1. Information we collect

The App uses the Shopify Admin API scopes read_orders,read_all_orders, read_fulfillments,read_customers, read_draft_orders andread_products, as well as webhooks sent by Shopify, to collect the following information:

• Store information: store domain, authentication and session information (including access tokens), the user ID, name, email address, and locale of staff who use the App and the role assigned to them in the App, granted scopes, and webhook delivery records.
• Information entered by the merchant: company name, address, phone number, email address, Japanese qualified invoice registration number and verification result, business and tax settings, document and email settings, bank transfer information, fiscal year-end month, billing status, logo and company seal images shown on documents, and the name, hash, and last-used time of API keys for external integrations.
• Order and customer information: order and customer IDs, order number and date, billing name or addressee, email address, shipping name, address and phone number, product title, SKU, variant, quantity, price and discount, currency, tax rate and amount, payment method, delivery method and date, tracking numbers, and order tags.
• Refund information: refund ID and date, refund note, refunded products, quantities, amounts, taxes, and shipping refunds.
• Documents and operational records: receipt, invoice, delivery note, refund invoice, quotation, purchase order, monthly invoice and statement numbers; addressee; point-in-time order snapshots; tax breakdowns and totals; PDF files and their hashes and storage identifiers; audit logs; addressee change requests; and hashed download tokens. Audit logs include a keyed hash of the client IP address, kept to prevent misuse.

2. How we use information

• To authenticate the App and manage stores and settings.
• To issue documents from orders and refunds, including automatic issuance and corrected versions.
• To store PDFs and provide verified downloads and email delivery.
• To maintain statutory records, search capabilities, and audit trails under Japanese invoice and electronic recordkeeping laws.
• To prevent duplicate webhook processing, protect the service, investigate failures, and respond to support requests.

We do not use the information for advertising or behavioral targeting.

3. Data retention

Issued documents, point-in-time order, tax, addressee and line-item snapshots, PDFs, and audit records are generally retained for seven years from the applicable statutory start date to comply with Japan’s Electronic Books Preservation Act, Consumption Tax Act, and other applicable laws. If a longer period is legally required, we retain them for that period.

Issued documents are not overwritten; a correction creates a new version while the original is retained. If the App is uninstalled, we delete all data for the store, including documents and PDFs otherwise subject to statutory retention, within up to 14 days of receiving Shopify’s shop/redact webhook (typically delivered around 48 hours after uninstallation, though Shopify does not guarantee an exact delivery time). We do not delete this data if the App has been reinstalled by the time we carry out that deletion. Other information is retained for as long as needed to provide and secure the service, handle billing and requests, or comply with applicable law.

Immediately after uninstallation, and before the deletion above takes place, we issue a temporary export link — limited by expiry date and download count — so you can retrieve your document data, and send it in a notification email. Anyone who has this link can download all documents for the store, so the email also asks that it not be forwarded. It is sent to the email address you registered in the App’s settings (your company email). If none is registered, we use the store’s registered email address from Shopify’s app/uninstalled webhook payload as a fallback recipient.

4. Third-party disclosure and service providers

We do not sell personal information or disclose it to third parties for advertising. We disclose personal data to third parties only with consent, when required by law, or when necessary to protect life, property, or legal rights.

We use service providers for hosting, databases, PDF object storage, and email delivery. For email delivery, the provider receives information such as the recipient email address, store name, order number, document number, and download link. Providers are given only the information needed to perform their services.

If you submit a feature request or bug report from within the App, the content you enter, your optional email address, attached images, store domain, browser type and screen size, and the URL of the current screen (without query parameters) are sent to our support ticket system (desk-api.jizai.dev).

5. Access, correction, and deletion requests

Requests to access, correct, erase, or restrict personal data under Japan’s Act on the Protection of Personal Information, the GDPR, or other applicable laws may be submitted using the contact below. We respond under applicable law after verifying the requester and the relevant store.

Shopify’s mandatory GDPR compliance webhooks — customers/data_request, customers/redact, and shop/redact — are received and processed automatically. For customers/redact, we unlink the Shopify customer ID from stored document records and keep an audit record of that action. For customers/data_request, we compile the data we hold about the customer and notify the store owner at their registered contact email so they can provide it to the customer. For shop/redact, within up to 14 days of receipt, unless the App has been reinstalled by the time we carry out that deletion, we delete all data for the store, including documents, PDFs, point-in-time snapshots, and audit records otherwise subject to statutory retention.

6. Security

We use measures including Shopify webhook signature verification, access controls, hashed download tokens, and audit records to help prevent unauthorized access, disclosure, alteration, or loss.

7. Changes to this policy

We may update this policy when applicable law, Shopify requirements, or the App’s data practices change. The updated date will be shown on this page.

8. Contact

Email: info@jizaistyle.com