Privacy Policy
How the B2B & B2C Order Invoices Shopify app handles store, merchant and customer data.
1. Who this policy is for
B2B & B2C Order Invoices (“the app”, “we”, “us”) is an application for Shopify stores that creates invoices and order summaries from orders, emails them to customers, and lets customers download their own invoices from their customer account.
This policy explains what the app does with data belonging to:
- Merchants — the Shopify store that installs the app, and the people who use it in the Shopify admin.
- Customers — the people who place orders on that store, and whose details appear on the invoices the app produces.
It applies only to the app. It does not cover Shopify itself, the merchant’s own storefront, or anything else the merchant runs. Each store has its own privacy policy for that.
2. Our role, and the merchant’s
There are two relationships here, and they work differently.
- Order and customer data belongs to the merchant. They are the controller of it; we are a processor acting on their instructions. We read it to produce the documents they asked for, and for nothing else. We do not sell it, rent it, share it for advertising, or use it to build any profile or product of our own.
- The merchant’s own account data is ours to administer. For the store record, the plan, billing state and support conversations, we are the controller — that is the data we need in order to run the app as a service.
A customer with a question about their own data should normally raise it with the store they bought from, because the store decides what happens to it. We will always help the store answer, and we act directly on the erasure requests Shopify sends us (see section 11).
3. What the app reads from Shopify
On install, the merchant grants a fixed set of permissions. The app can read nothing beyond them, and Shopify shows the list before the merchant agrees to it. They are:
| Permission | Why the app needs it |
|---|---|
| read_orders, write_orders | Read the order an invoice is for — number, date, line items, totals, taxes, discounts and shipping — and record on the order that an invoice was issued. |
| read_customers | The billing name, email and address that have to appear on the invoice. |
| read_companies, read_payment_terms | B2B orders only: the buying company and its payment terms, so a company invoice states the terms actually agreed rather than a guess. |
| write_draft_orders | Payment links for an invoice that is still unpaid. |
| customer_read_orders, customer_read_customers | Used by the customer account extension, so a signed-in customer can see and download the invoices for their own orders — and only their own. |
Most of this is read at the moment a document is generated and used to render it. Only the small set of fields in the next section is written to our database.
4. What we store
The app keeps a database record per store. Everything in it is keyed to the store’s domain, and one store can never read another’s.
Invoice records
One row per invoice: the invoice number and issue date, the Shopify order id and order number, the customer’s name and email, a tax or GST number if the store collects one, the currency, and the subtotal, tax and total. The date an invoice was emailed is stored so that the same invoice is never sent twice.
Activity history
A log of what the app did — an invoice issued, emailed, downloaded or regenerated — with the order number and, where relevant, the customer’s name and email, so a merchant can see what happened to a given order.
Store and account record
Details Shopify provides about the store itself: shop domain and id, store name, the store owner’s name, the store contact email and phone, the store address, currency, timezone and Shopify plan; when the app was installed and uninstalled; onboarding progress; and the selected plan, subscription and charge identifiers with the current billing period and usage.
Settings and templates
Everything the merchant configures: invoice templates and their markup, the business details, logo and tax identifiers they choose to print, footer and payment-terms text, invoice numbering, email settings, and the history of AI template generations for that store.
Sessions
A Shopify session record holding the access token that authorises the app to call Shopify on the store’s behalf. It is deleted when the app is uninstalled, at which point Shopify also revokes the token.
All of it is kept for as long as the app is installed, and then removed as described in section 11.
5. What we never store
- Payment card numbers or bank details. The app never receives them. Payments are handled by Shopify and its payment providers, and an invoice shows only what was paid and how.
- Shopify passwords or staff credentials. Access is by Shopify OAuth; we never see a password.
- Generated PDFs. Every invoice PDF is built on demand from the order at the moment it is requested, sent or downloaded, and then discarded. There is no archive of invoice files on our servers.
- Order line items and addresses. They are read from Shopify while a document is being rendered and are not copied into our database; only the totals listed above are kept.
6. How the data is used
- Generating invoices, order summaries and related documents.
- Emailing those documents to the customer, when the merchant has asked the app to.
- Showing a merchant their invoices, totals and activity in the Shopify admin.
- Letting a signed-in customer view and download invoices for their own orders.
- Applying the store’s plan, usage limits and billing through Shopify.
- Answering support requests and diagnosing faults.
- Keeping the service secure, and meeting our legal obligations.
Data is not used for advertising, resold, or shared with anyone outside the sub-processors in section 9.
7. AI template generation
The app can generate and edit invoice templates from a written instruction. That feature calls Anthropic’s Claude models through Amazon Bedrock, inside our own AWS account.
Customer data is not sent to the model. What is sent is the template markup, the merchant’s written instruction, their store’s template settings, any image the merchant uploads as a design reference, and — so the result can be previewed — a fixed sample order with invented names and amounts. Real orders and real customers are not part of the request.
