AppVerix Invoices: Privacy Policy

Last updated: October 13, 2026

AppVerix Invoices ("the app") is a Shopify app published by AppVerix ("we", "us"). This policy explains what the app collects when a merchant installs it, why, where it is kept, and how to have it deleted.

For the personal data of a store's customers, the merchant is the controller and we act as their processor. We only use that data to make and send the merchant's invoices.

1. What we collect and why

From the merchant's store (through Shopify's API):

Data Why Do we store it?
Shop domain, shop name, contact email, billing address, country and currency To fill in your business details on the invoice the first time you open the app, and to pick a default layout Only what ends up in your settings (see below)
An access token from Shopify So the app can read your orders Yes, in our database, until you uninstall
Orders: order number, date, line items, prices, taxes, discounts, shipping, refunds To draw the invoice, packing slip or credit note PDF No. Fetched from Shopify each time a PDF is made, then thrown away
Customer name, email, billing and shipping address, company and VAT number on the order Printed on the invoice. Email is used to send it. Only the email address the invoice was sent to (see below). Names and addresses are not stored.

What the app saves in its database:

  1. Your settings: company name, address, tax ID, contact email, logo image (PNG/JPEG, max 500 KB), chosen layout, invoice and credit-note number prefixes and counters, footer text, whether auto-email is on, and when you finished setup.
  2. Invoice records: for each order that got an invoice, the Shopify order ID, order number (for example #1003), the invoice number we gave it, the customer email it was sent to, when it was sent, and the error message if sending failed.
  3. Credit-note records: the Shopify refund ID, order ID and the credit-note number we gave it.
  4. Webhook receipts: the ID and topic of each Shopify webhook we received, so we don't process the same one twice. These contain no customer data.
  5. Login session: the Shopify session for your store (shop domain, granted scopes, access token).

We do not collect payment card data, phone numbers, browsing data, analytics, or cookies for tracking. The app sets no advertising or analytics cookies. We do not sell or share personal data, and we don't use it for profiling or automated decisions.

2. Who processes data for us

Provider What for Data they see Location
Cloudflare (cloudflare.com) Hosting for the app and its D1 database Everything listed in section 1 Globally distributed
Resend (resend.com) Sending invoice emails, only if auto-email is on Customer email address, your store name and reply-to email, and the PDF invoice (which shows the customer's name and address) USA
Shopify The platform the app runs on; also handles billing for the app Already holds all of this data See Shopify's privacy policy

Each provider has its own privacy terms. Where data leaves the EEA/UK, we rely on the provider's Standard Contractual Clauses or other approved transfer mechanisms.

3. How long we keep it

  • Settings, invoice and credit-note records: while the app is installed. They are needed so the same order keeps the same invoice number and numbers are never reused.
  • When you uninstall: we delete the login session right away. Shopify sends us a shop/redact request 48 hours later, and we then delete all of your store's settings, logo, invoice, credit-note and webhook records.
  • When a customer asks to be deleted (Shopify customers/redact): we remove their email address from our invoice records. We keep the invoice number and order number, which contain no personal data, because invoice numbering has to stay continuous for tax purposes.
  • Server logs: kept for up to 7 days. Customer emails are masked in logs (a***@example.com). Names and addresses are not logged.
  • Emails sent through Resend: kept by Resend under its own retention policy.

4. Your rights and data requests

The app supports Shopify's three privacy webhooks:

  • customers/data_request: we report which invoice records we hold for that customer, so the merchant can answer the request.
  • customers/redact: we delete that customer's email from our records.
  • shop/redact: we delete all data for the store.

Merchants can also email support@appverix.com to ask for a copy of their data or to have it deleted. We answer within 30 days. Customers of a store should contact the store first; we act on the merchant's instructions.

If you are in the EEA/UK you may also complain to your local data protection authority. In Brazil, the LGPD applies; contact us at support@appverix.com.

5. Security

  • All traffic to the app uses HTTPS (TLS).
  • The database is hosted on Cloudflare D1, which encrypts data at rest.
  • Webhooks from Shopify are verified with their HMAC signature; unsigned requests are rejected.
  • The app checks a Shopify session token on every admin request; it does not use third-party cookies.
  • Access to production infrastructure is restricted and protected by two-factor authentication.
  • If we learn of a breach that affects your data, we will tell you without undue delay and within 72 hours where the law requires it.

6. Changes

If we change this policy in a way that matters, we will update the date at the top and tell merchants inside the app or by email.

7. Contact

AppVerix. Email: support@appverix.com