Privacy policy – Vintax

Who we are and what the app does

Vintax is a Shopify app that works out VAT on the margin for second-hand goods, works of art, collectors' items and antiques, issues the matching invoices, and helps merchants keep a record of their purchases. For the personal data of their customers and of the people they buy from, merchants are the data controllers and we process that data on their behalf (GDPR art. 28).

Data we process

Shop data: orders (products, prices, discounts, shipping, refunds, country of delivery), product settings and purchase prices, and the details entered in the app's settings (company name, address, VAT number). We use them only to compute VAT, produce invoices and reports, and show them to the merchant.

Customer data: names and billing addresses are read from Shopify when an invoice is made, to print them on it, and are not stored.

Purchase register: the details of the people merchants buy from (name, address, status, identity document) that merchants enter themselves, as their national dealer register requires. They are encrypted (AES-256-GCM). Who consulted the register and when is logged for one year, as the French arrêté of 15 May 2020 requires.

We do not sell data, do not use it for advertising and do not track visitors. The app sets no cookies of its own beyond what Shopify needs to sign the merchant in.

Where data is kept and who processes it

The app runs on Google Cloud Run and stores its data in a PostgreSQL database hosted by Neon, both in the European Union. These providers act as our sub-processors under data processing agreements.

How long data is kept

Data is kept while the app is installed. When a merchant uninstalls the app, Shopify asks us 48 hours later to delete the shop's data (shop/redact) and we delete all of it, purchase register included. Merchants who must keep their register longer (for instance 10 years in France for an electronic register) should export it before uninstalling.

Security

Connections are encrypted (HTTPS), access to the app requires the merchant's Shopify session, identity data in the purchase register is encrypted at rest, and backups are encrypted by our hosting providers.

Your rights

Customers and sellers should contact the merchant, who controls their data; we help merchants answer requests, including those Shopify forwards to us (customers/data_request). Merchants can contact us about their own data at the address below. Everyone may also complain to their data protection authority (in France, the CNIL).