Privacy Policy
Last updated: April 22, 2026
1. Introduction
Qixeo Invoice (“Qixeo”, “we”, “us”) is a Shopify app that generates invoices for partial fulfillments of Shopify orders. This Privacy Policy explains what data we collect, how we use it, and the rights available under applicable privacy laws including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Under GDPR, we act as a data processor: the merchant (the Shopify store) is the data controller for their customers’ data, and we process that data on their behalf to generate invoices and related documents.
2. Information we collect
2.1 Information from Shopify
When a merchant installs Qixeo Invoice, we receive data from Shopify’s Admin API, including:
- Order details: items, quantities, prices, taxes, discounts, and shipping totals
- Customer information: email address, billing address, shipping address, and VAT number (where provided)
- Fulfillment data: tracking numbers, carriers, and shipment contents
- Shop configuration: currency, address, and tax settings
- Session tokens for authentication
We only request the Shopify API scopes necessary for the app to function: read_orders, write_orders, read_fulfillments, read_merchant_managed_fulfillment_orders, read_products, write_draft_orders, read_customers, read_files, and read_payment_terms.
2.2 Information provided by merchants
- Company details: name, address, VAT number, phone, and email
- E-invoicing configuration: IBAN, BIC, PEPPOL identifier
- Cloud storage credentials (Google Drive OAuth tokens, SFTP credentials) — encrypted at rest
- Email sender name and reply-to address
- Invoice template customizations
2.3 Information collected automatically
- Server access logs (IP addresses, timestamps, request paths) used for security and debugging
- Error telemetry (no personal data is intentionally captured)
We do not use cookies for tracking or advertising in the embedded admin interface.
3. How we use the information
- Generate partial invoices, packing slips, credit notes, and related documents
- Deliver invoices by email to the customers the merchant specifies
- Upload invoice PDFs to the merchant’s connected cloud storage (if enabled)
- Provide a customer-facing order status page accessible via a unique token (merchant opt-in)
- Sync invoice summaries to Shopify order metafields for the merchant’s reference
- Enforce plan limits and process billing via Shopify’s Billing API
- Maintain audit logs of invoice actions for the merchant’s compliance records
- Respond to Shopify’s GDPR compliance webhooks (see Section 7)
We do not sell personal data, use it for advertising, or share it with third parties beyond the subprocessors listed below.
4. Subprocessors
We rely on the following third-party services to operate Qixeo Invoice:
| Subprocessor | Purpose | Location |
|---|
| Shopify Inc. | App platform & source of order / customer data | Canada / US |
| Railway | Application hosting | US |
| Supabase Inc. (PostgreSQL database & storage) | Primary datastore | US |
| Resend | Transactional invoice emails | US |
| Google LLC | Google Drive cloud upload (merchant opt-in) | Global |
Merchants who configure SFTP cloud upload transmit invoice PDFs to a server of their own choosing; we are not a subprocessor for that server.
5. Data retention
- While the app is installed: invoice, order, and merchant configuration data is retained for the lifetime of the merchant’s account.
- After uninstall: Shopify fires a shop/redact webhook approximately 48 hours after uninstall, which triggers full deletion of all merchant data from our production databases.
- Customer redaction: upon receipt of a customers/redact webhook, we scrub customer PII (email, name, address, VAT number) from invoices, order tracking records, status pages, and batch delivery records within 30 days.
- Backups: encrypted database backups are retained for up to 30 days.
6. International transfers
Data may be transferred to and processed in the United States. Where required by GDPR, we rely on Standard Contractual Clauses (SCCs) published by the European Commission.
7. Your rights under GDPR / CCPA
Data subjects (typically the customers of merchants using Qixeo Invoice) have the right to:
- Request a copy of their personal data
- Request correction of inaccurate data
- Request deletion of their data
- Object to or restrict processing
- Data portability
How to exercise these rights: because we are a data processor, requests should first go to the merchant (the Shopify store) who acts as the data controller. The merchant can forward the request via Shopify’s “Request customer data” or “Erase customer data” controls in their Shopify admin, which trigger the GDPR webhooks we handle automatically. You may also contact us directly at the email below.
Shopify GDPR compliance webhooks we honor:
- customers/data_request: acknowledged; the merchant is responsible for delivering the requested data to the customer within 30 days.
- customers/redact: customer PII across invoices, order tracking records, status pages, and batch delivery records is scrubbed within 30 days.
- shop/redact: all shop data is deleted, typically within the 48-hour window Shopify specifies after uninstall.
8. Children’s privacy
Qixeo Invoice is not directed to children under 13 (16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us personal information, contact us and we will delete it.
9. Security
- In transit: TLS 1.2 or higher for all connections.
- At rest: database encryption; cloud storage credentials encrypted at the application layer.
- Access controls: minimum necessary access for operations; no team access to merchant data without an explicit merchant request or security incident.
- Webhook verification: all Shopify webhook payloads are HMAC-verified before processing.
10. Changes to this policy
We may update this policy; the “Last updated” date at the top reflects the current version. For material changes, we will notify active merchants by email.
11. Contact
Privacy inquiries, data requests, or concerns: