1. Roles
When you install the App in your Shopify store, you (the merchant) are the controller of your store's data and of your customers' personal data. Droid Infinity ("we") processes that data on your behalf, as a processor, solely to provide the App under the Terms of Service and Shopify's API terms. For the data this website collects about its visitors, we are the controller.
2. Data the App Processes
Store Data
- Your store's domain, name, owner name, email, phone and address, pulled from Shopify and editable in the App.
- Your settings, templates, logos, signature images, fonts and the number sequences you configure.
- Your plan, subscription status and monthly document counts.
Order and Customer Data
- Orders and draft orders: numbers, dates, line items, prices, taxes, discounts, shipping, payment status and method, notes and attributes, tags and the metafields you select.
- Customers named on those orders: name, email, phone, billing and shipping addresses, tax identifiers such as a VAT number, and the customer's locale.
- Generated PDFs, which contain the data above as printed, and the emails sent with them (recipient addresses, subject, timestamps and delivery results).
We read this data through Shopify's APIs only when a document is generated, previewed, sent or automated, and only for the orders involved.
3. Why We Process It
- To render, store and deliver the documents you request or automate.
- To email documents to your customers on your instruction, and to record delivery, bounces and complaints so you can act on them.
- To provide customer download links, which are signed and valid only for the order they belong to.
- To validate a buyer's VAT number against the EU VIES registry when a buyer VAT number is detected on an order or when you ask for a check; the number and the registry's answer are cached for 30 days.
- To bill your plan through Shopify, enforce plan limits and warn you about usage.
- To operate, secure and improve the App: logs of requests and errors, which may include store and order identifiers and customer email addresses, but never payment card data.
4. Where Data Is Stored and Who Helps Us
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Firestore, Realtime Database, Cloud Storage, Cloud Tasks, Secret Manager, Cloud Logging) | Hosting, databases and sessions, PDF storage, background jobs, credentials and logs | United States (us-central1) |
| Amazon Web Services (Simple Email Service) | Sending the emails you trigger and reporting their delivery | United States |
| Shopify | The platform the App runs in; billing; the source of store and order data | Per Shopify's own policy |
| European Commission VIES service | VAT number validation when a buyer VAT number is present | European Union |
Data is encrypted in transit and at rest by these providers. We do not sell or rent data, and we do not use your customers' data for advertising or for anything other than providing the App to you.
5. Retention and Deletion
- Issued invoices (sent to a customer) are kept as immutable versions for at least 5 years on Enterprise plans and at least 2 years on other plans, to support your record-keeping obligations; the current version of a document stays for as long as the App is installed. Estimates are kept for at least 1 year. Superseded versions that were never sent are removed earlier.
- Settings, templates and history are kept while the App is installed.
- Uninstall: when you uninstall the App, Shopify sends us a shop-redaction request after its waiting period, and we delete your store's settings, templates, documents, PDFs, email-suppression entries, counters and sessions.
- Customer requests: Shopify forwards customer data-access and erasure requests to us. For an access request we send you an export of the customer's documents and events to forward to them. For an erasure request we delete that customer's never-sent drafts and scrub their email from history, and we retain issued invoices of record for the retention period above, as the law allows; they are erased when it ends.
- Logs are retained by Google Cloud Logging for up to 30 days.
- VIES cache entries expire after 30 days.
6. Customer Download Links
A download link contains a signature tied to one order and your store's secret. Anyone holding the link can download that order's invoice until you regenerate the secret, which invalidates every link sent so far. Send the links only through channels you control, such as the order confirmation email.
7. Data from This Website
- The Site sets no cookies and runs no analytics or advertising scripts. Fonts are loaded from Google Fonts, which receives your IP address when the font files are requested.
- The Contact Us form sends your name, email, store domain and message to our support inbox by email and sends you a confirmation. We keep the correspondence as long as needed to answer you and for our records. The form also records your IP address briefly, in memory only, to limit abuse.
- Our hosting provider keeps standard request logs (IP address, user agent, URL, time) for a limited period for security.
8. Your Rights
Merchants can view and change their store data in the App at any time and delete everything by uninstalling. Customers should direct access, correction or erasure requests to the merchant whose store they bought from; where Shopify forwards such a request to us, we act on it as described in section 5. Depending on where you live you may have further rights under laws such as the GDPR, the UK GDPR or India's Digital Personal Data Protection Act; write to us and we will help.
9. Security
Access to production systems is restricted to the people who operate the App. Credentials are stored in a managed secrets service, never in code. Download links and API keys are signed or hashed so that a stored value cannot be used on its own. Email delivery feedback is verified before it is acted on.
10. Children
The App and the Site are for businesses and are not directed at children under 16. We do not knowingly collect their data.
11. Changes
We may update this policy; the effective date at the top changes when we do. Material changes are announced in the App.
12. Contact
Droid Infinity, Chennai, India. Email: support@droidinfinity.xyz.