How the Northscale Shopify apps handle data

Who we are

The apps are provided by Northscale Performance LLP (registration number LL0003399), 105-5307 Victoria Dr, Vancouver, British Columbia, V5P 3V6, Canada. Representative: dr. Juhász Dávid Imre. Contact: support@northscaleperformance.com.

What data each app processes

All apps. Store data needed to run the app: the store's domain, name, email, currency, time zone, plan type, and an access token issued by Shopify. App settings the merchant saves.

Elállási gomb HU/EU (online withdrawal button).

• From the customer's withdrawal form: name, email address, order number, and optionally the contract date, the items concerned, postal address and a message.
• To match a request to an order, the app reads the email address of that order from Shopify.
• To prevent abuse, the submitting network address is stored only as a salted hash, for at most 2 hours; submission counts per store and per email address are kept for at most 2 days.
• The acknowledgement email to the customer is sent through our email provider.

Számla Híd HU (invoicing with Billingo or Számlázz.hu).

• From the orders to be invoiced: customer name, billing and shipping address, email, phone, company name and tax number, items, prices and taxes.
• This data is sent only to the invoicing service the merchant connects (Billingo or Számlázz.hu), using the merchant's own API key.
• The merchant's API key is stored encrypted (AES-GCM) and is never shown again after saving.
• An event log (order number, invoice number, result) is kept for 90 days.

Pénztár Kit HU (payment rules and pickup point picker).

• The app does not read orders or customer data.
• The pickup point a customer selects is saved as a cart attribute in the merchant's own store.

E-Rechnung Bridge (ZUGFeRD and XRechnung e-invoices).

• From the orders to be invoiced: customer name, billing and shipping address, email, phone, company name and VAT ID (USt-IdNr.), items, prices, taxes, discounts and refunds.
• From this data the app creates invoice and credit note documents (PDF and XML) in the merchant's name and stores them so the merchant can download them, send them to the customer and export them for accounting (CSV, DATEV).
• EU business customers' VAT IDs are checked with the European Commission's VIES service; the result is cached for 30 days.
• If the merchant turns on invoice emails, the invoice is emailed to the customer through our email provider.
• An event log (order number, invoice number, result) is kept for 180 days.

How long we keep data

• Withdrawal declarations (Elállási gomb): 5 years from receipt, the general limitation period under Hungarian civil law, unless the merchant deletes them earlier.
• Invoicing event log: 90 days (Számla Híd), 180 days (E-Rechnung Bridge).
• Invoice and credit note documents (E-Rechnung Bridge): kept while the app is installed. The merchant remains responsible for the statutory archive (for example 10 years under § 147 AO) and can download all documents at any time. They are deleted together with the store's other data on uninstall.
• Technical server logs: 3 days.
• When a merchant uninstalls an app, Shopify sends a deletion request (shop/redact) and we delete all data of that store.

Where data is stored and who processes it

• Cloudflare, Inc. (Cloudflare Workers and Workers KV): hosting and storage, encrypted at rest and in transit.
• Resend (Elállási gomb and E-Rechnung Bridge): sending acknowledgement, notification and invoice emails.
• European Commission VIES (E-Rechnung Bridge): VAT ID validation.
• Billingo or Számlázz.hu (Számla Híd only): invoicing, chosen and connected by the merchant.
• Shopify: the platform the apps run on.

We do not sell personal data and do not use it for advertising or automated decision-making.

Customer and merchant rights

Customers can ask the merchant to access, correct or delete their data. We support this through Shopify's privacy requests: a customer data request (customers/data_request) is forwarded to the merchant, and a customer deletion request (customers/redact) anonymises that customer's records in our apps. Merchants can contact us at the email above with any privacy question; we answer within 30 days.

Security incidents

If we confirm a security incident affecting merchant or customer data, we notify the affected merchants by email within 72 hours with the facts known, the data categories involved and the actions taken.

Changes

If this policy changes, the updated version is published at this address with a new date.

Back to the apps