Privacy policy

Bahader E-Invoicing · last updated 6 November 2026

Bahader E-Invoicing ("the app") is a Shopify app made by Bahader Labs, a brand of Shahid Bahader IT Services ("we"). It creates invoices and credit notes for a merchant's Shopify orders as e-invoices (ZUGFeRD / Factur-X PDF and XRechnung XML). This policy explains what data the app handles, why, and how long it is kept.

Data from merchants

• the shop's myshopify.com address and the access token Shopify gives the app;
• for staff who open the app: their Shopify user ID, name, email, locale and account-owner flag, as provided by Shopify for the session;
• the company details the merchant enters for their invoices (company name, address, VAT ID, tax number, registration, contact name, phone and email, bank details) and their settings (numbering, automation, email texts).

Data from the merchant's customers

To create an invoice, the app reads the order from Shopify. Each issued invoice or credit note stores what an invoice must contain: the customer's name (and company), billing and shipping address, email address, VAT ID if given, the order number and date, the items, prices, discounts and taxes, and how the order was paid. The app does not store payment card details or any other customer data.

How the data is used

• to create the merchant's invoices and credit notes and show them in the app;
• to email invoices to customers when the merchant has switched that on or sends one;
• to let the merchant download and export their invoices.

We do not sell data, use it for advertising, or share it with third parties, except our hosting provider, OVHcloud (which runs the server and database in its data centre in Canada, a country with an EU adequacy decision), and our email provider, Spacemail (which delivers the emails). The merchant is the controller of their customers' data; we process it on the merchant's behalf under the data processing terms in our terms of service.

Retention and deletion

• Issued invoices and credit notes are kept unchanged while the app is installed, because merchants must keep invoices for 10 years (for example § 147 AO and § 14b UStG in Germany, art. L123-22 Code de commerce in France).
• When Shopify passes on a customer's request to be forgotten, issued invoices are kept for that legal obligation (GDPR art. 17(3)(b)); the app holds no other data about customers. The merchant is told which documents exist when a customer asks for their data.
• When a merchant uninstalls the app, we delete the shop's access details straight away, and all of the shop's data, invoices included, when Shopify asks us to (48 hours after uninstalling). Merchants should export their invoices before uninstalling.
• Records of staff access to invoices are kept for 180 days.

Security

Data is sent over HTTPS and stored in a private database on our server. Customer names, email addresses, the invoice data and PDFs, and the app's access tokens are encrypted in the database (AES-256-GCM), so backups hold them only in encrypted form. Each PDF's fingerprint (SHA-256) is stored to show it hasn't changed. Requests from Shopify are checked against Shopify's signatures. Only the merchant's staff, through Shopify, can see a shop's data in the app, and the app records when staff open, download, email or export invoices.

Your rights

If you are a customer of a store that uses the app, contact the store first: they control your data and can give you copies of your invoices. You can also contact us at the address below, and we will help.

Contact

Bahader Labs (Shahid Bahader IT Services)
Email: support@bahaderlabs.com

We will update this page if the way the app handles data changes. The date at the top shows the latest version.