Privacy Policy

Version 1.15 names in sections 2, 4 and 9 more of what the register holds. For a credit note, that is Shopify's identifier of the refund and the link to the invoice it corrects. For an invoice, it is the supply date. For every document but a delivery note, it is the tax treatment. None of these names a person. It also adds to sections 2, 5, 7 and 9 the record of the app's request for a review. The request is switched off today, so the record does not exist yet. Sections 2 and 7 now say that the record of your plans notes a move to another paid subscription. That can also be a new charge for the same plan. This version names data the app already held and a record it does not write yet. It takes away none of your rights, uses no data for a new purpose and applies from the day we post it. Version 1.14 corrects sections 2 and 7 on the record of your plans. The record notes whether a plan ended because you moved to another paid plan, not to any other plan. A move to the free plan is not noted as a change of plan. The app already kept the record this way. This version takes away none of your rights and applies from the day we post it. Version 1.13 adds to sections 2, 5, 7 and 9 the record of the paid plans your store chooses. It applies from the day we post it. The record is new and takes away none of your rights. No data we already held is used for a new purpose. Version 1.12 makes section 6 more exact about what we give the AI tool we work with when we want its help answering your question. It also adds that the tool reads the reviews published on our App Store page and writes and posts our public replies. It changes nothing about your store's data. It applies from the day we post it. Version 1.11 adds to section 6 what we give the AI tool we work with when we want its help with a reply. It changes nothing about your store's data. It applies from the day we post it. Version 1.10 removes from section 2 the sentence on the request records stored before 13 September 2026. Those records have now run out. It changes nothing about your store's data. It applies from the day we post it. Version 1.9 adds to section 14 the visitor's consent to the analytics cookie. Shopify's page is set to ask for it in the European Union, the European Economic Area, Switzerland and the United Kingdom. It changes nothing about your store's data. It applies from the day we post it. Version 1.8 adds section 14, on the people who view the app's page on the Shopify App Store, and Google Analytics to the companies in section 6. It changes nothing about your store's data. It applies from the day we post it. Version 1.7 adds to sections 2, 5 and 7 the record kept for development stores and stores being transferred. It applies from the day we post it. The record is new and only exists for those stores. No data we already held is used for a new purpose.

This policy explains what data the app handles, why, where it is kept, and how to have it deleted. It is written for the merchant who installs the app. Section 14 is about the people who view the app's page on the Shopify App Store. The English text is the binding one. A German translation is provided for convenience.

1. What the app does

The app makes invoices (Rechnung), delivery notes (Lieferschein) and credit notes (Gutschrift) as PDF files from your Shopify orders, in German or English. It makes a document when you click, from the order as Shopify holds it at that moment. The app adds nothing to your storefront or your checkout. If the app is unavailable, your orders, your checkout and Shopify's own documents keep working.

2. Data we store about your store

When you install the app, Shopify gives us:

• your store's myshopify.com domain;
• an access token that lets the app read your orders, and nothing else;
• the list of permissions you granted.

While you use the app, we store:

• your settings: your company name and address, your tax number or VAT ID, and whether you use the small business rule (Kleinunternehmerregelung). Also the bank details line if you enter one, your logo, your numbering and the document language;
• a register of every document you issue. For each one it holds Shopify's identifier of the order and its order number (such as #1001), the document type, the document number, the date and the currency. It also holds the net, tax and total amounts per tax rate, and a fingerprint of the file that shows whether a reissued document is identical. For an invoice it holds the supply date as the invoice printed it. That is the days the goods were shipped, or the issue day, or the month they are expected to ship with the days of any parcels already sent. When the goods ship later, it also holds the days Shopify recorded a payment on. For every document but a delivery note it holds the tax treatment the document was issued under, as a kind and a country code. For a credit note or a cancellation invoice it holds the link to the invoice it corrects. When it was issued for a refund, it also holds Shopify's identifier of that refund. None of these names a person;
• an activity log: which document was issued or made again, for which order and when, and when the register was exported. It also holds the Shopify user number of the staff member who clicked, not their name or email address. The log also notes when a customer data request named an order we hold records for (section 9);
• a record of each customer data request that names orders we hold records for. It holds Shopify's identifiers of those orders, when the request arrived and when the file was first downloaded (section 9);
• the identifiers of the notices Shopify sends us, so each is handled once;
• the email address Shopify holds for your store, so we can send you the notices in section 12. That is the store owner's address, or the store's public contact address when Shopify gives us no owner address. The app reads it when a staff member opens the app, at most once a week, and stores it with the date it was read. We use it for nothing else. It is never shown in the app and never written to a log;
• for each notice we give your store, the record that it was shown to you and, where it applies, that it was emailed, with the times;
• if you choose a paid plan, a record of it. It holds your store's myshopify.com domain, the plan, when its trial starts and ends, and whether it is a test charge. With it we keep Shopify's identifier of the charge, the dates the plan started and ended, and whether it ended because your store took out another paid subscription. That can be a move to another paid plan or a new charge for the same plan. We use it to count how many stores are on each plan and how many trials turn into a paid plan. After a transfer the app also reads it. Once your store has held a paid plan since the transfer, the app stops telling you why your store is on the free plan;
• if Shopify tells the app that your store is a partner development store, a record of it. It holds your store's myshopify.com domain and the last time the app found the store to be one. Once it is no longer one, the record also holds when the app found that out. We use it to tell you after a transfer why your store is on the free plan, and to count how many development stores use the app. We also use it so the app can tell that a test charge from its development days is not a paid plan;
• once the app's request for a review is switched on, a record of it. It holds when the app showed you Shopify's review window, the last answer that window gave and when the request ended. We use it to ask you for a review after you have issued your second invoice. Once Shopify has shown you its window, the app does not ask again. The same holds when Shopify tells the app this store cannot be asked (already reviewed, a yearly limit or waiting period, not eligible). The request is switched off today. While it is off, the app never asks you, so it has nothing to record.

The first time you open the settings, the app reads your store's name and address from Shopify to fill in the form. We store them only when you save.

Shopify tells the app which language your admin is set to every time a page loads, so the app can show itself in German or English. We do not store it.

If you write to our support address, we store your message, the address you wrote from and any name you give us, so we can answer you and follow up later.

Our servers also keep technical logs of requests for 30 days. For a request to the app it writes one line. It holds the time, the method, the address requested without anything after a question mark, the status and the duration. It also holds a short tag that stands for your store, computed with a key, in place of the store's web address. Where the app's other lines name your store, they hold that tag too. They also hold other fields, such as Shopify's order and refund identifiers, document numbers and counts. The app's logger refuses a field that holds a name, an address, a customer number or a staff user number. Lines that Node or React Router write by themselves are kept as they are written, outside that rule.

Since 13 September 2026 we no longer store the record that Google's hosting platform makes of each request. That record was the only place the network address of the browser or server making the request was written. Google processes the network address to deliver each request and keeps its own record of that under its own terms. We do not receive it.

3. Data we read but do not keep

When you make a document, the app reads from Shopify what the document must show. That is the order's items, prices, discounts, shipping, tax and refunds. It is also your customer's name or company name, and the billing and shipping address. For a business order, it also reads the buyer's VAT ID from the order's additional details. These details go into the PDF, which is sent to your browser. They are not written to a database, a file, a cache or a log.

The app does not ask Shopify for your customers' email addresses or phone numbers and does not read them. It does not read Shopify's customer records either, only the names and addresses on the order.

The app asks Shopify for an offline access token only. We do not receive the name or the email address of the staff member who installs the app or opens it. The one address we do read is the one Shopify holds for the store itself, described in section 2.

The app sets no cookies of its own and uses no analytics or advertising trackers. The app's page on the Shopify App Store is Shopify's page, not part of the app. Section 14 covers it.

4. Our role

For the data we hold about your store and your account, we decide why and how it is used, so we are the controller of it. For the personal data we handle to make your documents, we act on your instructions as your processor under Article 28 of the GDPR. That covers your customers' names, addresses and VAT IDs, and the user numbers of your staff. It also covers the order identifiers in the register, in the activity log and in the records of customer data requests, and the order numbers and refund identifiers in the register. The Data Processing Agreement that governs this is part of our Terms of Service. If your business needs a signed copy of the Data Processing Agreement, write to support@larchline.co and we send one.

