Privacy Policy for Fatturino
ezApps Software Inc.
Effective Date: November 1, 2026
ezApps Software Inc. ("ezApps," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you use Fatturino (the "Service"), our Shopify app that turns your store's orders into Italian electronic invoices (FatturaPA) and transmits them to the Sistema di Interscambio ("SDI") operated by the Agenzia delle Entrate.
This Policy applies to the B2B use of the Service by merchants and should be read together with our Terms of Service. It is specific to Fatturino; our other products are covered by their own policies.
1. Scope of This Policy
Fatturino is a compliance service for merchants who sell in Italy. When you install the app, it reads order data from Shopify, builds the electronic invoice the law requires, sends it to SDI through an accredited transmission provider, records the outcome, and places the accepted document in ten-year legal storage (conservazione a norma).
Important:
Unlike a pure sync tool, Fatturino must keep a copy of every invoice it transmits. An electronic invoice is a fiscal document that Italian law (DPR 633/1972 and the rules on conservazione digitale) requires the merchant to retain for ten years. The invoice contains the buyer's fiscal identifiers and, for standard invoices, their name and address.
We hold these records on your behalf and only for as long as your legal obligation lasts or until you instruct us otherwise, as described in Sections 6 and 9.
2. Information We Collect
Merchant & Account Data
- Your Shopify store domain (e.g.
your-store.myshopify.com) and store identifier - Shopify session records for staff who open the app, which may include a staff name, email address, and locale supplied by Shopify
- Your store's contact email address, used for onboarding and essential service notifications
- Shopify access credentials, stored on protected servers and refreshed automatically (see Section 5)
Company Profile (the invoice issuer)
- Your legal name or company name, Partita IVA, codice fiscale, tax regime (regime fiscale), REA registration where applicable, and registered office address
- The identifier assigned to your company by our transmission provider when you register with SDI through the app
- Your app settings: invoicing on or off, automatic sending, invoice numbering, email preferences, and language
Invoice Records (your customers' data)
For each order you invoice, we store the document and what is needed to prove its lifecycle:
- Shopify order identifier and order name (e.g. "#1001"), the amounts invoiced, and VAT breakdown
- The buyer's fiscal identifiers supplied for the invoice: codice fiscale, Partita IVA, SDI recipient code (codice destinatario), and PEC address
- For standard invoices (orders of EUR 400 or more, business buyers, and buyers abroad): the buyer's name or company name, billing address, and country
- The FatturaPA XML as transmitted, the provider's document identifier, every SDI notification received (accepted, rejected, delivered, delivery failed), and the legal-storage receipt
- Credit notes and re-issued invoices linked to the original document
- Where you enable the feature, the customer email address to which the invoice PDF was sent
Fiscal data entered by your customers through the checkout block, the Thank you page block, or the POS tile is saved by Shopify on the order as order attributes. Fatturino reads it from there when it builds the invoice.
Billing & Usage Data
- Your subscription plan, billing period, and trial status, read from Shopify
- A usage event for each document transmitted during a billing cycle, which we report to Shopify to calculate charges
Operational Records
- A log of notifications received from our transmission provider, keyed by store, used to keep invoice statuses correct and to diagnose problems
- Error messages returned by Shopify, SDI, or the transmission provider for a given document
We Do Not Store:
- Payment card numbers or any payment instrument details
- Customer passwords or Shopify customer account credentials
- Order contents for orders you do not invoice; these are read from Shopify only while the app displays them
- Customer data for shops that have not enabled invoicing
3. How We Use Information
We use the information described above strictly to:
- Provide the Service: build FatturaPA documents from your orders, transmit them to SDI, and record the outcome
- Meet your legal obligations: keep the transmitted documents and their receipts in legal storage for ten years
- Issue corrections: credit notes and re-issued invoices linked to the original
- Send the invoice PDF to your customer when you enable that feature
- Surface problems to you: orders missing fiscal data, rejected documents, and delivery failures
- Measure usage for billing through Shopify
- Monitor reliability, detect abuse, and improve the product
- Send onboarding and essential account emails
We never sell, trade, rent, or monetize your data or your customers' data, and we do not use it to train machine-learning models.
4. Roles & Legal Basis for Processing
With respect to your customers' data, you are the data controller and ezApps acts as a data processor, processing data only on your documented instructions, which you give by installing, configuring, and using the Service. Our transmission and storage provider acts as a sub-processor under our instructions.
We process this data under the following legal bases:
- Performance of a contract (providing the Service to you)
- Compliance with a legal obligation (the issuance, transmission, and retention of electronic invoices under Italian law)
- Legitimate business interests (billing, security, and system integrity)
Fatturino is a commercial B2B system and is not intended for consumer personal use.
