Privacy Policy — Tarvela Invoices

Last updated: 4 July 2026

Tarvela Invoices ("the App") is a Shopify application operated by Tarvela ("we"). It generates legally required tax invoices and credit notes for merchants' orders. This policy explains what personal data the App processes, why, and how.

What we process, and why

Data	Whose	Purpose	Legal basis
Order contents (items, amounts, taxes)	Customer of the merchant	Compute and print invoice lines and totals	Legal obligation (tax invoicing)
Customer name and billing/shipping address	Customer of the merchant	Legally required fields on the invoice	Legal obligation
Customer email	Customer of the merchant	Deliver the invoice PDF, identify the buyer	Legal obligation / legitimate interest
Merchant fiscal details (name, tax ID, address)	Merchant	Seller block printed on invoices	Contract

We deliberately request access to the minimum fields needed. We do not access phone numbers. We do not use personal data for analytics, profiling, advertising or any purpose other than producing and delivering invoices. We never sell or share personal data with third parties, except the email delivery provider used to send invoices on the merchant's behalf.

Storage and retention

Issued invoices are stored as immutable snapshots, because tax law requires invoices to be preserved unchanged (e.g. Spain: minimum 4 years, Ley General Tributaria arts. 66-70).
When a merchant uninstalls the App, OAuth credentials are deleted immediately; all remaining shop data (settings and invoice copies) is permanently deleted upon Shopify's shop/redact notice (48 hours after uninstall). Merchants should export their invoices before uninstalling.
Data is encrypted in transit (TLS) and at rest, including backups.

Customer rights (GDPR)

Access / portability: all data we hold about a customer appears on the merchant's invoices, which the merchant can retrieve in-app at any time.
Erasure: issued invoices are exempt from erasure while statutory retention applies (GDPR art. 17(3)(b)). We hold no other customer data, and honour Shopify's customers/redact process accordingly.

Contact

Data controller for merchant account data and processor for merchants' customer data: Tarvela — soporte@tarvela.com. Merchants remain the data controllers of their customers' data.