5. Why we use this data

• To make the documents you ask for: reading the order, applying your settings and your numbering, and keeping the register so that no number is used twice. This is necessary to perform our contract with you (Article 6(1)(b) GDPR).
• To show you what was issued, when, and by which staff account. This is part of the same contract (Article 6(1)(b)).
• To tell you about a change to this policy, our terms, our sub-processors or our prices. We also tell you if we shut the service down, if the app passes to another company, or if there is a security problem. We give these notices in the app and by email, as section 12 says. This is part of the same contract (Article 6(1)(b)).
• To help you: answering your support requests and finding the cause of a problem. This is part of the contract. If you are not yet a customer, it is our legitimate interest in answering you (Article 6(1)(f)).
• To tell you after a transfer why your store is on the free plan. And so the app can tell that a test charge from before the transfer is not a paid plan. This is part of the same contract (Article 6(1)(b)).
• To count how many development stores use the app. Only the totals leave the database. Our legitimate interest is knowing how the app is doing (Article 6(1)(f)).
• To count how many stores are on each plan and how many trials turn into a paid plan. Only the totals leave the database. Our legitimate interest is knowing how the app is doing (Article 6(1)(f)).
• Once the request for a review is switched on: to ask you once for a review of the app, after you have issued your second invoice. Our legitimate interest is asking the stores that use the app what they think of it (Article 6(1)(f)).
• To keep the app secure and reliable: logs, error tracking and the detection of misuse. Our legitimate interest is a service that works and is not misused (Article 6(1)(f)).
• To meet legal duties, such as answering a public authority (Article 6(1)(c)). Answering a privacy notice from Shopify is part of the contract.

You do not have to give us your settings, but without them the app cannot make a correct document. For your customers' data on the documents, you decide the purpose and the legal basis, and we act on your instructions (section 4).

We never sell your data and we never use it for advertising.

6. Where the data is kept

The app runs on Google Cloud servers in Belgium (region europe-west1), and its database and technical logs are stored there. Encrypted backups of the database are kept by Google Cloud in the European Union. So the data the app holds is stored in the European Union. Support email is handled on Microsoft 365.

Shopify holds your store's data, including your orders and your customers, under its own privacy policy. When you make a document, Shopify sends the app what that document needs, over an encrypted connection.

We are a United States company. The two people who run the app work from the United States. They can reach the database for support and maintenance, and your customers' names and addresses are not in it. They build and run the app with Claude, an AI tool made by Anthropic PBC in the United States. A written rule binds that work: the tool never reads your settings, your customers' data or your emails to us. When we want help answering a question you sent us, a person gives it only the question, without names, email addresses or order details. The tool also reads the reviews published on our App Store page, with the store details Shopify shows beside them, and writes and posts our public replies. It works only through the operators' own Google sign-in, not an account of its own. Technical messages it works with can still show your store's web address. If you write to us, a person reads your message in the United States.

Resend sends the notice emails described in section 12. It receives the address Shopify holds for your store and the text of the notice. That text holds nothing about your customers. Resend stores the email and the record of its delivery in the United States and keeps them for 30 days.

Google LLC, Microsoft and Resend are on the Data Privacy Framework list for transfers from the European Union to the United States. Google LLC provides both Google Cloud and Google Analytics. Resend's data processing terms also state that the standard contractual clauses the European Commission has approved apply to such transfers. Where that framework does not cover a transfer to Google Cloud, Microsoft or Resend, we rely on the standard contractual clauses the European Commission has approved, which are part of our contracts with them. For the data we handle as your processor, the same clauses are part of our Data Processing Agreement with you.

Companies that process or receive data for us:

Shopify is not on this list. It is the platform your store runs on, you have your own agreement with it, and the app receives order data from it when you make a document.

