Privacy Policy

Last updated: 2026-05-10 · Effective: 2026-05-10

This Privacy Policy explains how aulvem ("we", "our", "the Service") collects, uses, and protects information related to the Shopify application provided by us.

1. Information we collect

When a Shopify merchant installs our application, we receive:

• Shopify shop domain and access tokens granted by the merchant during OAuth installation
• Order metadata: order IDs, order timestamps, line items, currencies, amounts, shipping addresses, customer names, tracking numbers
• Carrier documents that the merchant explicitly uploads (PDF or image files)
• Application configuration that the merchant sets (registered invoice issuer number, retention preferences)

We do not collect or store:

• Customer payment information (handled by Shopify Payments)
• Customer email content beyond what Shopify exposes via webhooks
• Personal data from end customers beyond what is required for the export-tax-evidence purpose

2. How we use information

We process this information for one purpose only: to generate, store, and produce export-tax-evidence documentation that the merchant needs to satisfy Japanese tax-audit and electronic-records-law requirements.

Specifically, we use the data to:

• Produce multi-currency commercial invoices for export orders
• Convert foreign-currency amounts to JPY using the Mitsubishi UFJ TTM rate at the order date
• Store evidence documents for the legally required retention period (seven years by default; ten years for Pro merchants who opt in)
• Apply RFC 3161 timestamps and SHA-256 hash chains to evidence files
• Generate the Evidence Pack that Pro merchants use during tax-audit response
• Render multi-language buyer receipts (English, Simplified Chinese, Traditional Chinese, Korean) using static templates
• Enable freee or MoneyForward CSV export for accounting integration

We do not use the data for:

• Marketing to end customers
• Profiling or behavioral analysis
• Sale to third parties
• Training of machine-learning models on merchant or customer content
• Any purpose unrelated to the export-tax-evidence service

3. Data location and retention

Evidence documents and order records are stored on Cloudflare R2 in the United States region. Database records are stored in the same region. Retention is set by the merchant: the legal default is seven years from the shipment date.

When a merchant uninstalls the application, we initiate a thirty-day grace period during which records remain available for re-installation; after thirty days, all merchant data is deleted, except where Japanese tax law independently requires the merchant (not us) to retain copies on their own systems.

4. Third-party processors

The following processors handle data on our behalf:

• Cloudflare (storage, compute, DNS): privacy commitments at cloudflare.com/privacypolicy
• Mitsubishi UFJ public exchange-rate page (read-only public data fetch)
• Freetsa or DigiCert (RFC 3161 timestamp authority): receives only a SHA-256 hash, not the underlying document
• Shopify Inc. (platform OAuth and webhooks): privacy commitments at shopify.com/legal/privacy

The Service does not invoke external AI or large-language-model APIs at any tier; multi-language receipts and other localized output are generated from static templates included with the Service.

5. Data subject rights (GDPR, CCPA, APPI)

We implement Shopify's mandatory privacy webhooks:

• customers/data_request — we provide the requesting customer's data within thirty days
• customers/redact — we delete the requesting customer's personal data within thirty days
• shop/redact — we delete all merchant and customer data forty-eight hours after a shop is uninstalled, subject to retention rules in section 3

Customers of merchants who use our application may also contact us directly at support@aulvem.com for access, correction, or deletion requests. We will route such requests to the relevant merchant where the merchant is the data controller.

6. Security

• All data in transit is encrypted with TLS 1.2 or higher
• Database fields containing access tokens are encrypted at rest by Cloudflare
• Evidence documents have RFC 3161 timestamps and SHA-256 hash chains, allowing tamper detection
• We follow industry-standard practices for vulnerability monitoring and patch management

7. International transfers

Data is processed in the United States. Merchants and end customers may be located in Japan, the European Union, or other regions. By using our application, merchants accept that data is transferred to and processed in the United States.

8. Changes to this policy

When we change this policy materially, we will notify Shopify Partners account holders by email and update the "Last updated" date at the top.

9. Contact

For privacy questions or to exercise data-subject rights, email support@aulvem.com. Replies typically arrive within two weekdays in UTC business hours.