Amazon Bedrock processes each request only to return the result. Prompts and outputs are not used to train models and are not retained by the model provider. We keep a short history of a store’s own generations so the merchant can undo one, and it is deleted with the rest of their data.
8. Emails sent to your customers
When a merchant enables invoice emails, the app sends the customer their invoice as a PDF attachment through Amazon SES. The message goes to the email address on the order, carries the store’s name and the merchant’s wording, and is sent from a verified sending address belonging to the app.
These are transactional messages about an order the customer placed. They are not marketing, they are not sent to anyone who has not ordered, and the app never emails a customer for its own purposes. A merchant who turns the feature off stops them for their store entirely. SES retains delivery metadata — whether a message was accepted, bounced or complained about — which is what allows a bad address to be reported back to the merchant.
9. Sub-processors
The app runs on a small number of named services. These are all of them.
| Service | Purpose | Data it sees |
|---|---|---|
| Shopify | The platform the app is installed on | Orders, customers and store data, which originate there |
| Fly.io | Application hosting | Anything the app processes, in transit, plus server logs |
| MongoDB Atlas | Database | The stored records in section 4 |
| Amazon SES | Sending invoice emails | Recipient email, store and message content, and the attached PDF |
| Amazon Bedrock (Anthropic Claude) | AI template generation | Template markup and instructions only — see section 7 |
| Crisp | Support chat inside the Shopify admin | The merchant’s name, email and what they write to us. No customer or order data, unless a merchant pastes it into a chat. |
Each is bound by its own data-processing terms. We will update this list before adding another, and a merchant can ask to be notified of changes by writing to admin@accounteditor.com.
10. Where the data lives
The application is hosted in Amsterdam, in the European Union. The database is hosted by MongoDB Atlas. Email delivery and the AI feature run in Amazon Web Services regions in the United States, which means those two operations involve a transfer outside the EEA and the UK. Such transfers rely on the Standard Contractual Clauses in our agreements with those providers.
11. Deletion, uninstalling and erasure requests
The app implements all three of the privacy webhooks Shopify requires, and they do what follows automatically.
| Event | What happens |
|---|---|
| App uninstalled | The session and access token are deleted at once. The store’s records are kept for 48 hours, so that a merchant who reinstalls the same day finds their templates, numbering and invoices intact. |
| Store erasure (48 hours after an uninstall) | Everything belonging to that store is deleted: invoices, activity, settings, templates, numbering, email settings, AI history and the store record. Nothing of theirs remains. |
| Customer data request | We report to the store what the app holds for that customer, so the merchant can answer the customer within Shopify’s deadline. |
| Customer erasure request | The customer’s name and email are permanently overwritten on their invoices and in the activity history. The invoice rows themselves remain, without the person. |
Why an invoice row survives a customer erasure. An invoice is an issued document with a number in an unbroken sequence, and merchants are required by tax law in most countries both to keep those records and to leave no gaps in the numbering. So we remove the person — the name and the email, which is what the request is actually about — and leave the accounting record standing. Shopify’s own requirement is that the data be “deleted or redacted”, and this is redaction.
Backups are retained by our database provider on a rolling basis and are overwritten in the ordinary course; data deleted from the live database disappears from backups as those roll over.
12. Your rights
Depending on where you live — including under the GDPR in the EU and the UK, and the CCPA/CPRA in California — you may have the right to access a copy of your personal data, to correct it, to have it deleted, to receive it in a portable form, to object to or restrict its processing, and to complain to your data-protection authority. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.
Customers: contact the store you ordered from. They can raise the request through Shopify, which passes it to us and to every other app the store uses, and we act on it as described above.
Merchants: write to admin@accounteditor.com. We answer within 30 days. Uninstalling the app is also a complete deletion request, and takes effect as set out in section 11.
13. Security
- All traffic to the app, and between it and its providers, is encrypted with TLS.
- Access to Shopify is by OAuth token, scoped to a single store and revoked on uninstall. Every admin request is verified as coming from Shopify before anything is read or written.
- Every query is scoped to one store’s domain, so no store can be shown another’s data.
- Customer invoice downloads use signed links that expire after 15 minutes and are valid for one customer and one order.
- Credentials are held as server-side secrets and are never sent to the browser.
No system can promise perfect security, but if a breach affects your data we will notify you and the relevant authority as the law requires.
14. Cookies and tracking
Inside the Shopify admin, the app uses the session cookies Shopify requires to keep a merchant signed in, and the Crisp chat widget sets its own cookies so a support conversation survives a page reload. There are no advertising cookies, no cross-site trackers and no third-party analytics. The app adds nothing at all to a merchant’s storefront, so it sets no cookies on shoppers.
15. Children
The app is a business tool for merchants and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, write to us and it will be deleted.
16. Changes to this policy
If this policy changes, the date at the top changes with it. A change that materially affects how merchant or customer data is handled will be announced in the app before it takes effect.
17. Contact
For any privacy question, data request or complaint about B2B & B2C Order Invoices, write to admin@accounteditor.com. We reply within 30 days, and usually much sooner.