Privacy Policy — Lopora: Faturas Automáticas

Last updated: 5 November 2026

1. Who we are

The "Lopora: Faturas Automáticas" app (the "app") is provided by Rodrigo André da Silva Lopes, a sole trader operating as Lopora, based in Coimbra, Portugal ("Lopora", "we"). Contact: suporte@lopora.pt.

2. Roles

• The merchant who installs the app is the controller of their customers' data.
• Lopora acts as the merchant's processor (GDPR art. 28): it processes data only to send the merchant's invoicing software the data for the documents the merchant configured, on the merchant's instructions. Terms are in the Data Processing Agreement annexed to the Terms of Service.
• The merchant's certified invoicing software (Vendus, InvoiceXpress, TOConline or Moloni, as chosen by the merchant) is engaged directly by the merchant, with the merchant's own API key. It is not Lopora's sub-processor; that relationship is governed by that provider's own terms and privacy policy.
• Lopora is controller only for the merchant's own contact details and the subscription billing data Shopify makes available to us.

3. Data we process

From the Shopify store, for each paid order or refund: order and refund identifiers, line items, quantities, prices, taxes, shipping and discounts; customer name, email, billing address and tax ID (NIF) when given at checkout; buyer company details (B2B) when present.

From the merchant: shop domain, app settings, the invoicing software API key (stored encrypted with AES-256-GCM), the subscribed plan and an access log.

We do not use the data for advertising, profiling or model training, and we do not sell it.

4. Purposes

Only to request the matching invoice-receipt, simplified invoice or credit note from the merchant's invoicing software; prevent duplicate documents; show the merchant each document's status and let them retry failures; keep backups; and handle access and erasure requests. Legal basis: performance of the contract with the merchant and the merchant's tax obligations (GDPR art. 6(1)(b) and (c)), as determined by the merchant.

5. Where data is stored and recipients

• Fly.io, Inc. — sub-processor (hosting): app server and database in Frankfurt, Germany (region fra). US company.
• Tigris Data, Inc. — sub-processor (backups): database backups, encrypted before they leave the server (Tigris does not hold the key); object storage provided through Fly.io. US company. Because backups are encrypted on the app server before upload, Tigris cannot read their content.
• Shopify — the source platform the app talks to.
• The merchant's invoicing software (Vendus, InvoiceXpress, TOConline or Moloni) — only the one the merchant chooses and connects; engaged by the merchant.
• Email (SMTP) provider — delivers the app's alerts to the merchant; receives only the merchant's email and the alert text.

No other disclosures unless required by law.

6. International transfers

Production data stays in the EU (Frankfurt). Because Fly.io and Tigris are US companies, data may be accessed from the US (e.g. technical support or authority requests). Such transfers rely on the European Commission adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) for certified companies and/or the Standard Contractual Clauses (Implementing Decision (EU) 2021/914) in those providers' data processing agreements (GDPR arts. 45 and 46).

7. Retention

• Customer data in document records and the work queue: redacted after 90 days (name, tax ID, address and email removed; type, dates, IDs, lines and totals kept for credit notes); also erased when Shopify sends customers/redact.
• Record of the issued document (number, date, total, invoicing software reference): kept while the app is installed, to prevent duplicates. The tax document itself lives in the merchant's invoicing software under the merchant's statutory retention periods.
• Completed tasks and webhook IDs: deleted after 30 days. Access log: deleted after 1 year. Access-request exports: kept until delivered, at most 90 days.
• Encrypted backups: daily backups kept 30 days, and the backup of the 1st of each month kept 12 months, then deleted. Hosting disk snapshots last up to 5 days. Data deleted in the app disappears from backups when they expire; backups are used only to restore the service, and a restore re-applies erasures already requested.
• Uninstall: sessions and the API key are deleted immediately; about 48 hours later Shopify sends shop/redact and we delete all store data (subject to the backup periods above).

8. Data subject rights

Data subjects have the rights of access, rectification, erasure, restriction, portability and objection (GDPR arts. 15–21). As the merchant is the controller, end customers should contact the merchant. The app helps the merchant respond automatically to the requests Shopify forwards: customers/data_request (JSON export available to the merchant in the app), customers/redact and shop/redact. If a data subject contacts us directly, we forward the request to the merchant. Tax documents already issued cannot be erased while they must legally be kept (GDPR art. 17(3)(b)); this is handled in the merchant's invoicing software.

Merchants, and anyone regarding data Lopora controls, can exercise their rights at suporte@lopora.pt. Anyone may complain to the Portuguese supervisory authority (CNPD, www.cnpd.pt).

9. Security

HTTPS only; HMAC verification of every webhook; API key encrypted at rest (AES-256-GCM); backups encrypted with a public key before upload; data accessible only from the store's own Shopify admin; access log; incident response plan with notice to the merchant without undue delay.

10. Changes

We may update this policy. The date at the top shows the current version; material changes, including any new sub-processor, will be communicated to merchants.