Privacy policy
Hexloom Tax Exempt is a Shopify app made by Hexloom Labs. It collects tax exemption certificates from a store's wholesale buyers and passes them to the merchant for review. This page says what the app stores, who can see it and when it is deleted.
Who is responsible
For the certificates a buyer uploads, the merchant who runs the store decides why and how they are used, so the merchant is the controller. Hexloom Labs runs the app on the merchant's behalf and only processes that data to provide the app. For the merchant's own account data (the shop address and the app's access token), Hexloom Labs is the controller. Contact details are on the support page.
What the app stores
| Data | Whose | How it is stored |
|---|---|---|
| Shop address (for example demo-store.myshopify.com), and the access token Shopify issues to the app with the permissions to read and write customers | Merchant | Token encrypted with AES-256-GCM |
| Business name and certificate number | Buyer | Encrypted with AES-256-GCM |
| Certificate file (PDF, JPG or PNG, up to 5 MB) | Buyer | Encrypted with AES-256-GCM |
| Buyer email address, state or province, certificate type, expiry date, the file's original name, review status, decision history (including the ID of the staff member who decided) and the merchant's rejection reason, plus the ID of the matching Shopify customer | Buyer | Stored as plain record fields, because the app has to match buyers and send the expiry notices |
| A counter keyed by shop and a keyed hash of the buyer email address (the address itself is not kept in it), used to limit abuse of the upload form | Buyer | Kept for 24 hours after the buyer's last upload attempt |
The app uses its customer permissions only to find the customer whose email matches an approved certificate, to create that customer if the store has none, and to set or remove the tax exemption. It also reads the store name and the store owner's contact email, so it can show the store's name on buyer emails and send the owner a customer data request. It does not read orders, products or payment details.
The app uses no advertising, no analytics and no tracking cookies. We do not store IP addresses. The app is hosted on Cloudflare, which processes network requests as any host does.
Who can see it
- The merchant, in the app inside their Shopify admin. The merchant can download the certificate file and approve, reject or revoke it.
- The buyer receives emails about their own certificate: approved, rejected (with the merchant's reason), expiring in 30 days and expired.
- Hexloom Labs does not read certificates, except to fix a problem that the merchant reports to support.
- We do not sell data and we do not share it with anyone else, except the providers listed below.
Providers that process data for us
- Shopify: the platform the app runs on, and the source of the shop and customer records the app reads and updates.
- Cloudflare: hosting, and storage of the records above. Cloudflare decides where on its network the data is held.
- Resend: delivery of the emails to buyers and store owners. Buyer emails carry the buyer's address, the store name, the certificate's status and, for a rejection, the merchant's written reason. A customer data request email to the store owner carries that customer's records, including the business name, certificate number and files.
How long we keep it
- Pending and approved certificates stay while the app is installed: pending ones until the merchant decides, approved ones until the expiry date or until the merchant revokes them.
- Rejected certificates lose their uploaded file at once; the rest of the record is deleted 90 days after the decision. Revoked and expired certificates are deleted with their files 90 days after the decision.
- When the merchant uninstalls the app, the access token is deleted at once. Shopify then sends a store erasure request, normally 48 hours after the uninstall, and all of that store's certificates, files and history are deleted. Tax exemptions already set on customers in Shopify stay until the merchant removes them.
- When a customer asks a merchant to erase their data, Shopify sends the app a customer erasure request and that customer's certificates and files are deleted.
- Records of webhook deliveries (an ID only) are kept for 7 days to ignore repeats.
- An access log (shop, action such as listing or downloading a certificate, certificate ID, time and who acted: the merchant session, the buyer upload form, Shopify or a scheduled job; never names, emails, numbers or files) is kept for 12 months, and removed with the rest of a store's data on a store erasure request except one record that the erasure happened.
Free and paid plans
Shops on the Free plan are handled identically to paid shops: the same data, the same encryption, the same retention periods and the same erasure on uninstall. The plan only sets limits on how many certificates can be approved at a time, how many can wait for review and how many megabytes of files a shop can store.
Requests about personal data
The app handles Shopify's three required privacy requests automatically: customer data request, customer erasure and store erasure. On a customer data request, the store owner is emailed that customer's records and uploaded files (up to five records in one email). A buyer who wants to see or delete their certificate should ask the store they sent it to, or write to us through the support page and we will pass the request on or act on it ourselves. These rights follow from laws such as the GDPR, the CCPA and Canadian privacy law, including Quebec's Law 25.
Security
All traffic uses HTTPS. Requests from Shopify are checked against its signature before the app acts on them. Encrypted records are bound to the store they belong to, so a record copied to another store cannot be decrypted. No system is perfectly secure. If we learn of a breach that affects you, we will tell you without delay.
Changes
If this policy changes, the date at the top changes, and we email merchants when the change affects what we collect.