Privacy Policy

1. Introduction & Overview

This Privacy Policy explains how India GST Invoicing & Tax Bills ("the App", "we", "us", "our") collects, uses, stores, and protects personal data and commercial information when you install and use our Shopify application. We are committed to upholding the highest standards of data security, privacy, and compliance with the Digital Personal Data Protection (DPDP) Act, 2023 (India), the General Data Protection Regulation (GDPR), and Shopify's Partner Program & API Policies.

2. What Information We Collect

In order to generate statutory Rule 46 CGST Tax Invoices, Delivery Packing Slips, and Credit Notes, the App collects and processes only the minimum data strictly necessary to fulfill these tax compliance functions:

A. Merchant Store Information:

• Shopify store domain (`.myshopify.com`) and contact email.
• Merchant business configuration: Legal Business Name, Trade Name, 15-digit GSTIN, 10-digit PAN, Registered Commercial Address, Phone, and State Code.
• Optional invoice customizations: Business logo URL, digital signature image URL, authorized signatory name, bank account details, and UPI ID for customer payment QR codes.
• Custom product HSN code and GST rate mapping configurations.

B. Order & Customer Transaction Information:

• Shopify Order ID, sequential order number, order date, and financial/fulfillment status.
• Customer delivery destination: Shipping Name, Address, City, State, State Code, and Pincode (used to determine Place of Supply and compute CGST/SGST vs. IGST).
• Customer Billing Name and Address (for statutory Bill-To tax entity designation).
• Buyer GSTIN (captured via order custom attributes for B2B wholesale transactions).
• Purchased line items: Product title, variant/size, SKU, quantity, unit price, discounts, and item tax lines.

3. How We Use Collected Information

We process information solely for the following explicit, legitimate purposes:

• Statutory Invoicing: Dynamically generating legally compliant Rule 46 Tax Invoices, Packing Slips, and Credit Notes.
• Tax Slabs & HSN Lookup: Calculating accurate CGST, SGST, and IGST breakdowns according to Indian GST council classifications.
• Wholesale B2B Management: Enabling corporate customer directories, PO numbers, and separate shipping/billing address tracking.
• GSTR-1 Sales Register Export: Formatting itemized line-item Excel/CSV reports for merchant tax filing reconciliation.
• Credit Ledger Tracking: Managing invoice generation credit balances and billing transactions via Shopify Billing.

4. Data Sharing & Third Parties

Order data is obtained through Shopify APIs and saved in our database. If UPI QR codes are enabled, the QR image provider receives the merchant UPI ID, business name, invoice number, and payment amount to generate the image.

5. Data Storage, Security & Retention

• Security: All network communications are encrypted end-to-end using Transport Layer Security (TLS/HTTPS). Stored invoices are protected with tamper-proof HMAC-SHA256 signature tokens.
• Retention: Generated invoices and order records are retained only as long as you maintain the App installed on your Shopify store, to enable instant free invoice re-printing and historical tax auditing.
• Deletion upon Uninstallation: Uninstalling removes Shopify access sessions. Store records and saved invoices are removed when Shopify sends its store-redaction request. Customer data requests and redaction requests are processed through Shopify privacy webhooks.

6. Mandatory GDPR & Shopify Privacy Webhook Compliance

The App has implemented and maintains active listeners for all Shopify Mandatory Privacy Webhooks:

• `customers/data_request`: If a customer requests a copy of their personal data processed by your store, Shopify dispatches this webhook. Because invoices are derived on demand from Shopify orders, any stored invoice records matching the customer can be exported.
• `customers/redact`: If a customer requests erasure of their personal data, Shopify notifies us. Any stored customer references in generated invoices are scrubbed and anonymized.
• `shop/redact`: 48 hours after a merchant uninstalls the App, Shopify sends a store data erasure webhook. Our system permanently deletes all database records, configurations, HSN mappings, B2B data, and stored invoice files for that store.

7. Merchant and Customer Rights

Under applicable Indian and international privacy legislation, merchants and their customers have the right to:

• Request confirmation of whether their personal data is being processed.
• Access and receive a portable copy of their tax invoice records.
• Request correction or updating of inaccurate business information.
• Request complete erasure of their records.

8. Contact Us

For any questions, data deletion requests, or privacy compliance inquiries, please contact our Data Protection Officer: