Privacypolicy

GST Invoice India Pro (the "App") is a Shopify app published by Wyron Technologies ("Wyron", "we", "us"). It runs inside the Shopify admin and generates GST tax invoices, bills of supply, credit and debit notes, purchase records and GST reports for merchants in India.

This policy explains what data the App collects from a merchant's Shopify store and from the merchant directly, how we use and protect it, how long we keep it and how it is deleted. It applies to merchants who install the App and to their customers whose details appear on orders. Our company website has its own privacy policy.

If you have any question about this policy or your data, write to info@wyrontechnologies.com.

From your Shopify store, through the Shopify API and the permissions you grant when you install the App (read_orders, read_products, read_customers, read_locations, read_files, write_files):

• Store details: store name, myshopify domain, contact email, currency and the Shopify plan.
• Orders: order number, dates, line items, quantities, prices, discounts, taxes, shipping, payment and fulfilment status, refunds, notes and custom attributes (for example a buyer GSTIN or an SEZ flag entered at checkout).
• Customers linked to those orders: name, email address, phone number, billing address and shipping address, as they appear on the order.
• Products and variants: title, SKU, price and image URL, so you can map HSN or SAC codes and GST rates and so invoices show what was sold.
• Locations: name and address of your Shopify locations, used for multi-GSTIN invoicing.
• Files: the App uploads the logo you choose to your own Shopify Files and stores only its public URL.

Information you enter in the App:

• Your business identity: legal name, trade name, GSTIN, PAN, IEC, CIN, FSSAI licence number, registered address, phone, email and website.
• Bank account details you want printed on invoices: account holder, account number, IFSC, bank and branch name, UPI ID.
• GST configuration: HSN and SAC codes and rates, product tax mappings, additional GSTIN locations, SEZ buyer GSTINs, invoice number series, financial year settings and scheme choices such as composition.
• Invoice templates: layout, colours, logo URL, terms and conditions, declaration, signatory and footer text, or your own invoice HTML.
• Optional email settings: SMTP host, port, username and password, from name and from address, subject and message templates, and automation triggers. The SMTP password is encrypted before it is stored.

Information the App generates while you use it:

• The documents themselves: invoice numbers, dates, supplier and buyer details, line items, tax breakdown, totals, place of supply, supply type, status and cancellation reason.
• Purchase and expense records you enter, including supplier GSTIN and ITC eligibility.
• E-invoice data for B2B documents: the INV-01 payload, IRN hash and QR payload.
• Email logs: recipient, status, time sent and any error message.
• An audit log of actions taken in the App (created, cancelled, emailed, settings changed) with the time and the email address of the staff member who performed them.

Technical information: our servers keep standard request logs (IP address, time, requested URL, errors) for security and troubleshooting. The App does not use advertising cookies or third-party analytics inside the Shopify admin. It relies on Shopify session tokens to know which store and staff member is signed in.

• To generate, number, render and store GST documents for your orders and refunds, and to calculate CGST, SGST, UTGST, IGST and cess correctly.
• To send invoices by email when you ask us to, or automatically on the triggers you enable, through the SMTP server you configure.
• To produce GSTR-1, GSTR-3B, HSN, GSTR-9, purchase and ITC reports and CSV exports.
• To upload your logo to your Shopify Files and show it on your documents.
• To answer your support requests and to investigate errors.
• To keep the App secure, prevent abuse and meet our legal obligations.

We do not sell personal data, share it with advertisers, use it to build marketing profiles or use it to train machine-learning models.

For the data of your customers that appears on orders, you (the merchant) decide why and how it is processed. We process it on your behalf and on your instructions to provide the App. In the language of the Indian Digital Personal Data Protection Act, 2023 you are the Data Fiduciary and we act as your Data Processor; under the GDPR you are the controller and we are the processor.

For your own account and business details, and for our technical logs, we are the controller because we need them to operate the App and to meet our own legal duties.

The App runs on Google Cloud Run in the Mumbai region (asia-south1) and stores its data in a managed PostgreSQL database. All traffic between your browser, Shopify, our servers and the database is encrypted with TLS.

SMTP passwords are encrypted at rest with AES-256-GCM using a key held separately from the database. Shopify access tokens are short-lived and rotated, and are deleted the moment the App is uninstalled.

Invoice PDFs are rendered on demand when you download or email them. We do not keep copies of PDF files. Your logo lives in your own Shopify Files, not on our servers.

Access to production systems is limited to Wyron staff who need it to run and support the App, and is protected by multi-factor authentication. No method of storage is perfectly secure, but we take the measures reasonably expected of a provider handling financial records.

• Shopify Inc.: the App reads from and writes to your store through Shopify's APIs, and Shopify may send us data through webhooks. Shopify's own privacy policy applies to its platform.
• Google Cloud (hosting) and our managed database provider: they store and process data on our behalf under their standard data processing terms.
• Your email provider: when you configure SMTP, invoice emails and their PDF attachments are delivered through the server you specify. We do not route them through any third-party email service.

We do not share data with anyone else, except when the law requires it (for example a valid request from a court or tax authority), or if Wyron is involved in a merger or acquisition, in which case we will tell you before your data is transferred and this policy continues to apply.

While the App is installed we keep your documents and settings so that your number series stays continuous and your history, reprints and reports keep working.

When you uninstall the App we immediately delete your Shopify access tokens and sessions, delete your SMTP server details and password, and switch off every automation so no document or email can be produced afterwards.

Forty-eight hours after uninstall, Shopify sends us a shop/redact request and we permanently delete everything else we hold for your store: invoices and notes, purchases, counters, templates, HSN mappings, locations, bank details, email logs and audit logs.

Section 36 of the CGST Act requires you to retain tax invoices and related records for 72 months from the due date of the annual return. Because we delete your data 48 hours after uninstall, please download your documents and export your reports before you uninstall. If you reinstall within those 48 hours, your history and numbering are restored.

You can ask us to delete your store's data sooner, or to delete specific records, by emailing us from the address on your Shopify account. We act on such requests within 30 days.

When Shopify forwards a customer's erasure request (customers/redact), we remove that customer's name, GSTIN and addresses from the affected invoices while keeping the financial figures that tax law requires you to retain. When Shopify forwards a customer's access request (customers/data_request), we record it and provide you, the merchant, with the data we hold so you can respond to your customer.

As a merchant you can view, correct and export your data at any time from inside the App: documents can be downloaded as PDF, and every report can be exported as CSV. You can ask us to access, correct, delete or restrict the use of any personal data we hold about you or your staff, or object to its processing, by emailing us.

If you are a customer of a store that uses the App, please contact that store first, because it decides how your data is used. We will help the merchant respond. You may also contact us directly, and we will verify your request with the merchant before acting on it.

We respond to all requests within 30 days. If you believe we have not handled your data lawfully you may complain to the Data Protection Board of India or, in the European Economic Area or United Kingdom, to your local supervisory authority.

Our servers are in India. Shopify, Google Cloud and our database provider operate globally and may process or back up data outside India. Where that happens we rely on those providers' contractual safeguards, including standard contractual clauses where required.

The App is a business tool for registered GST taxpayers and is not directed at anyone under 18. We do not knowingly collect data from children except where it appears on an order placed through a merchant's store.

We may update this policy as the App or the law changes. The date at the top of this page shows the latest version. If a change materially affects how we handle your data we will tell you inside the App or by email before it takes effect.

Wyron Technologies

Email: info@wyrontechnologies.com

Website: https://wyrontechnologies.com

Please mention the App name and your store's myshopify domain so we can find your records quickly.