Privacy Policy
Updated 15 October 2026
This Privacy Policy explains how Vendkit (“we”, “us”) handles data when a Shopify merchant uses ShopPrint (the “App”), an app that lets a merchant design and print invoices, packing slips, credit notes and barcode or price labels.
1. Who we are and our role
The App is operated by Vendkit. When a merchant installs ShopPrint, the merchant is the data controller and Vendkit acts as a data processor: we process data only to provide the App's printing features to that merchant, on their instructions. Our processing terms are set out in the Data Processing Addendum in our Terms of Service.
2. Data we access in your store
ShopPrint asks Shopify only for the permissions it needs:
| Shopify data | Permission | Why we need it |
|---|---|---|
| Orders | read_orders | Read line items, quantities, prices, totals and order numbers so they can be printed on your documents. |
| Customers | read_customers | Read the customer's name, email, phone number and shipping and billing address, because an invoice or packing slip must show who the order is for and where it is going. |
| Products | read_products | Read product names, variants, prices, SKUs and barcodes to print price and barcode labels. |
| Inventory | read_inventory | Read stock levels so labels can be printed for the right quantities. |
3. How we handle customer personal data
Customer name, email, phone and address are read from Shopify only when a document is generated, used to draw that document, and are not saved to our database. We do not keep a copy of your customer list. This “read at print time, never retain” approach keeps customer personal data to the minimum needed to do the job.
Emailing an invoice. On a paid plan, a merchant can choose to email an invoice to the customer. Only when the merchant clicks Email, we send one email to the customer's email address as it is on that order (no other address can be entered), through our email provider, Resend. The email shows the order number, invoice number, date and total and a private link. We do not save the customer's email address. The private page behind the link reads the order from Shopify each time it is opened, so it holds no copy either.
Shopify Flow. A merchant can also add ShopPrint's “Email invoice to customer” action to their own Flow workflow, which does exactly what the Email button does, and only when that workflow runs. ShopPrint tells Flow when an invoice was emailed or a credit note was issued, sending Flow the order ID, the document number and, for an emailed invoice, its private link, so the merchant's own workflows can react. Nothing else is shared and nothing new is stored.
Sending invoices by themselves. On a paid plan, a merchant can choose to have ShopPrint email the invoice when an order is paid or shipped. Shopify then tells ShopPrint about that order, ShopPrint sends the same email described above to the address on the order, and nothing about the order or the customer is saved. Orders with no email address, and reserved test addresses such as example.com, are skipped.
Draft orders and payment terms. Only if a merchant allows it in Shopify's permission pop-up, ShopPrint reads draft orders and payment terms (for example “Net 30” and the due date) from Shopify when a document is generated, in the same way as orders, and does not save them.
AI support assistant. On the Pro and Scale plans, a merchant can ask an AI assistant questions about ShopPrint. What the merchant types is sent to our AI provider, Anthropic, which writes the answer. We do not store the conversations; we keep only a count of messages for each shop and month to apply fair limits. Merchants should not type customers' personal data into the chat.
