Terms of Service — Lopora: Faturas Automáticas
Last updated: 5 November 2026
1. Provider
"Lopora: Faturas Automáticas" is provided by Rodrigo André da Silva Lopes, sole trader (Lopora), Coimbra, Portugal. Contact: suporte@lopora.pt.
2. What the app does
It sends the merchant's paid orders and refunds to the merchant's Vendus account so that Vendus issues invoice-receipts, simplified invoices and credit notes. Tax documents are issued by Vendus, the certified invoicing software. The app itself is not certified invoicing software, does not certify documents and does not report anything to the Portuguese Tax Authority: numbering, ATCUD, QR code, signature and reporting are done by Vendus.
3. Merchant responsibilities
Keep an active Vendus account and a valid API key (real documents need a paid Vendus plan, billed separately by Vendus); confirm the settings with an accountant and review issued documents; meet their own tax and data protection obligations as controller; start in test mode and switch to live only after checking the results.
4. Plans and billing
Plans and prices are those shown on the Shopify App Store listing and are billed by Shopify on the store's invoice. Merchants can change or cancel at any time in the Shopify admin. When the monthly document limit is reached, new documents wait and are issued once quota is available.
5. Availability
The app is provided "as is". We make reasonable efforts to keep it running, but Shopify, Vendus, hosting or the app may fail. Failed orders wait in "Needs attention" to be retried.
6. Limitation of liability
To the extent permitted by law, Lopora is not liable for indirect damages, lost profits, fines or tax charges caused by incorrect settings, incorrect order data or third-party failures. Total liability is limited to the fees paid for the app in the previous 12 months. Nothing here excludes liability that cannot be excluded by law.
7. Personal data
Governed by the Privacy Policy (/privacidade). Lopora acts as the merchant's processor under Annex A — Data Processing Agreement, which is part of these Terms and accepted on install.
8. Termination
Merchants may uninstall at any time. Data is deleted as described in the Privacy Policy. Documents already issued remain in Vendus.
9. Governing law
Portuguese law; courts of Coimbra, subject to mandatory rules.
Annex A — Data Processing Agreement (GDPR art. 28)
A.1 Parties. The merchant installing the app is the controller; Lopora (Rodrigo André da Silva Lopes, Coimbra) is the processor, for store customers' personal data processed by the app.
A.2 Subject matter and purpose. Receive paid orders and refunds from Shopify, send them to the merchant's certified invoicing software to issue invoices and credit notes, keep each document's status, prevent duplicates, keep backups and handle data subject requests.
A.3 Categories. Data subjects: the merchant's end customers and buyer-company contacts. Data: name, email, billing address, tax ID, order data. No special categories (GDPR art. 9).
A.4 Duration. While the app is installed, plus the retention periods in the Privacy Policy (customer data redacted after 90 days; backups up to 12 months).
A.5 Instructions. Lopora processes data only on the merchant's documented instructions: these Terms, the app settings and support requests. Lopora informs the merchant if an instruction appears to infringe the GDPR. Transfers outside the EEA only under A.8.
A.6 Confidentiality. Only Lopora's owner accesses the data; anyone authorised in future is bound by confidentiality.
A.7 Security (art. 32). HTTPS; webhook HMAC verification; API key encrypted with AES-256-GCM; backups encrypted (age/X25519) before upload; EU hosting; access only through the store's Shopify admin; access log; minimisation and automatic redaction at 90 days; incident response plan.
A.8 Sub-processors. The merchant gives general authorisation for: Fly.io, Inc. (US) — app and database hosting in Frankfurt, Germany; Tigris Data, Inc. (US) — storage of encrypted backups, through Fly.io, encrypted before upload. Lopora binds them to equivalent obligations (through those providers' DPAs) and remains liable for them. Access from the US relies on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) where the provider is certified, and/or the Standard Contractual Clauses (Implementing Decision (EU) 2021/914). Lopora gives at least 30 days' notice of any new sub-processor; the merchant may object by uninstalling before the change takes effect.
A.9 Not Lopora's sub-processors. Shopify is the merchant's platform and the data source, under its own contract with the merchant. The merchant's invoicing software (Vendus, InvoiceXpress, TOConline or Moloni) is chosen and contracted directly by the merchant, using the merchant's own API key; Lopora has no contract with it for this processing and only sends data on the merchant's instruction. It is therefore the merchant's processor (or, for the legal duties of certified software, an independent controller), not Lopora's sub-processor; the merchant should have the art. 28 agreement with it.
A.10 Assistance. Lopora helps the merchant with data subject requests (GDPR webhooks and email) and, as far as its information allows, with arts. 32–36.
A.11 Breaches. Lopora notifies the merchant without undue delay, aiming for 24 hours after becoming aware, with the art. 33(3) information available, so the merchant can notify the authority within 72 hours where required.
A.12 End of processing. On uninstall, the API key and sessions are deleted immediately and,
on shop/redact (about 48 hours later), all store data; backups expire per A.4. Tax documents
remain in the merchant's invoicing software.
A.13 Audits. Lopora provides, on request to suporte@lopora.pt, the information needed to demonstrate compliance and allows reasonable audits with 30 days' notice, at the merchant's cost, at most once a year unless there is a breach.
A.14 Precedence. On personal data matters, this annex prevails over the rest of the Terms.