Privacy Policy

Marketplace Invoice ("we", "us", "our") values the protection of personal data. Marketplace Invoice is an app inside your Shopify admin that turns every paid order into a VAT-compliant invoice. In this privacy policy we explain what data we process, why we do so, and how we handle it, in accordance with the General Data Protection Regulation (GDPR).

Data controller

The data controller for the processing described in this policy is:

• Marketplace Invoice
• Email: info@marketplaceinvoice.com
• Chamber of Commerce (KvK): 70163561
• VAT number: NL002310732B91

1. What data we collect

We collect and process the following personal data:

• Your name and email address as the merchant, and the domain of your Shopify store
• Your company name, Chamber of Commerce number, VAT number and address details, as they appear on your invoices
• Order and customer data from your Shopify store that we need to create an invoice: customer name, address and email address, the order lines, the totals and the VAT, and the customer's VAT number when the order carries one
• The access token Shopify issues when you install the app
• Documents you upload through Quick Invoice in a web account (screenshots, PDFs or CSVs) for data extraction purposes
• Payment information: your plan for the Shopify app runs through Shopify, existing web accounts run through Stripe. We do not store payment details ourselves
• Usage and analytics data on our public website (page views, sign-ups), collected via Google Analytics and the Meta Pixel only after you accept analytics cookies in our cookie banner. The app itself is not tracked

2. How we use your data

We use your data exclusively for the following purposes:

• Creating a VAT-compliant invoice for every paid order in your Shopify store
• Attaching that invoice to the order in Shopify and emailing it to your customer when you have that turned on
• Creating a credit note when you refund an order
• Managing your account, your plan and your billing
• Communicating about our service (service messages)
• Extracting invoice data from uploaded documents via the Quick Invoice feature (using Anthropic Claude)
• Measuring website traffic and advertising effectiveness, with your consent (see section 7)

3. Legal basis for processing

We process your personal data on the following legal grounds (GDPR Art. 6):

• Contract performance (Art. 6(1)(b)): processing is necessary to create and deliver your invoices, as agreed when you installed the app or created an account.
• Consent (Art. 6(1)(a)): analytics and marketing cookies are only placed after you give consent via our cookie banner, which you can withdraw at any time.
• Legitimate interest (Art. 6(1)(f)): we have a legitimate interest in improving our service and maintaining the security of our platform.
• Legal obligation (Art. 6(1)(c)): we are required to retain certain data, such as invoice records, to comply with fiscal retention requirements under Dutch law.

4. Access, storage and security

We take the security of your data seriously:

• You grant us access to your store data by installing the app in Shopify, and you revoke it by uninstalling the app. We read no more than your orders, the customer details on them, and your shop details.
• The access token for your Shopify store is stored encrypted (AES-256-GCM). Encryption keys are stored separately from the database.
• Our database is hosted by Neon (PostgreSQL) within the European Union.
• The application is hosted on Vercel with servers in the EU.
• All data traffic is transmitted via secure HTTPS connections.
• Passwords, where an account has one, are stored hashed and are never available in plain text.

5. Sharing with third parties

We do not share your personal data with third parties, except with the following processors that are necessary to provide our service:

• Shopify: order data, invoice delivery and the billing for your plan, through the Shopify API and at your request
• Vercel: application hosting (EU)
• Neon: database hosting (PostgreSQL, EU)
• Resend: sending the emails that carry your invoices
• Stripe: payment processing for existing web accounts (US, with Standard Contractual Clauses for EU to US data transfers)
• Anthropic: data extraction from documents you upload in Quick Invoice only (US, under commercial API terms, see section 9)
• Google: Google Analytics and Google Tag Manager for website analytics, and Google Ads for advertising measurement (US, with Standard Contractual Clauses), only after you accept analytics cookies
• Meta: the Meta (Facebook) Pixel for advertising measurement (US, with Standard Contractual Clauses), only after you accept marketing cookies
• Trustpilot: displaying our customer reviews widget on the public website

We have Data Processing Agreements in place with all of these parties. We never sell your data to third parties.

