Ossly — privacy and data

Ossly prepares EU One Stop Shop (OSS) VAT reports from a shop’s orders. Draft text; to be reviewed before App Store submission.

What we store

For each order and refund: order number and date, amounts, VAT rates and VAT amounts, currency.
The customer’s country (needed to report VAT to the right EU country).
A customer VAT number, if one was given (encrypted, AES-256-GCM).
Optionally, if the merchant turns it on: the customer’s name (encrypted).
The Shopify customer ID, so deletion requests can be honoured.

We do not store customer email addresses, phone numbers or street addresses.

App server and database are hosted in the EU (Frankfurt, Germany). Customer VAT numbers and names are encrypted by the app before they are stored.

When a customer asks to be forgotten (Shopify customers/redact), we delete their name and Shopify customer ID. If the merchant keeps VAT records for 10 years (default), the VAT number stays with the VAT record as tax law requires; otherwise it is deleted too.
When the app is uninstalled, Shopify asks us 48 hours later to delete the shop’s data (shop/redact); we delete everything.
Customer data requests (customers/data_request) are logged and answered with what we hold.

Contact the merchant you bought from, or the app developer through the Shopify App Store listing.