determine document treatment. Email is used only to deliver or resend the buyer’s document when enabled by the merchant. Data is never sold, used for advertising, profiling or unrelated analytics.

Retention and deletion

• Issued documents are immutable statutory records retained while the merchant uses the service, subject to the applicable tax-law period.
• Delivery recipients and operational error details are removed after 90 days, or earlier following a valid customer-redaction request.
• Temporary customer-data exports expire after seven days.
• Webhook idempotency records expire after 30 days; PII-free refusal records after one year; access audit records after two years.
• On Shopify’s shop-redaction request, all remaining shop data is deleted.

Customer rights

The app implements Shopify’s mandatory customer data-request, customer-redaction and shop-redaction webhooks. Requests should be made to the merchant, who can use Shopify’s privacy process. Operational contact data is erased; issued tax records may be retained where law requires it.

Security and subprocessors

Data is encrypted in transit and in production storage. Backups are encrypted. Production and test data are separate, production access is restricted and logged, and documented incident-response and data-loss-prevention procedures apply. Shopify supplies order events; the merchant’s configured email relay receives a document only when delivery is enabled.

• Shopify: merchant authentication and order/refund event source.
• Hetzner Online GmbH, Finland region: production compute and encrypted storage.
• Cloudflare, Inc.: DNS, TLS edge and denial-of-service protection.
• The merchant’s configured email relay: document delivery only when enabled.

Contact

Merchants can contact the operator through TrueVAT’s support channel in the Shopify App Store or from the embedded app. Customer requests should first be sent to the relevant merchant.