7. How long we keep it

• Your settings, the register, the activity log and the access token: for as long as the app is installed.
• When you uninstall the app: the access token and the email address Shopify holds for your store are deleted at once. Everything else we hold about the store is deleted about 48 hours after you uninstall, when Shopify tells us the store has removed the app. If that notice does not reach us, we delete it ourselves, at the earliest 14 days after you uninstall and normally within 30 days. Only if Shopify cannot confirm to us that the app was removed do we keep it longer, until it does. If Shopify does not answer when we check the uninstall, the access token stays until the rest is deleted, so we can ask again. The exceptions are the record in the next point and the record of your plans, which stays only as a count (see below). Write to us if you want it deleted sooner.
• The record that a Shopify notice was handled (your store's web address, the kind of notice and its date): at the latest 30 days after its arrival. We keep it at least 23 days, so the same notice is not processed twice, except in the two cases that follow. When your store's data is deleted (the point above), these records go with it. Only the record of Shopify's removal notice can stay, and it is deleted within 30 days after you uninstall. If you install the app again after an uninstall, Shopify may confirm to us that it is installed. The record of that uninstall can then be deleted at once, and at the latest 14 days after it arrives. The one exception to the 30 days is the record of your uninstall when Shopify cannot confirm that the app was removed. We keep it until Shopify does, because it tells us when to delete your data.
• The record of a customer data request (section 2): you can download its file for 55 days after the request arrives. The record is deleted within 60 days after the request arrives. It is deleted earlier when you uninstall the app, or when Shopify asks us to delete that customer's data.
• The record that a notice from us (section 12) was shown to your store and emailed to it: while the app is installed. It is deleted with the rest of the store's data after you uninstall (see above). We keep it so you can see that you were told.
• The notice emails at Resend, with the records of their delivery: 30 days.
• The development-store record (section 2): it stays when you uninstall the app and is deleted with the rest of the store's data (see above).
• The record of the app's request for a review (section 2): it stays when you uninstall the app. It is deleted with the rest of the store's data (see above).
• The record of your plans (section 2): while the app is installed. When you uninstall, the plans in it are marked as ended. When the rest of your store's data is deleted (see above), the record loses its link to your store and to Shopify's identifier of the charge. What remains is each plan, its dates, whether it was a test charge and whether another paid subscription replaced it. Nothing in it names your store. We keep that only as a count.
• The listing-page records of section 14: Google Analytics keeps them at most 14 months, counted from a returning visitor's last visit.
• Deleted data can remain in the encrypted database backups for up to 8 days, until those backups are replaced.
• Technical logs: 30 days.
• Support emails: up to 24 months, so we can follow up on earlier requests.
• The documents themselves: we keep no copy. The PDFs you download are yours, and you keep them for as long as the law of your country requires.

8. Your rights

If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, you can ask us at any time to:

• see the data we hold about your store;
• correct it;
• delete it;
• limit how we use it while a question about it is open;
• receive it in a portable format.

Your right to object. You can object at any time to a use based on our legitimate interest (section 5). We then stop, unless we have compelling reasons that override yours.

The app makes no decisions about people by automated means.

Write to support@larchline.co. We answer within one month. If a request is complex, we may take two more months, and we tell you why within the first month. You can also complain to a data protection authority, in particular where you live or work or where you think the problem happened. In Germany that is the data protection authority of your federal state. In Austria it is the Datenschutzbehörde. In Switzerland it is the Federal Data Protection and Information Commissioner (FDPIC).

If you are a customer of a shop that uses the app, the shop decides how the data on its documents is used. Write to the shop first. You can also write to us at support@larchline.co. We pass your request to the shop and help it answer you.

9. Requests that come through Shopify

Shopify sends apps three kinds of privacy notices. This is how the app answers them:

• Customer data request: we find what we hold for the orders named in the request. That is the document numbers, dates and amounts, and when documents were made and by which staff user number. If we hold any, we record that the request came in and the app shows you a notice. From it you download these records as a machine-readable file (JSON), so you can answer your customer. The file covers the orders we held records for when the request arrived. It holds every entry the register and the activity log keep for those orders, and nothing about other orders. It is made when you download it; we keep no copy. If we hold nothing for those orders, the app shows no notice.
• Customer data deletion: for the orders named in the request, we delete the activity log entries. We also delete the record of any customer data request that names one of those orders. We keep each document's number, date and amounts in the register, because your numbering must stay complete. We remove the link to the order, which is its identifier and its order number, and for a credit note the identifier of the refund. We can then no longer tell which order a document belonged to.
• Store data deletion: we delete everything we hold about the store except the record of your plans. That is the settings, logo, register, activity log, records of customer data requests and access token. It is also the record of the app's request for a review. The record of your plans loses its link to your store and stays only as a count (section 7). One record that the deletion happened stays: your store's web address, the kind of notice and its date, so the same notice is not processed twice. We delete it at the earliest 23 days after it arrives, and in any case within 30 days after you uninstall.

