Preview: Kurswacht Invoice is coming soon to the Shopify App Store; prices are provisional. Get notified at launch
Install for freeInstall

App privacy policy

Last updated: 14 October 2026

1. Who we are

Provider of the Shopify app “Kurswacht Invoice” (the “App”): Robin Schmitt, Schmitt IT (sole proprietorship), Deutschhausplatz 1a, 55116 Mainz, Germany Email: hello@kurswacht.com No data protection officer has been appointed.

This policy covers the App only. Our website and other services have their own privacy information.

2. Our role

  • Customer data of your shop (your buyers): we process it as a processor on your behalf (Art. 28 GDPR). You, the merchant, are the controller. Our Data Processing Agreement applies.
  • Your merchant data (shop domain, settings, plan): we process it as controller to provide the App to you.

3. Data we process

Merchant data

  • Shop domain and the Shopify access token the App needs to call Shopify.
  • App settings: seller name, address, country, VAT ID, tax number, support email, payment terms, number ranges, automation and template settings, an optional logo. Depending on the features you use, also: bank details (bank, IBAN, BIC), contact person and phone for XRechnung invoices, DATEV consultant and client number and the login of your email mailbox (server, user name, sender, optionally a copy address; the password encrypted).
  • Plan and usage data (number of issued documents per billing period).
  • The App does not store names or email addresses of your staff from Shopify sessions.

Customer data from your orders (only to issue documents)

  • Billing and, if different, shipping name, company and postal address, including country.
  • The buyer’s VAT ID, if it is entered in the order or address. If the VIES check is switched on, the App stores the confirmation (date and request identifier from the EU) with the document.
  • Order data: order number, dates, line items (title, variant, SKU, quantity, prices), taxes, discounts, shipping and fees.
  • Payment data: payment status, payment method name and a payment or transaction reference. No card data.
  • Refunds, cancellations and order changes that require a credit note.
  • Order tags, note, sales channel and order attributes are read to apply your automation filters and to find a VAT ID or a Leitweg-ID. Of these, the App stores the detected VAT ID with the name of the field it came from, the Leitweg-ID if XRechnung is switched on, the document language with “language of the order” and, in the automation history, the filter values you configured that an order matched (for example a tag, payment method, country or sales channel you entered). The order note and other attributes are not stored.
  • Email address: only if you switch on email sending, the App reads the order’s email address from Shopify when it sends a document and hands it to your mailbox together with the document. The address is not stored; for each document the App only stores the sending status, the number and time of attempts and a history entry without the address.
  • Not processed: the App does not request customers’ phone numbers from Shopify.

Generated documents: invoice and credit-note PDFs, e-invoice XML, validation reports and document metadata (number, date, amounts, buyer country, payment reference).

Download links: customer download links are signed; the App stores only a hash of each link. The App does not write request logs with IP addresses. Our hosting provider Railway logs every request to the App with time, path, status and IP address and deletes these logs after 90 days. The path of a download link can contain its signed token.

Privacy requests: for Shopify privacy webhooks the App stores the request type, counts and a hashed (not readable) customer and request identifier.

Purpose Legal basis
Creating, storing and providing invoices and credit notes; customer downloads; exports; automation; the features you switch on: VIES check, email sending and Flow trigger On your instruction under the DPA. Your own basis is typically Art. 6(1)(b) and (c) GDPR (contract, invoicing and retention duties).
Providing the App to you, support, billing through Shopify Art. 6(1)(b) GDPR
Security, abuse prevention, troubleshooting Art. 6(1)(f) GDPR
Handling Shopify privacy requests Art. 6(1)(c) GDPR

For usage billing the App reports each issued document to Shopify with an internal document identifier only; no customer data is included.

5. Where data is stored

Data is stored in the European Union: the App and its database run at Railway in the europe-west4 region (Netherlands), and document files are kept in Cloudflare R2 with an EU data location. Both providers are based in the United States. For any access from there, both are certified under the EU-US Data Privacy Framework; the European Commission’s Standard Contractual Clauses from their data processing agreements apply in addition.

6. Recipients and sub-processors

  • Railway Corporation (548 Market St PMB 68956, San Francisco, CA 94104, USA) runs the App, its database and the database’s daily backups in the europe-west4 region (Netherlands). Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses.
  • Cloudflare, Inc. (San Francisco, USA) stores the generated document files in Cloudflare R2 with an EU data location. The app encrypts every file before upload. Safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses.

Support: Cloudflare forwards email sent to hello@kurswacht.com to a mailbox at Google (Gmail), where we answer it. Please do not send us customer data by email; the document number is enough for questions about a document.

Shopify receives data as your platform under your own contract with Shopify. If the Flow trigger is switched on, the App reports every finished document with the order reference, document number, type, download link, date, amount and currency to Shopify Flow.

Only for features you switch on:

  • European Commission (VIES): for the check before a reverse-charge invoice the App sends the buyer’s VAT ID and your VAT ID to the EU VIES service.
  • Your email provider (SMTP): for email sending the App hands the customer’s email address and the document (PDF, for XRechnung also XML) to the mailbox you enter. Where available, the message also contains the document’s signed download link. If you enter a copy address (BCC), the same message with link and attachments goes there as well. You choose the provider and the copy address; they are not our sub-processors.

The App contains no analytics, advertising or tracking tools. It sends emails only through your own mailbox.

7. Retention and deletion

  • While the App is installed: documents and their data are kept so that downloads and exports keep working.
  • After uninstalling: Shopify sessions are deleted immediately. Shopify sends a shop/redact request 48 hours after uninstalling; the App then deletes all data of the shop, including all documents, exports, settings, number ranges and event history.
  • Your retention duty: you must keep invoices for the statutory period (in Germany several years). Export your archive (month or year export) before uninstalling. We do not keep copies after deletion; the daily database backups expire within 6 days, the hosting provider’s request logs (section 3) after 90 days.
  • Customer erasure request (customers/redact): the App revokes the customer’s download links. Documents you must retain by law stay stored until the shop is deleted. The request is shown to you in the App.
  • Customer access request (customers/data_request): the request is shown to you in the App so you can answer it, for example with an export.
  • Backups: our hosting provider backs up the database daily and deletes each backup after 6 days. Document files are not backed up separately.

8. Security

  • From outside, the App is reachable only over HTTPS (TLS). It reaches its database over a private, encrypted network of the hosting provider.
  • Stored documents, export files and invoice snapshots are encrypted by the App with AES-256-GCM before they are written to storage.
  • Download links are signed, cannot be derived from order or invoice numbers, are stored only as hashes and can be revoked. Admin print links expire after 30 minutes.
  • All data is assigned to one shop. Merchants reach it only through Shopify-authenticated sessions of that shop; customers reach only their own documents through signed links. Shopify webhooks are verified.
  • The App does not write addresses or document content to its logs, and it removes the values of known link parameters such as tokens and signatures before it logs an error.

9. Your rights

Your shop’s customers should contact you, the merchant, as controller. We support you with their requests.

For your own personal data you have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

10. Changes

We update this policy when the App or the law changes. The current version is available at https://kurswacht.com/en/privacy/app/.

11. Contact

Robin Schmitt, Schmitt IT, Deutschhausplatz 1a, 55116 Mainz, Germany Email: hello@kurswacht.com