Privacy Policy

Who we are

This app is operated by SL Studio (Orange County, California, USA). Contact: support@sl-studio.dev.

What we store

We keep the minimum needed to run the app:

• Shop domain and the Shopify access token issued when you install the app (so the app can read your orders when you ask for a document).
• The settings you enter: default language, document number prefix, logo URL, seller block, tax ID, footer text, customs defaults, automatic-email preference.
• A monthly document counter per shop (used for the Free plan limit) and your plan status (Free or Pro).
• An access log of document generation (time, document type, order IDs, channel), kept for security for 90 days.
• If you join the email list on this site: your email address.

What we do not store

Order, customer and product data are read from Shopify only at the moment a document is generated and are used solely to render that document. We do not copy orders or customers into our own database.

Generated PDFs are streamed to you and are not saved on our servers.

Automatic email (optional)

If you turn on automatic email in Settings, when an order is created we render the chosen document and send it to the customer's order email using our email provider (Resend). The customer email address and the PDF pass through that provider for delivery and are not retained by us. Turn the switch off in Settings at any time.

Where data lives

Hosting: Vercel (US). Key-value storage: Upstash Redis (US); the app encrypts stored shop data (AES-256-GCM) before it is written, and all connections use TLS. Email delivery: Resend. Payments: Shopify Billing — we never see card details.

This public website counts page views with Vercel Web Analytics, which sets no cookies. It is not loaded inside the app in Shopify admin.

Retention and deletion

When you uninstall the app we delete the session and access token immediately and the remaining shop data (settings, counters, plan) within 48 hours when Shopify sends the shop/redact webhook.

Customer data requests and customer redaction webhooks from Shopify are honored; since we store no customer records there is nothing further to return or erase.

Email-list addresses are deleted on request (email support@sl-studio.dev) or when the list is retired.

Protected customer data

We request Shopify's protected customer data access only for the fields needed on invoices and packing slips (name, address, email, phone) and use them only for generating the document you request.

Security and terms

How we protect data and respond to incidents: https://invoice.sl-studio.dev/security. Terms of Service and data processing terms: https://invoice.sl-studio.dev/terms.

Changes

We will update this page when the policy changes and show the date at the top.