10. Security

The app's own keys and the database password are kept in a secrets manager, never in code. Each store's access token is kept in the app's database, which is encrypted. Data travels encrypted, and the database and its backups are encrypted at rest. Your customers' names and addresses are never stored, so no copy of our database contains them. Only the app and the two people who run it can reach the database. The people sign in through Google, with two-factor authentication. The AI tool they work with is barred by the written rule in section 6 from opening it. If a security problem affects personal data we handle, we tell you without undue delay, and at the latest within 48 hours of becoming aware of it.

11. Children

The app is a tool for merchants and is not directed at children.

12. Changes to this policy

When we change this policy, we post the new version with its date. For a change that affects your rights, we tell you before it takes effect. Before we use data for a new purpose, we tell you first.

How we tell you. Where this policy says we tell you something, you get the same notice in two places. The app shows it on every page until you mark it read. It stops showing 30 days after the change takes effect, or 60 days after we post it when it names no date. We also send it by email to the address Shopify holds for your store, when Shopify gives us one (section 2). The sender is noreply@larchline.co, and you can reply to support@larchline.co. These emails are about the app and this policy only. We never use them for advertising.

13. Contact

Scena Labs LLC 522 W Riverside Ave, Ste N Spokane, WA 99201 United States support@larchline.co

14. Visitors to the app's page on the Shopify App Store

This section is about anyone who views the app's page on the Shopify App Store, apps.shopify.com/rechnung-lieferschein-pdf, merchants included. It changes nothing about your store's data or your customers' data in the app. The app itself uses no analytics (section 3).

That page is Shopify's page. In Shopify's form for the page we give Shopify a measurement ID of our Google Analytics 4 property for our apps' pages on the Shopify App Store. Shopify's page then sends Google Analytics a record of each view of the page and of each click on its buttons to install or open the app. Depending on the property's settings, Google Analytics can also record other actions on the page, such as scrolling or a click on a link. Google Analytics sets a cookie with an identifier in the visitor's browser. Shopify's own privacy policy covers the rest of Shopify's site.

We use these records only to count the views of the page and the clicks on those buttons: by page, by country and by day. In Google's reports we look at totals, never at a single visitor, and we never try to identify one. We do not use them for advertising, and we do not combine them with the data the app holds about stores. The reason is our legitimate interest in knowing how many people view the page and install the app from it. In the European Union and the European Economic Area a cookie like this needs the visitor's consent. Shopify's page is set to load Google Analytics there only after the visitor accepts analytics cookies in Shopify's cookie choice. It does the same for visitors in Switzerland and the United Kingdom. For those visitors Shopify's page is set to place the cookie only with their consent. For visitors in the European Union, the European Economic Area and the United Kingdom, where that consent is collected, both the cookie and the counting rest on it. For the counting the basis is Article 6(1)(a) GDPR, and in the United Kingdom the UK GDPR. For the cookie it is §25(1) TDDDG in Germany and regulation 6 of PECR in the United Kingdom. Visitors can withdraw their consent at any time, with effect for the future. To do so they can change their choice in Shopify's cookie banner or delete all stored data of apps.shopify.com in their browser. For visitors elsewhere the basis stays the legitimate interest above. The rights in section 8 apply to these records too.

Google LLC, in the United States, provides Google Analytics and receives these records, so they go to the United States (section 6). We stay responsible for our use of them. Google Analytics keeps them at most 14 months, the longest a standard Google Analytics property allows. For a visitor who comes back, those 14 months can count from the last visit. Google states that Google Analytics 4 does not log or store IP addresses.