Privacy policy

Verifactu by Abakira turns a Spanish merchant’s paid Shopify orders and refunds into Verifactu billing records (simplified and corrective invoices), chains them as required by Spanish Royal Decree 1007/2023 and Order HAC/1177/2024, and gives each buyer a receipt with its tax QR code.

What we access, and why

Orders (read) — to build the invoice of a paid order and the corrective invoice of a refund: line titles, quantities, prices, discounts, taxes, shipping, totals and currency.
Orders (write) — only to save three fields on the order: the invoice number, the tax QR link and the receipt link. We never change anything else on an order.

What we store

Merchant: the shop owner contact email and the language of the Shopify admin (for essential service communication and to show the app in the right language; this is not a marketing opt-in), and the business tax ID (NIF) and legal name the merchant enters, which appear on every invoice by law.

Invoices: for each paid order or refund, the billing record required by Spanish law (invoice number, date, amounts and VAT breakdown, the chained fingerprint), the order number, and the receipt lines (product title, quantity, amount, VAT rate). We do not store buyer names, emails, phone numbers, addresses or payment details: a simplified invoice does not identify the buyer.

Records the app could not invoice: the order number and the reason, so the merchant can invoice it another way.

Who else sees this data

Agencia Estatal de Administración Tributaria (AEAT), the Spanish tax agency, receives each billing record once real submission is enabled. In the current version nothing is sent to the AEAT: records are checked by a simulation inside the app.
Vercel runs the app and Neon stores its database.
Crisp (Crisp IM SAS, Nantes, France) provides the support chat inside the merchant admin only, never on a storefront. Crisp sees only what a merchant chooses to write to us.
Anyone holding a receipt link can open that receipt. Links are long random tokens, not guessable, and a receipt shows no buyer data.

What we never do

We do not sell or share merchant or buyer data.
We do not use any data for advertising or profiling.

How long we keep it, and deletion

Billing records cannot be edited or deleted while the app is installed: Spanish law requires them to stay unaltered, and our database enforces it. When a merchant uninstalls the app, we clear the contact email and admin language at once. Shopify then sends a shop redaction request 48 hours later, and we delete everything we hold for that shop, billing records included. Merchants must download their records (XML export in the app) before uninstalling if they need a copy.

How it is protected

Data is encrypted in transit (HTTPS/TLS everywhere, including between the app and its database) and at rest by our database provider.

Our agreement with merchants

We act as a data processor on behalf of the merchant, who remains the controller of their store’s data. We process only the data listed above, only for the purposes listed above. If that changes, this page changes first.

Contact

support@abakira.com · Abakira LLC, abakira.com