Privacy policy

What this is about

Facteado is an app for Shopify stores that lets merchants create, send and track invoices with a Swiss QR payment part from their orders. This policy explains which data is processed – for merchants who use the app and for their customers who receive an invoice.

Controller

Facteado.ch, Vogelmatt 6, 6216 Mauensee, Schweiz

Contact for all privacy requests: support@facteado.ch

We are the controller for merchant data (account, settings, plan). We process the data of a store's customers on behalf of the merchant; the merchant is responsible for its purpose and lawfulness.

Merchant data

When a store installs Facteado, we store the store address (e.g. name.myshopify.com), the access token issued by Shopify, the plan and the app settings: company name, address, contact details, bank details (IBAN or QR-IBAN), VAT number, logo, templates, texts and fonts of the invoices.

So that it can be traced who viewed customer data, we log access to invoices with the user ID Shopify sends for store staff and keep this log for one year. We do not store names or email addresses of staff.

The purpose is providing the app; the basis is the contract with the merchant.

Data of a store's customers

For an invoice, Facteado reads the order from Shopify: name, company, billing and shipping address, email address, order number, items, amounts, taxes, payment method and payment status. We do not read phone numbers. For an invoice without an order, we store what the merchant enters.

We store each invoice with its PDF and a history (e.g. created, sent, opened, reminded, paid). When an invoice is opened through the link in the email or on the order page, we note the time once; we do not store IP addresses. Anyone who has the link can open the PDF; the link cannot be guessed.

When the merchant marks an invoice as paid, Facteado can also mark the order as paid in Shopify. Payments never go through Facteado: customers pay directly into the merchant's account. We do not see customers' bank details or account transactions.

The purpose is the merchant's invoicing; the legal basis is the merchant's contract with their customers. Facteado uses this data for nothing else, in particular not for advertising and not for analyses across stores.

Sending by email

When the merchant sends an invoice through Facteado – manually or automatically according to their settings – or sends a reminder by hand, the email with the PDF goes to the order's email address. The sender name and reply-to address are the store's. The invoice history records which address it went to.

Facteado does not use tracking pixels in emails. We cannot tell whether an email arrives or is read.

Address search

While an address is being entered, the app can show suggestions. For this, our server sends the entered text to the Swiss federal geodata service (Federal Office of Topography swisstopo, geo.admin.ch). No other data is transmitted.

Visiting the website

We do not use analytics, advertising or tracking tools on our pages. If you pick a language on our pages, we remember the choice in a cookie (facteado_lang, valid for one year) that only contains the language code (“de”, “fr”, “it” or “en”). Our hosting provider may briefly keep technical access data such as IP address and time in server logs to ensure operation and security.

Support requests

When you write to us by email or through the contact form in the app, we process your email address, the store address, the content of your message and any screenshots to answer the request. We keep the correspondence as long as needed for the request and statutory retention duties.

We inform merchants by email or in the app about important changes, security topics and their plan. We only send marketing newsletters with explicit consent.

Service providers

We use the following categories of processors: a hosting provider for running the app and the database (data centre in the Netherlands), an email provider for the mailbox and sending of emails (Switzerland), a provider for the daily backup copy of the database (USA; encrypted before upload, kept for 30 days) and Shopify (platform and plan billing). Where data is disclosed to the USA, it is protected by standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Plans are billed exclusively by Shopify. We neither see nor store payment data; we only learn which plan a store has booked.

The processing by these providers is also subject to their own privacy policies. We do not sell personal data and do not pass it on for advertising.

Disclosure in special cases

We only disclose data to authorities or courts if we are legally obliged to or if it is necessary to protect our rights, defend against claims or investigate misuse of the app.

If Facteado is transferred in whole or in part to another company, for example in a sale or merger, the data may be transferred with it. It remains protected by this policy, and we inform merchants beforehand.

Data security

We protect the data with encrypted connections (HTTPS), restricted access, an access log and a data centre in the EU. However, nobody can guarantee completely secure transmission and storage on the internet.

Retention

A store's data is kept as long as Facteado is installed. After uninstalling, we delete all of the store's data including all invoices as soon as Shopify asks us to (usually after 48 hours). The statutory retention of invoices (10 years in Switzerland) is the merchant's responsibility: they must download or export their invoices before uninstalling.

If a customer requests the deletion of their data through Shopify, we remove the email address from their invoices and from the invoice history. The invoices themselves, with name and address, remain because the merchant must keep them; the history notes the deletion.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Write to us at support@facteado.ch. You can also lodge a complaint with a data protection authority; in Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC).

If you are a customer of a store, please contact the store first: it is responsible for your data. If we receive your request directly or through Shopify, we forward it to the merchant and mark your invoices for them so they can find them quickly.

Before answering a request, we may ask for proof of your identity. We usually answer within 30 days.

Children

Facteado is aimed at businesses, not children. We do not knowingly process data of persons under 16 as users of the app.

Merchant duties

Merchants are themselves responsible for informing their customers in their own privacy policy about invoicing and sending by email, for answering their customers' requests and for keeping their invoices as required by law.

Liability

Facteado's terms of service govern liability. To the extent permitted by law, we are not liable for damage arising from processing by service providers, from attacks by third parties despite reasonable safeguards, or from data that merchants or Shopify supply incorrectly. Mandatory statutory liability, in particular for intent and gross negligence, remains unaffected.

Governing law and changes

This policy follows the Swiss Federal Act on Data Protection (FADP). We may adapt it when the app or the legal situation changes; the version published on this page applies. We inform merchants in the app before material changes. If the language versions differ, the German version prevails.