4. Data we store
| What | Details | Kept for |
|---|---|---|
| Store settings | Your business name, address, phone, tax ID, logo link, template design, invoice prefix, the header note, payment terms, QR link and caption you type in Templates, your document language, paper size, country rules (including any tax IDs and notes you write there), plan and setup progress. | Until you uninstall. |
| Invoice and credit note numbers | An invoice number, and a credit note number with the day it was issued, each linked to an order ID, so numbers stay sequential and unique for your tax records. | Until you uninstall. |
| Invoice links | When an invoice is emailed: a random link code, your store, the order ID, when the link expires (90 days after the last email), when it was last emailed and how many times. No customer name, email address or order contents. | Until it expires, then it stops working; deleted when you uninstall or on a privacy request. |
| Print history | Which order was printed, as which document type (invoice, packing slip or credit note), and when: order ID and order number only. | 24 months, then deleted automatically. |
| Label counts | How many labels were printed on a given day, to track the Free plan allowance. No product or customer details. | Until you uninstall. |
| Help Center messages | If you send us a message from the Help Center: the topic you chose, your message, the email address you give us and your store's address, so we can reply. We pre-fill the email box with your store's contact email; you can change it. Please do not include passwords or card numbers. | Until you uninstall, then deleted with your store's data. |
| Session details | Your staff name and email, and the access token Shopify gives the App to act on your store. | Until you uninstall. |
5. Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Generating your invoices, packing slips, credit notes and labels | Performance of our contract with the merchant |
| Invoice numbering and print history | Performance of contract; the records hold no customer details |
| Keeping the App secure and fixing errors | Our legitimate interest in running a reliable service |
| Billing your plan through Shopify | Performance of contract |
6. Who we share data with
We never sell or rent data. We use these providers (sub-processors) to run the App:
| Provider | What they do | Location |
|---|---|---|
| Shopify | The platform the App runs on; source of order, customer and product data; billing. | Canada / global |
| Railway | Hosts the App's servers. | United States (East) |
| Supabase | Database, encrypted at rest. | Canada (Montréal) |
| Resend | Delivers the invoice emails a merchant chooses to send. Receives the customer's email address, the order number, invoice number, date, total and the private link for each email, only at that moment. | United States |
| Anthropic | Writes the answers of the AI support assistant (Pro and Scale plans). Receives the questions a merchant types into the chat, only at that moment. We do not store the conversations. | United States |
| Sentry | Error monitoring. Personal data is removed from error reports before they are sent. | United States |
7. International data transfers
Data may be processed in Canada and the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on the safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses and Canada's adequacy decision.
8. Retention and deletion
- Print history is deleted automatically after 24 months.
- Invoice and credit note numbers are kept while the App is installed, because sequential numbers must stay unique for your tax records.
- When you uninstall, we remove your session details straight away. Shopify then asks us, about 48 hours later, to delete your store's data, and we permanently delete everything we hold for your store. Copies in our daily backups are overwritten within 7 days.
- We respond to all of Shopify's mandatory privacy requests (customer data request, customer redact and shop redact). Because ShopPrint saves no customer names or contact details, a customer request has nothing to return beyond order numbers; on a customer redact request we delete the invoice and credit note numbers, print history and private invoice links for that customer's orders.
- An emailed invoice link works for 90 days after the last time it was emailed. When you uninstall, the links stop working at once.
9. Cookies
ShopPrint sets no advertising or tracking cookies, and shows no cookie banner because it needs none. It runs inside your Shopify admin and signs in with Shopify's session token. The only cookie involved is a short-lived security cookie that Shopify's sign-in flow uses while the App is being installed.
On the Labels page, ShopPrint remembers your label size, the fields you chose and your sheet alignment in your browser's local storage, on that computer only. This is never sent to us, and clearing your browser data removes it.
Print previews and PDF downloads are built in your browser. We do not store the documents, and your browser may keep a temporary copy while the page is open.
10. Your rights
Depending on where you live, laws such as the EU and UK GDPR, the CCPA/CPRA, Canada's PIPEDA, Brazil's LGPD and Australia's Privacy Act give you rights to access, correct, delete, restrict or port your personal data, and to object to processing. Shoppers should send requests to the store they bought from (the merchant, who is the controller). Merchants can exercise these rights by contacting us or by uninstalling the App. You may also complain to your local data-protection authority.
11. Security
All data is sent over HTTPS and stored in encrypted databases. Every request from Shopify is verified with its signature before we act on it, and data is only read or changed for the store that owns it. Because customer details are never written to our database, we do not keep them at all. Access to production systems is limited to the App's operator, and we keep daily database backups for 7 days, after which they are overwritten. To protect the App from abuse we briefly count requests per IP address, for about a minute, in the server's memory; this count is discarded and is not stored in our database. Our hosting provider may keep standard request logs for a short time.
12. Children
The App is a business tool and is not directed at children. We do not knowingly process children's data.
13. Changes to this policy
We may update this policy as the App changes. The “Updated” date at the top shows when it last changed; for significant changes we will notify merchants in the App.
14. Contact us
Vendkit — support@vendkitapps.com. We reply within one business day.