Français · English

Privacy Policy — Quittus

Last updated: 2026-07-25

1. Publisher

Quittus is a Shopify invoicing app published by [legal name], [company ID / legal form], [address]. Contact: support@quittus.com.

2. Our role

Quittus acts as a data processor (under the GDPR) for the merchant who installs the app. The merchant is the data controller. Quittus processes data only on the merchant's instructions, to provide the invoicing service.

3. Data we process

Only the data needed to produce an invoice or credit note from an order: the customer's name, email address, billing and shipping addresses, and order data (items, quantities, amounts, taxes, order number). No other personal data is collected.

4. Purpose and legal basis

Data is used solely to generate, display, download and export the merchant's invoices and credit notes. The legal basis is the merchant's legal obligation to issue invoices, carried out by Quittus on their behalf. No use for marketing, profiling or automated decision-making; no sale or sharing with third parties.

5. Hosting and sub-processors

Data is hosted by Railway (Google Cloud Platform infrastructure), our sole sub-processor. Any transfer outside the European Union is governed by the European Commission's Standard Contractual Clauses.

6. Security

Encryption in transit (HTTPS/TLS) and at rest (cloud infrastructure disk encryption); strict per-store isolation; access limited to what is strictly necessary; two-factor authentication.

7. Retention

Invoices and credit notes are kept for the legal accounting retention period (10 years under French commercial law, art. L123-22). On uninstall, all of a store's data is deleted within 48 hours (Shopify shop/redact webhook).

8. Your rights (GDPR)

End customers exercise their rights (access, rectification, erasure, objection, portability) with the merchant, who is the data controller. Quittus handles requests forwarded by Shopify. Contact: support@quittus.com. You may also lodge a complaint with your data protection authority.

9. Changes

This policy may be updated; the date at the top indicates the latest version.