Privacy Policy

1. Who we are

We have not appointed a Data Protection Officer; we are not required to. Privacy questions go to the contact address above and are handled by the company's administrator.

2. Two different roles

Which rules apply depends on whose data it is. Invocourier wears two hats:

We are a processor for buyer data

The personal data that appears on invoices - the merchant's customers - belongs to the merchant. The merchant decides what to invoice and why; we act only on their instructions, through the app's settings. In GDPR terms the merchant is the controller and we are the processor. If you bought something from a shop and have a question about your data, contact that shop first; they are the right party to answer, and we will support them.

The obligations that bind us as a processor are set out in our Data Processing Agreement, which is entered into automatically with every merchant who installs the app.

We are a controller for our own business data

For the data we hold about merchants themselves - the account, the settings, billing - and for people who leave an email address on this website, we are the controller and this policy is our own notice to you.

3. What we process, and why

a. Buyer data on invoices (processor)

When an order qualifies for an invoice, Shopify sends us the order and we render the invoice document. That document contains: buyer name, billing address, email address, VAT or company registration number where the buyer provided one, for Italian invoices the buyer's codice fiscale and their codice destinatario or PEC address where they were given, the ordered items, and the amounts. We store the finished document (its XML, and the PDF where one was produced) plus the buyer name and VAT number as index fields so the merchant can find it. For Romanian invoices we also keep the RO e-Factura upload index and the Ministry of Finance's signature file, which together with the XML form the legal original.

For orders the app deliberately does not invoice - a consumer sale outside a B2B mandate, a sale that belongs in the Italian corrispettivi register, a point-of-sale order - we keep a short record instead: the Shopify order reference and its date, the reason, the totals and the VAT rates. Those records let the merchant see why an order carries no invoice, and let us produce the daily register totals Italian law expects. They hold no buyer name, address or email.

We also store the result of VAT-number checks against the EU VIES service (the number, whether it was valid, the registered trader name, and when it was checked), because that is the evidence for the VAT treatment applied to the invoice.

Purpose and basis: producing and transmitting invoices that the merchant is legally required to issue. The merchant's basis is their legal obligation (GDPR art. 6(1)(c)); ours is our contract with the merchant (art. 6(1)(b)) and their documented instructions. We request the minimum an invoice needs - we do not ask Shopify for the buyer's phone number.

b. Merchant account data (controller)

The shop's .myshopify.com domain, the merchant's own company details entered in Settings (legal name, address, VAT number, company registration number, contact email and phone, bank IBAN where they add one for payment instructions), their invoicing preferences, the authentication session with Shopify, and the count of documents issued each month for billing.

Purpose and basis: providing and billing the service - our contract with the merchant (art. 6(1)(b)).

c. Email signups on this website (controller)

If you use the readiness checker and leave your email, we store the email address and the answers you selected (your country, whether you sell B2B, how you invoice today). We use it to send you the compliance checklist you asked for and to tell you when the connector launches for your country.

Basis: your consent (art. 6(1)(a)). You can withdraw it at any time by replying to any message or writing to , and we delete the address.

d. Technical logs

Our web server records requests in the ordinary way: IP address, time, the page requested, and the browser's user-agent string. This is what lets us diagnose faults and spot abuse. Basis: our legitimate interest in operating a secure service (art. 6(1)(f)).

4. Who else is involved

These companies process personal data on our behalf so that the service can run. Each is bound by a contract limiting them to our instructions.

Shopify is not in this list: Shopify is the merchant's own platform and the source the order data comes from, not a party we pass data to.

The Polish Krajowy System e-Faktur (KSeF) is not a processor either: it is the state e-invoicing system in which a merchant established in Poland is legally required to file invoices to business buyers. We submit those merchants' FA(3) invoices to the Ministry of Finance under the merchant's own authorisation token; the Ministry (Szef Krajowej Administracji Skarbowej) is the controller of what it holds and keeps it for ten years. Consumer invoices reach KSeF only when the merchant opts in.

