Last updated: 7 August 2026
We provide our app, InvoZip: Bulk Invoice Download, to merchants who use Shopify to power their stores. The app generates PDF invoices for your recent orders and packages them into a single ZIP file you can download. This Privacy Policy describes how personal information is collected, used, and shared when you install or use the app in connection with your Shopify-supported store.
Information we access. When you install the app, it requests a single read-only Shopify access scope, read_orders. The app cannot create, change, or delete anything in your store. To draw an invoice it reads the order number and date, payment and fulfilment status, line items (product title, variant, SKU, quantity, price, discounts), subtotals, shipping, taxes, refunds, and totals. Because an invoice must say who it is for, the app also accesses two categories of Shopify protected customer data: the name and the billing or shipping address on the order. We also store your myshopify.com domain, shop ID, timezone, currency, and the access token that lets the app call Shopify on your behalf, along with the business details you enter yourself, such as your business name, address, tax identifier, logo, and invoice footer.
What we do not collect. The app does not request or receive customer email addresses or phone numbers. It has no access to your Customers list and never sees payment or card details, which are handled entirely by Shopify. It places no scripts or cookies on your storefront and does not track your store visitors. Order and customer details pass through memory only while an invoice is being drawn and are never written to our database.
How we use the information. We use it to generate the invoices you request, to show how many orders fall inside a date range before you start, to count how many invoices you have generated in the current month so your plan allowance can be applied, to keep your session working inside the Shopify admin, and to respond to you when you contact us for support. Your information is never used for advertising or profiling, and it is never sold. We may share information only to comply with legal obligations or to protect our rights.
Your export files. A completed export is a single ZIP containing one PDF per order. It is encrypted with AES-256-GCM before it reaches storage, held in a private bucket with no public access, and served only to an authenticated session belonging to the store that created it. Every export is deleted automatically 24 hours after it is ready, so please save the ZIP once you have downloaded it.
How long we keep information. Export files are deleted after 24 hours. Order and customer details are never stored at all. Your invoice settings, export history, and monthly usage counts are kept until you uninstall the app, at which point they are deleted along with your access token and any stored files. Records used to avoid processing the same Shopify webhook twice are kept for 7 days.
Service providers. We use Shopify as the platform the app runs on and the source of order data, MongoDB Atlas as our database, Cloudflare R2 for private storage of encrypted export files, and DigitalOcean for application hosting. These providers process data only to provide their service to us. Your information may be stored and processed outside your country, including in the United States and the European Union.
Your rights. If you are a resident of the European Union or another region with data protection laws, you can request access, correction, export, or deletion of your personal information, and you may complain to your local data protection authority. To exercise these rights, contact us using the details below. The app also supports Shopify's mandatory privacy webhooks: when Shopify sends a customer data request, a customer redaction request, or a shop redaction request on your behalf, the app responds automatically. Because the app keeps no customer records, a customer data request returns nothing to disclose, and a redaction request removes any temporary export files associated with your store.
Security. All traffic to and from the app uses HTTPS. Export files are encrypted at rest, with the file, its encryption metadata, and the encryption key held separately. Access tokens are stored server-side and never exposed to the browser. The app requests the minimum Shopify access it needs and no write access at all.
Children. The app is a business tool for merchants and is not directed at anyone under 16. We do not knowingly collect personal information from children.
Changes. We may update this Privacy Policy periodically to reflect changes in our practices or for operational, legal, or regulatory reasons. The date above shows when it was last revised.
Contact us. For questions or more information about our privacy practices, please contact SAGE Apps at hassansageapps@gmail.com.