Privacy policy
Last updated: October 26, 2026
This policy explains which data the Impec app processes, why, with whom and for how long. It covers merchants who install Impec and the customers of those merchants.
Who we are
Impec is published by Audric Berlioz, sole trader, 374F rue Neuve, 69970 Marennes, France. Contact: support@impecfacture.com.
Roles
- For its customers’ data, the merchant is the controller: it issues its invoices and must keep them. Impec acts on its behalf as a processor (Article 28 GDPR), only on its instructions: issuing, sending and exporting its invoices.
- For the merchant’s own data (store, company information), Impec is the controller.
Data processed
Merchant data:
- the Shopify store domain and email address;
- the legal information entered in “My business”: legal name, legal form, SIREN, VAT number, address, email, phone, website;
- the access tokens provided by Shopify, which let the app read orders.
Data of the merchant’s customers, read from Shopify orders:
- name, company, billing address and email address;
- items ordered, amounts, taxes, payments and refunds.
Impec asks Shopify for a single permission: reading orders. The app receives no card data and no passwords, and does not track customers’ browsing.
Purposes and legal bases
- Issuing invoices and credit notes, emailing them to customers and preparing accounting exports: performance of the contract between Impec and the merchant; for the merchant, compliance with its legal invoicing obligations.
- Answering support requests: performance of the contract.
- Keeping the app secure (technical logs): legitimate interest.
Data is never sold, rented or used for advertising.
Sub-processors and recipients
- Render Services, Inc. (525 Brannan St, San Francisco, CA 94131, United States): hosting of the app and its database, in its Frankfurt (Germany) region.
- Scaleway SAS (8 rue de la Ville-l’Évêque, 75008 Paris, France): sending emails, from France.
- Shopify: the platform the orders come from, which also bills the Impec subscription.
Emails are sent to the merchant ’s customer (invoices and credit notes) and to the merchant (its customers’ data requests).
Transfers outside the European Union
Data is hosted in the European Union. As Render Services, Inc. is a US company, access from the United States (for example for maintenance) remains possible; it is covered by the EU–US Data Privacy Framework and, failing that, by the European Commission’s standard contractual clauses.
Retention periods
- Invoices and credit notes: as long as the app is installed. The merchant must keep them for 10 years and can download them at any time from the “Exports” page.
- Orders on hold: deleted as soon as the invoice is issued.
- After uninstalling: all of the store’s data is deleted 48 hours later, at Shopify’s request, except the last number used in each invoice and credit note series (a counter, with no customer data), kept so that a reinstall never reuses a number already assigned.
- Technical logs: limited period, for security and troubleshooting; they contain no customer name, address or email.
Security
- Hosting in the European Union; encrypted database; encrypted connections (HTTPS).
- Each store only accesses its own data. Notifications from Shopify are verified by their signature.
- Download links for PDFs and exports are signed and valid for 15 minutes.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data. Merchants: write to support@impecfacture.com.
Customers of a store: send your request to the merchant you ordered from, or to Shopify. Impec helps the merchant answer it. Invoices are kept for the period required by law.
You can also lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr
Changes
This policy may change, for example when a sub-processor is added. The date of the last update is shown at the top of the page; merchants are informed of significant changes.