Privacy Policy

This Privacy Policy describes how Billsora (“we”, “us”) collects, uses, and protects information across both parts of the Billsora product: the Billsora Shopify app (“the Shopify App”), which a merchant installs and uses on their Shopify store, and the Billsora Mobile App, which lets a store’s registered owner log in and view that store’s orders, receipts, and invoices on their phone. By installing or using either, you agree to the practices described below.

1. Who We Are

Billsora is a Shopify application that helps merchants generate, customize, and manage invoices for their store’s orders. The Shopify App is embedded within the Shopify Admin and operates using data made available through the Shopify APIs. The Billsora Mobile App is a companion Android/iOS app that lets the store owner view that same order and invoice data on their phone.

2. Information We Collect

When you install and use Billsora, we may access and process the following information:

• Store information: your store domain, store name, email, currency, timezone, and basic configuration.
• Order information: order numbers, line items, totals, taxes, discounts, shipping, and fulfillment status.
• Customer information (Protected Customer Data): customer name, email address, phone number, and billing/shipping addresses, as contained in your orders.
• App data: invoice templates, branding, and generated invoices you create within the App.

We only access this data to provide the App’s core functionality.

When a store owner uses the Billsora Mobile App, we additionally collect:

• Owner login information: the store domain and owner email address entered at login, used solely to verify that the person logging in is the store’s registered owner, and a one-time login code sent to that email. The Mobile App does not use passwords. This code is stored temporarily on our servers in a hashed (non-reversible) form and automatically expires after 5 minutes, after which it can no longer be used.
• Push notification token: if the owner allows notifications, a device push token (provided by Expo, our push notification service) so we can alert them when an order is created or its status changes. This token identifies the device for notification delivery only, and is removed from our systems when the owner logs out of the Mobile App.

3. How We Use Information

• To generate, format, and manage invoices for your orders.
• To store and apply your invoice templates and branding settings.
• To authenticate your store and keep your session secure.
• To deliver invoices (for example, by email) when you request it.
• To verify that the person logging into the Mobile App is the store’s registered owner, and to send them a one-time login code.
• To send the store owner a push notification when an order is created or its status changes, if they’ve enabled notifications in the Mobile App.

We do not sell, rent, or share your data or your customers’ data for advertising or marketing purposes.

4. Data Storage and Security

Data is stored in a managed PostgreSQL database (hosted by Supabase) and the App is hosted on Vercel. All data is transmitted over encrypted connections (HTTPS/TLS) and stored on infrastructure that employs encryption at rest. Access to data is restricted to the App’s operation and protected by access keys.

5. Data Sharing and Third Parties

We share data only with the service providers necessary to operate the App:

• Shopify — the platform the App runs on and the source of store/order data.
• Supabase — database hosting.
• Vercel — application hosting.
• Expo — delivers push notifications to the Billsora Mobile App.

These providers process data solely to provide their services and are bound by their own privacy and security commitments.

6. Data Retention

We retain data only as long as the App is installed and necessary to provide its functionality. When you uninstall the App, your store’s data is deleted in accordance with Shopify’s mandatory data-deletion (shop/redact) webhook, typically within 48 hours of uninstall.

7. Your Rights (GDPR & Customer Privacy)

Billsora supports Shopify’s mandatory compliance webhooks for customer privacy:

• Customer data request — we respond to requests for the data we hold about a customer.
• Customer redaction — we delete a customer’s personal data on request.
• Shop redaction — we delete a store’s data after the App is uninstalled.

8. Cookies and Sessions

Billsora uses only the cookies and session tokens required to authenticate your store and keep you securely signed in while using the App. We do not use tracking or advertising cookies.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Continued use of the App after changes constitutes acceptance of the revised policy.

10. Contact Us

If you have any questions about this Privacy Policy or how your data is handled, contact us at:

Email: billsora.dev@gmail.com