AppVerix Net Terms Desk: Privacy Policy

Last updated: 15 October 2026

AppVerix Net Terms Desk (“the app”) is a Shopify app published by AppVerix (“we”, “us”). This policy explains what the app collects when a merchant installs it, why, where it is kept and how to have it deleted.

The app does not read or store the personal data of a store’s customers: no customer names, emails, phone numbers or addresses. It stores business data about orders on payment terms. For any customer data that stays in Shopify, the merchant is the controller and we are the processor.

1. What we collect and why

From the merchant’s store, through Shopify’s API:

  • Shop domain, store name, currency and time zone: to identify the store, show amounts and read due dates in the store’s time. Stored.
  • An access token from Shopify: so the app can stay installed and read orders and set up its checkout rule. Stored in the login session until you uninstall.
  • Invoices, one per order with payment terms: Shopify’s order id, the order name, PO number, terms name, due and issue dates, total and amount owing, the status, and the company and company location names. Stored.
  • Companies: Shopify’s company id and name, and what you enter: a credit limit, a hold setting, a private note and the date you marked a reminder as sent. Stored.
  • Shop settings: the admin and reminder language, hold rules, a message for the checkout, the weekly summary choice and which setup steps you ticked. Stored.
  • Billing state from Shopify (plan, trial or none). Stored as a cache; Shopify is the source of truth.
  • The store’s contact email, read from Shopify when you choose or cancel a plan and, on Pro with the summary switched on, each week, only to email you. Not stored.
  • Compliance log: the topic and a short summary Shopify sent on a privacy webhook. No names or emails.

2. What we do not collect

The app does not read or store customer names, emails, phone numbers, addresses, payment details or the products in an order. Its Shopify requests ask only for the business fields listed above.

Shopify sends an order webhook when an order is created or changed. Its content includes customer details. We verify its signature, take only the order id from it, and discard the rest: it is never stored or logged. We then read the business fields through the Admin API.

No cookies, analytics or advertising are used, and nothing from the app runs on your storefront. The app also adds a checkout rule that looks only at the company id and the cart total. A visitor’s IP address is not stored or logged.

3. Who processes data for us

Where data leaves the EEA/UK, we rely on the provider’s Standard Contractual Clauses or other approved transfer mechanisms.

  • Cloudflare (cloudflare.com): hosting for the app and its D1 database. Sees everything in section 1. Globally distributed.
  • Resend (resend.com): sends the welcome, cancellation and weekly summary emails to the store contact. Sees the address and the email text.
  • Shopify: the platform the app runs on, which also handles billing. See Shopify’s privacy policy.

4. How long we keep it

  • Invoices, companies and settings: while the app is installed. Paid and cancelled invoices are removed 13 months after they were last updated.
  • When you uninstall: we delete the login session right away. Shopify sends a shop/redact request about 48 hours later and we then delete the store’s invoices, companies and settings. The compliance log (topic and short summary, no names or emails) is deleted after 90 days.
  • A customer deletion request (customers/redact): we hold no customer personal data to delete; we log that it arrived.
  • Server logs: up to 7 days, without personal data.

5. Your rights and data requests

The app supports Shopify’s three privacy webhooks: customers/data_request (we reply that we hold no personal data of that customer), customers/redact (nothing to delete; logged) and shop/redact (we delete all data of the store).

Merchants can also write to support@appverix.com for a copy of their data or to have it deleted, or export their ledger from the app at any time. We answer within 30 days. A store’s customers should contact the store first. If you are in the EEA/UK you may complain to your local data protection authority. In Brazil the LGPD applies; contact us at the same address.

6. Security

  • All traffic uses HTTPS (TLS).
  • The database runs on Cloudflare D1, which encrypts data at rest.
  • Webhooks from Shopify are verified by their HMAC signature; unsigned requests are rejected.
  • The app checks a Shopify session token on every admin request and uses no third-party cookies.
  • Access to production infrastructure is restricted and protected by two-factor authentication.
  • If a breach affects your data we tell you without undue delay, and within 72 hours where the law requires it.

7. Data processing agreement and security

For the personal data of a store’s customers, the merchant is the controller and we are the processor. The AppVerix Data Processing Addendum sets out our commitments (purposes, subprocessors, security, deletion, breach notification), and our security and incident response policy describes how we protect and handle data.

8. Changes and contact

If we change this policy in a way that matters, we update the date at the top and tell merchants in the app or by email. Contact: support@appverix.com