5. Data Security
We implement commercially reasonable security measures including:
- Encrypted connections (HTTPS / TLS) for all traffic, including to Shopify and to our transmission provider
- Short-lived Shopify access tokens that are refreshed automatically and deleted on uninstall
- Cryptographic verification of every inbound webhook: HMAC for Shopify, Ed25519 signatures for our transmission provider
- Checkout and Thank you page requests authenticated with Shopify session tokens
- Role-restricted internal access and infrastructure-level firewall protections
However, no system can be guaranteed 100% secure, and you acknowledge and accept this risk.
6. Data Storage & Retention
- Application data is stored on protected servers operated by our hosting provider in the European Union (Frankfurt, Germany).
- Transmitted invoices, their XML, notifications, and legal-storage receipts are retained for ten years from issue, which is the retention period Italian law imposes on you, the merchant.
- Invoice rows that never reached SDI (for example, orders parked because fiscal data was missing) carry no retention obligation and are deleted on request or on uninstall.
- Billing and usage records are retained as required for billing verification and dispute resolution.
- When you uninstall the app, your Shopify session is deleted immediately, automatic sending is switched off, and the app stops receiving data from your store.
- Approximately 48 hours after uninstall, Shopify sends a shop redaction request and we erase the remaining data associated with your store from our application database, including the invoice records. Before uninstalling, download your documents and legal-storage receipts from the app, or ask us for an export, so that you can continue to meet your own retention obligation.
Documents already lodged with SDI and placed in legal storage with our provider are governed by that provider's retention terms and by Italian law; deleting our records does not withdraw an invoice from SDI.
7. Third-Party Platforms & Sub-Processors
The Service operates by connecting to:
- Shopify: source of your order, customer, and fiscal-data attributes, and the platform through which you are billed
- Sistema di Interscambio (Agenzia delle Entrate): the Italian government system that receives, validates, and delivers every electronic invoice
We rely on the following sub-processors to operate the Service:
- A-Cube S.r.l. (Italy): accredited intermediary that signs and transmits invoices to SDI, relays SDI notifications, and provides legal storage (conservazione a norma) of the documents
- Fly.io: application hosting and database storage (Frankfurt, Germany)
- Resend: delivery of onboarding emails to you and, when you enable it, invoice emails to your customers
We do not share your data with advertisers or data brokers.
8. Permissions We Request
Shopify requires apps to request explicit permission for the data they access. Fatturino requests access to orders, including orders older than 60 days, because invoices, credit notes, and re-issues can be required long after the sale and legally preserved documents stay linked to their order for ten years; to customers, so the POS tile can retrieve the buyer's address for invoices of EUR 400 or more; and write access to orders, so fiscal data entered on the Thank you page can be saved onto the order. We request no permission we do not use.
9. Your Customers' Rights
We support Shopify's mandatory privacy webhooks. If one of your customers exercises a data right through your store:
- Data request: the personal data we hold about the customer is contained in the invoices issued for their orders. You can export those documents from the app to answer the request; contact us if you need assistance.
- Redaction request: invoice records that were never transmitted to SDI are deleted. Transmitted invoices are fiscal documents you are legally required to retain, and are not deleted; this is the exemption for legal obligations provided by the GDPR (Article 17(3)(b)).
- Shop redaction: all data for your store is erased from our application database, as described in Section 6.
10. Your Rights
As a Fatturino customer, you have the right to:
- Request access to the data we hold about your account
- Request correction of your company profile and account records
- Download your invoices, XML files, and legal-storage receipts from the app at any time
- Request deletion of your account and its data upon termination, subject to the retention obligations above
Requests may be submitted to: support@ezapps.io
11. Children's Privacy
Fatturino is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.
12. International Data Transfers
Invoice data is processed and stored in the European Union (Germany and Italy). Account and billing records may also be processed in Canada, where ezApps is established, and in other jurisdictions where our infrastructure providers operate. Where data is transferred out of the EEA, we rely on appropriate safeguards, including adequacy decisions and Standard Contractual Clauses.
13. Data Breach Procedures
In the event of a confirmed security breach affecting your data:
- We will investigate immediately
- We will notify affected merchants without unreasonable delay, and supervisory authorities where required by law, so that you can meet your own obligations as controller
- We will take immediate steps to mitigate further exposure
Fatturino does not store payment details or customer credentials, so exposure is limited to the invoice records, company profile, and operational data described in Section 2.
14. Policy Updates
We may update this Privacy Policy from time to time.
- Material changes will be communicated via email or on our website
- Continued use of the Service after the effective date constitutes acceptance
15. Contact Information
For all privacy-related questions or requests:
ezApps Software Inc.
support@ezapps.io