Privacy Policy — Vatuno

Last updated: 30 August 2026

What we collect

Order data (order id, billing country, amounts, tax lines) via Shopify webhooks — required to compute VAT records and OSS reports.
Buyer VAT numbers when provided at checkout — validated against the official EU VIES registry; each check is logged as compliance evidence.
Merchant company details you enter in Settings — printed on invoices.

What we do NOT collect

No payment card data, no passwords, no browsing behaviour, no data sold to third parties.

Retention

Invoices and VAT records are retained to meet EU invoice-retention obligations (up to 10 years, varying by member state). When a redaction request arrives — for a single customer or for a whole store — we erase the personal fields (buyer VAT number, trader name and address) and keep the financial record itself, because you may need it in a tax audit and the law requires us to keep it. We do not delete your invoices when you uninstall.

GDPR

We honour Shopify's mandatory GDPR webhooks: customers/data_request, customers/redact and shop/redact. Where the EU invoice-retention obligation conflicts with a deletion request, the legal retention obligation prevails (GDPR Art. 17(3)(b)); personal fields outside invoices are erased or anonymised.

Third parties

VIES (European Commission) — VAT number validation.
Railway — hosting; data stored in the EU region.

Contact

busseozgenoglu@gmail.com