6. International data transfers

Your data is primarily processed within the European Union. In some cases, data may be transferred outside the EU:

• Shopify processes your shop and order data in its own infrastructure, which may sit outside the EU, under its own terms.
• Stripe processes payment data for existing web accounts in the United States under Standard Contractual Clauses (SCCs) to ensure an adequate level of data protection.
• Anthropic processes Quick Invoice document data in the United States under their commercial API terms. Data sent to Anthropic is not used for model training.
• Google and Meta process website analytics and advertising data in the United States under Standard Contractual Clauses, and only when you have accepted the relevant cookies.
• All other data processing occurs within the EU (Vercel EU, Neon EU).

7. Cookies and analytics

We use a functional session cookie for authentication and small functional cookies to remember your language and your cookie-consent choice. On our public website we also use analytics and marketing cookies, from Google Analytics, Google Tag Manager and the Meta Pixel, but only after you accept them. We run Google Consent Mode, so these are denied by default until you opt in, and you can decline them entirely. Stripe may place its own cookies during checkout in a web account, please refer to Stripe's privacy policy. Read more in our cookie policy.

8. Your rights

Under the GDPR you have the following rights:

• Right of access: you can request which data we process about you.
• Right to rectification: you can have incorrect data corrected.
• Right to erasure: you can request the deletion of your data.
• Right to data portability: you can receive your data in a commonly used format.
• Right to restriction: you can have the processing of your data restricted.
• Right to object: you can object to the processing of your data.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You can exercise your rights by contacting us at info@marketplaceinvoice.com. We will respond to your request within 30 days.

9. Use of AI in Quick Invoice

The Quick Invoice scan feature uses Anthropic Claude (a large language model by Anthropic, PBC) to extract structured data (customer name, address, line items, amounts) from uploaded documents such as screenshots, PDFs, or images.

What data is sent to Anthropic

When you use the Quick Invoice scan feature, the content of your uploaded document is sent to Anthropic's API for processing. This may include customer names, addresses, product descriptions, prices, and other information visible in the document.

How Anthropic handles your data

• We use Anthropic's commercial API, which operates under their Commercial Terms of Service.
• Your data is not used to train Anthropic's models. Their commercial API terms explicitly state that customer data submitted through the API is not used for model training.
• Anthropic may retain API inputs and outputs for up to 30 days for trust and safety purposes, after which the data is deleted.
• Anthropic processes data in the United States.

Your control

• The Quick Invoice scan feature is entirely optional. You can always create invoices manually without using it.
• You review and approve all extracted data before an invoice is generated. No automated decisions are made.
• If you do not want your data to be processed by Anthropic, simply do not use the scan feature.

For more information about how Anthropic handles data, see their Privacy Policy and Commercial Terms.

10. Automated decision-making

We do not use automated decision-making or profiling as referred to in Article 22 of the GDPR. Every invoice follows from the factual order data in your Shopify store and involves no decisions that produce legal effects or similarly significantly affect anyone. The Quick Invoice scan feature only suggests data, which you review and approve before any invoice is created.

11. Retention and erasure

We retain your data for as long as the app is installed in your store and for as long as it is needed for the purposes above. We honour the privacy webhooks Shopify sends us:

• customers/data_request: we look up the data we hold about that customer, which is what appears on their invoices, and report it back to you.
• customers/redact: we remove that customer's personal details (name, email address, address and VAT number) from the invoices we hold.
• shop/redact: Shopify sends this request 48 hours after you uninstall the app. We then erase your store's data, close the connection and delete the access token.

We keep invoice records for the statutory retention period, seven years under Dutch law, unless you ask us to erase them and no legal obligation stands in the way. If you delete a web account, your data is removed from our systems within 30 days, apart from the records we are legally required to keep.

12. Data Processing Agreements

We have entered into Data Processing Agreements with all of our processors, including Shopify, Vercel, Neon, Resend, Stripe, Anthropic, Google and Meta, that comply with the requirements of the GDPR. These agreements ensure that your data is processed in a secure and legally compliant manner.

13. Changes

We may update this privacy policy from time to time. In the event of substantial changes, we will notify you by email. The most current version is always available on this page.

14. Contact and complaints

If you have questions about this privacy policy or about the processing of your personal data, please contact us at info@marketplaceinvoice.com.

If you have a complaint about the processing of your personal data, you may file a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.