Privacy Policy

Last updated: August 5, 2026

VATBridge ("we", "us") provides a Shopify application that captures and validates business VAT numbers and generates compliant e-invoices for merchants selling to EU businesses. This policy explains what data we process and why.

1. Who we serve

Our customer is the merchant who installs VATBridge on their Shopify store. We process data on the merchant's behalf to deliver the app's functionality. We do not sell data to anyone.

2. What we collect

• Merchant account data — your store domain, the access token Shopify issues on install, and your company's legal name and VAT number that you enter in Settings. These identify you and appear as the seller on invoices.
• Order data — for each order, we receive the order identifier, the VAT number entered by the buyer, the buyer's email, line items, and totals. This is the minimum needed to validate the VAT number and generate an invoice.
• Validation results — the outcome of checking a VAT number against the EU's VIES registry, including the registered company name and address VIES returns.

We do not collect payment card details, buyer passwords, or any data beyond what is described above.

3. How we use it

• To validate VAT numbers against the official EU VIES service.
• To generate and deliver Peppol-compliant e-invoices and PDF invoices.
• To show you a dashboard of validation and delivery results.

4. Sub-processors

We share data only with the services required to run the app:

• Shopify — the platform your store runs on.
• The EU VIES service (European Commission) — receives the VAT number being validated.
• Our Peppol access-point provider — receives invoice data to deliver e-invoices over the Peppol network.
• Our hosting and database provider — stores the data described above in the EU (Frankfurt).

5. Data retention & deletion

We keep validation and invoice records for as long as your store has the app installed, so your compliance history stays available. We honor Shopify's mandatory data-protection webhooks:

• Customer data request — we surface the records tied to the requested orders.
• Customer redaction — we delete the records tied to the specified orders.
• Shop redaction — when you uninstall, we delete all of your store's data, including settings and validation records.

You can also request deletion at any time by emailing us.

6. Where data is stored

Data is stored on servers located in the European Union (Frankfurt, Germany).

7. Security

Access tokens and secrets are stored encrypted. Data is transmitted over HTTPS. Access is restricted to the operators of the service.

8. Not legal or tax advice

VATBridge automates VAT validation and e-invoice generation. It is software, not tax or legal advice. Consult your accountant about your specific obligations.

9. Contact

Questions or deletion requests: hello@vatbridge.app