Privacy Policy

Last updated: April 16, 2026

Invoice9 ("we", "our", or "us") is operated by 2folk GmbH. This Privacy Policy explains how we collect, use, and protect information when you use the Invoice9 Shopify app.

1. Information We Collect

When you install Invoice9, we access the following data from your Shopify store to provide our service:

• Order data — order numbers, line items, totals, and fulfillment status, used to generate invoices, credit notes, and packing slips.
• Customer data — customer names, billing addresses, email addresses, and VAT numbers, used to populate invoice documents and perform VIES VAT validation.
• Shop data — store name, address, currency, and locale, used to configure invoice templates and e-invoice format detection.
• App settings — invoice numbering sequences, template preferences, email settings, and Google Drive integration credentials, stored to maintain your configuration.

2. How We Use Your Data

• Generate PDF invoices, credit notes, and packing slips in your chosen format (including ZUGFeRD, Factur-X, and PEPPOL).
• Send invoice emails to your customers on your behalf.
• Sync documents to your connected Google Drive account.
• Validate EU VAT numbers via the VIES service (European Commission).
• Maintain sequential invoice numbering and audit logs.

3. Data Storage

Your data is stored on servers within the European Union. We retain order and invoice data for as long as your app subscription is active, plus a statutory retention period of 10 years as required by EU accounting regulations. You may request deletion of your data at any time by contacting us (see Section 8).

4. Data Sharing

We do not sell your data. We share data only with the following third-party services required to operate Invoice9:

• Shopify — via the Shopify API to read orders and shop data.
• Google LLC — if you enable Google Drive sync, documents are uploaded to your own Google Drive account.
• PEPPOL network — if PEPPOL delivery is enabled, invoice XML is transmitted over the PEPPOL network to your buyer's access point.
• European Commission VIES — VAT numbers are validated against the publicly available VIES service.
• Email delivery — invoice emails are sent via our own SMTP server (Stalwart Mail) hosted within the European Union.

5. GDPR Compliance

We process personal data in accordance with the EU General Data Protection Regulation (GDPR). Our legal basis for processing is performance of a contract (Art. 6(1)(b) GDPR) — specifically, your contract with us to provide invoicing services — and compliance with legal obligations (Art. 6(1)(c) GDPR) for statutory document retention.

As a Shopify merchant, you are the data controller for your customers' personal data. We act as your data processor. We process customer data only on your documented instructions (i.e., generating and sending invoices).

6. Data Subject Rights

Under GDPR, your customers have the right to access, rectify, or erase their personal data held by Invoice9. If a customer contacts you to exercise these rights, please forward the request to support@2folk.com and we will fulfill it within 30 days.

You may also contact us to request a copy of your own data or to delete your account and all associated data.

7. Cookies

Invoice9 is an embedded Shopify admin app. It does not set first-party cookies in your customers' browsers. The app may use Shopify session tokens stored in browser memory (not persistent cookies) to authenticate admin sessions.

8. Contact

For any privacy-related questions or requests, please contact:

2folk GmbH
Email: support@2folk.com
Website: https://invoice9.2folk.com

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you via email or the Shopify admin if we make material changes. Continued use of Invoice9 after the effective date constitutes acceptance of the updated policy.