Legal

Privacy Policy

For the Shopify app “GST Auto Invoice: India” (the “App”).

Effective 30 October 2026Publisher & data processor: One CEO Company[email protected]

One CEO Company is the trading name of the sole proprietorship “MY NCERTKaksha AI Innovation”, Saharanpur, Uttar Pradesh, India. The merchant who installs the App is the data controller for their customers’ data; One CEO Company is the data processor acting on the merchant’s instructions through the App.

1. What we collect

When a merchant installs the App, Shopify shares with us, under the access scopes the merchant approves:

Store data: shop domain, store name, address, contact email, and an access token to call Shopify’s API on the store’s behalf.
Order data (read_orders / write_orders): order number, dates, line items, prices, taxes, discounts, shipping, payment and fulfilment status, refunds.
Customer data (read_customers): the buyer’s name, billing and shipping address, email, phone, and, when the merchant stores one, the buyer’s GSTIN. An Indian tax invoice must show these.
Product data (write_products): titles, SKUs, variants, and the HSN codes / GST rates the merchant assigns.
Merchant-entered settings: legal business name, GSTIN, PAN (derived from the GSTIN), address, bank/UPI details to print on invoices, logo, numbering preferences, and optionally SMTP credentials for the merchant’s own mailbox or a WhatsApp Business (Meta Cloud API) token. These secrets are stored encrypted (AES-256-GCM).
Usage data: invoice and credit-note records we generate, delivery logs (which invoice was emailed or sent on WhatsApp, when, and to which address or number), report files the merchant generates, and basic server logs (IP address, request path, timestamps) kept for security and debugging.

We do not collect card or bank details of the merchant’s customers, and we do not use cookies for tracking inside the App beyond the session cookies Shopify requires.

2. Why we use it

To generate, number, store and deliver GST tax invoices, credit notes, debit notes and packing slips for the merchant’s orders.
To produce the merchant’s GST reports (GSTR-1, GSTR-3B, HSN summary) and accounting exports (Tally, Zoho).
To send invoices to the merchant’s customers by email or WhatsApp, when the merchant turns that on.
To bill the merchant for a paid plan through Shopify’s Billing API. We never see payment card data; Shopify handles the charge.
To provide support and to keep the App secure and reliable.

We do not sell personal data, do not use it for advertising, and do not use it to train machine-learning models.

3. Where it is stored

Data is stored in a PostgreSQL database on our servers (currently hosted with our VPS provider; region listed in the app’s settings page), with encrypted backups in the same region. Transit to and from Shopify, the merchant’s browser, and the merchant’s customers is TLS-encrypted. Generated PDF files are rendered on request and are not stored as files; report exports are kept on the server until the merchant deletes them or the store is removed.

4. Who else sees it

Shopify, as the platform (its own privacy policy applies).
The merchant’s email provider (Gmail, Zoho, Outlook or any SMTP host the merchant configures), only when the merchant enables email delivery; we send through the merchant’s account.
Meta Platforms (WhatsApp Business Cloud API), only when the merchant connects their own WhatsApp Business number; messages are sent from the merchant’s number using the merchant’s token.
Our hosting provider (section 3), which processes data on our behalf under a data-processing agreement.

No other third party receives personal data. We disclose data only if required by law.

5. How long we keep it

While the App is installed: as long as the merchant keeps the records. Merchants can cancel or delete invoices in the App. GST law typically requires keeping invoices for 6–8 years, so the merchant should export before uninstalling.
After uninstall: Shopify’s app/uninstalled webhook revokes our access immediately; 48 hours later Shopify sends shop/redact and we permanently delete every record for that store (settings, invoices, credit notes, offline orders, templates, logs, plan cache, sessions).
Customer erasure (GDPR webhooks): on Shopify’s customers/redact webhook we anonymise the customer’s name, address, email, phone and GSTIN on the stored invoices for that customer. On customers/data_request we locate the invoices and the merchant can export them for the customer.
Server logs: 30 days.

6. Security

Access tokens and merchant secrets are encrypted at rest; the database is not reachable from the public internet; all admin pages require a valid Shopify session token; webhooks are HMAC-verified; the public invoice link is a signed, expiring token that reveals one invoice only. Staff access is limited to what is needed for support and is logged.

7. Merchant and customer rights

Merchants can view, edit, export and delete their data inside the App at any time, or ask us at [email protected]. Customers of a merchant should contact that merchant; we will assist the merchant with access, correction or deletion requests within 30 days. Residents of the EU/UK may also lodge a complaint with their supervisory authority. Indian users may contact our grievance officer at the same address under the Digital Personal Data Protection Act, 2023.

8. Children

The App is a business tool for merchants and is not directed at children.

9. Changes

We will post changes on this page and update the effective date. Material changes are announced inside the App.

10. Contact

One CEO Company (sole proprietorship “MY NCERTKaksha AI Innovation”) · Saharanpur, Uttar Pradesh, India · [email protected] · oneceocompany.com

See also the Terms of Service and the GST Auto Invoice: India product page.