Privacy Policy — Facturette

Version 1.0 — effective 2026-08-07 This is an English translation provided for information. The French version (politique-confidentialite.fr.md) is the only authoritative text.

1. Who we are

Facturette is a Shopify app published by:

Facturette automatically generates Factur-X invoices (PDF/A-3 + EN 16931 CII XML) compliant with French law and, for merchants on the paid tier, files B2B invoices to the merchant's accredited e-invoicing platform (Plateforme Agréée).

2. Our role: processor, not controller

The merchant operating the Shopify store is the data controller for their customers' data. Facturette acts solely as a processor under Article 28 GDPR: we process personal data only on the merchant's documented instructions, expressed by installing the app and configuring it.

We never use the merchant's customer data for our own purposes — no marketing, no profiling, no resale, no model training, no commercial analytics.

The terms of this processing are set out in the Data Processing Agreement (data-processing-agreement.en.md), which forms part of the contract entered into at installation.

3. What we process, and why

3.1 Merchant and store data

The access token is encrypted at rest (ASP.NET Core Data Protection, with keys persisted in the database rather than on the instance disk).

3.2 The merchant's customers' data

We request access to three protected fields, and only three:

Phone number is deliberately not requested. A French invoice does not need it. Requesting a field we have no use for would breach the data minimisation principle.

We also process the order data needed for the calculation: line items, quantities, prices, discounts, shipping, VAT rates and amounts, currency, payment date, the Shopify order and customer identifiers, and where applicable the business customer's SIREN (entered by the merchant or the customer, used to route B2B versus B2C).

3.3 What we do not store

The raw body of a Shopify webhook is never retained. An orders/paid body carries the customer's name, address and email; we store only a SHA-256 digest, which is enough to guarantee idempotency (never invoicing the same order twice) while retaining no personal data at all.

No customer personal data appears in our application logs.

4. Retention periods

Our retention model is deliberately short: the merchant, not Facturette, holds the long-term archive. The ten-year invoice retention obligation is theirs, and we do not duplicate it.

The merchant retains the invoice permanently through two channels we populate: the attachment on the Shopify order and the email sent to the customer.

5. Where data is hosted

All data is hosted in Europe, in a country whose level of protection the European Commission has recognised as adequate:

Switzerland is not a member of the European Union or the EEA, so hosting there is a transfer to a third country within the meaning of Chapter V of the GDPR. That transfer relies on an adequacy decision of the European Commission (Art. 45 GDPR), adopted on 15 January 2024 under the GDPR: personal data may be transferred from the EU and the EEA to Switzerland without additional safeguards. Standard Contractual Clauses are therefore not required.

An adequacy decision is a living instrument, reviewed periodically by the Commission. Should it be suspended or repealed, or should the hosting location change, this policy will be updated and merchants notified before the change takes effect.

The SUPER PDP case

For merchants on the paid tier, and for B2B invoices only, the invoice is transmitted to the merchant's accredited platform through SUPER PDP using the merchant's own API key. This transmission is the merchant's legal obligation under French B2B e-invoicing rules, not a transfer of data for our benefit. Facturette holds no account on the platform and is not a party to the tax filing.

6. Security

Measures actually implemented:

• Encryption in transit: HTTPS/TLS for all public access; mTLS (Oracle wallet) to the database; HTTPS to the Shopify and SUPER PDP APIs. The application service is not publicly exposed in cleartext — it listens only on the loopback interface, behind Cloudflare.
• Encryption at rest: Transparent Data Encryption on the Oracle Autonomous Database, backups included; access tokens carry a second, application-level layer of encryption.
• Minimisation: three protected fields requested, phone excluded; webhook bodies never retained; no personal data in logs.
• Tenant isolation: every request is scoped to the store derived from a verified session token or an HMAC-validated webhook — never from a client-supplied parameter.
• Environment separation: development and production data live in distinct database schemas under distinct credentials.
• Secrets: never in source control; environment variables in production.

Our incident procedure is described in the security incident response policy (security-incident-response.en.md).

7. Data subject rights

The merchant's customers exercise their rights (access, rectification, erasure, restriction, objection, portability) with the merchant, who is the controller.

We assist the merchant through the Shopify mechanisms provided for this purpose:

• customers/data_request — we report to the merchant what data we hold for that customer.
• customers/redact — the customer's personal data is deleted. Given the 30-day retention window (§4), there is usually nothing left to erase by the time the request arrives.
• shop/redact — all store data is erased after uninstall.

Questions about this processing: [email protected]. You may also lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).

8. Cookies and trackers

Facturette's admin interface renders inside the Shopify admin and uses no analytics, advertising or profiling cookies. Authentication relies on Shopify session tokens, sent with each request and not stored in a cookie.

9. Changes

Any material change to this policy is notified to installed merchants before it takes effect. The version date appears at the top of this document.