The Romanian RO e-Factura system, run by ANAF and the Ministry of Finance, is not a processor either: it is the state e-invoicing system in which a merchant established in Romania is legally required to file invoices, to businesses and to consumers alike. We submit those merchants' invoices to the Virtual Private Space (SPV) through the ANAF login the merchant or their accountant performed with their own qualified certificate; the Ministry of Finance is the controller of what it holds. A consumer who gave no tax identifier is identified by thirteen zeros; we never collect a personal identification number (CNP).

We keep this list current. Before any new sub-processor starts handling personal data - for example a French Plateforme Agréée when we support the French mandate - we update this page and notify merchants, so they can object.

5. Where data is processed

Invoice data is stored and processed inside the European Union, on servers in Helsinki, Finland. Documents sent over the Peppol network reach the recipient's access point, which is determined by the recipient's own registration. Invoices of merchants established in Italy pass through our accredited channel in Ravenna, Italy, which transmits them to the Agenzia delle Entrate's Sistema di Interscambio as Italian law requires. Invoices of merchants established in France pass through Super PDP, a Plateforme Agréée in Paris, France, which delivers them to the buyer's platform and files the e-reporting with the French tax administration as French law requires; the merchant's own account on that platform is what our application uses.

Cloudflare, which operates the network edge in front of our servers, is a US company with a global network; traffic to this site may be routed through infrastructure outside the EU. Where that involves a transfer, it relies on the European Commission's Standard Contractual Clauses. Our backups are also stored with Cloudflare, in a bucket restricted to the European Union - and they are encrypted on our own server before they are sent, so Cloudflare holds data it cannot read.

6. How long we keep it

Invoices, while the merchant uses Invocourier. Invoices are accounting records: the law obliges the merchant to keep them for years, not months (ten years in Italy, France and Belgium, eight in Germany, and so on). While the app is installed we keep the merchant's archive intact for exactly that reason.

An erasure request from a buyer does not delete an invoice. GDPR art. 17(3)(b) keeps records that exist to satisfy a legal obligation out of reach of erasure, and an issued invoice is such a record. When a request arrives, we tell the merchant which documents hold the buyer's data and confirm that we hold nothing else about them. Anything about that buyer that is not in an invoice, we do not keep in the first place.

Everything else: merchant account data and settings are deleted 48 hours after uninstall, as above. Website signup emails are kept until you unsubscribe. Server logs are rotated and deleted after no more than 14 days.

Backups. We keep encrypted backups so that a failure or a mistake cannot destroy a merchant's records. Backups rotate on a fixed schedule and the oldest is never more than six months old, so data deleted from the live system disappears from our backups within six months at the latest. We do not restore a backup in order to recover data that was deliberately deleted.

7. Your rights

Under the GDPR you can ask for access to your personal data, correction of it, erasure, restriction of processing, portability, and you can object to processing based on legitimate interests. Where processing rests on consent, you can withdraw it at any time without affecting what was done beforehand.

If you are a shopper whose details appear on an invoice: please contact the shop you bought from. They decide what happens to that data; we act on their instructions and will help them respond.

If you are a merchant, or you signed up on this website: write to . We answer within 30 days.

If you think we have handled your data badly, you are entitled to complain to your local data protection authority, or to ours: ANSPDCP in Romania.

8. Cookies

This website sets no cookies. There is no analytics, no tracking pixel and no advertising script on these pages - which is why you are not being asked to accept anything.

The application itself, inside the Shopify admin, sets only the session cookies needed to keep a merchant signed in. Those are strictly necessary and are not used to track anyone.

9. Security

Data is encrypted in transit (TLS everywhere) and at rest: customer data - the database with the invoice archive, and the sign-up list from this site - is stored on an encrypted volume (LUKS2) whose key is never stored on the server, and swap memory is encrypted with a key that changes on every start. Backups are encrypted on our server before they leave it, with a key held only by us, so the company storing them cannot read them. The operating-system disk holds no customer data and is not separately encrypted. Access to the server is limited to the company's administrator, over key-based authentication only with passwords disabled, and is logged. We keep a written incident response procedure: if personal data is ever breached, we notify affected merchants without undue delay and the supervisory authority within 72 hours where the GDPR requires it.

10. Changes to this policy

When we change something material - a new sub-processor, a new category of data, a different retention period - we update the date at the top of this page and notify merchants before the change takes effect. Older versions are available on request.