VAT Exempt Pro — Privacy Policy

Last updated: 22 July 2026

VAT Exempt Pro ("the app", "we", "us") helps Shopify merchants validate their customers' EU VAT numbers and apply the correct tax treatment at checkout. This policy explains what personal data the app processes, why, and how it is protected.

1. Data we process

• Merchant / store data: your store's domain and the access token needed to operate the app.
• Customer data: the customer's email address (to identify the correct customer record) and the VAT number they submit. When a VAT number is validated we also store the VIES consultation ID and the company name returned by the registry.
• Validation logs: a record of each validation attempt (VAT number, country, result, timestamp) so the merchant can audit activity.

We do not collect customer names, phone numbers, addresses, payment details, or order contents.

2. Why we process it (purpose)

Solely to validate an EU VAT number against the European Commission's VIES registry and, when valid, apply the EU reverse-charge tax exemption to the corresponding customer so VAT is correctly handled at checkout. We do not use personal data for any other purpose, and we never sell personal data.

3. Sub-processors

• EU VIES (European Commission): VAT numbers are sent to the official VIES service for validation.
• Hosting provider: the app and its database are hosted on our managed server infrastructure.

4. Retention and deletion

Personal data is retained only as long as needed to provide the service. We honor Shopify's mandatory data-protection webhooks:

• customers/redact — we delete the customer's data on request.
• shop/redact — we delete all of a store's data after uninstall.
• customers/data_request — we provide the data we hold on request.

5. Security

All data is transmitted over HTTPS/TLS. Access to stored data is restricted to authorized personnel, protected by strong authentication. We maintain backups and a security incident-response process, and notify affected parties and Shopify of any material data breach without undue delay.

6. Your rights

Depending on your jurisdiction (including the EU/EEA under GDPR), individuals may have rights to access, correct, or delete their personal data. Merchants or their customers can exercise these rights by contacting us, or by using Shopify's built-in data-request and erasure tools.

7. Contact

Questions about this policy or your data: [email protected].