Last updated: 8 October 2026
Privacy policy
This policy explains what data the Corrispettivi Pro app for Shopify (the "App") and this website process, why, and for how long, in accordance with Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.
1. Data controller
Mashup Adv S.r.l.s.
Traversa di Via Mario Fiore 17, 81055 Santa Maria Capua Vetere (CE)
VAT no. and tax code 04652990617
Email: [email protected]
2. Roles in data processing
For the store data the App needs in order to work (domain, access credentials, settings) and for the data of anyone who contacts us, Mashup Adv S.r.l.s. acts as data controller.
For the order data the App reads from the store, the controller is the merchant who installed the App. Mashup Adv S.r.l.s. processes that data on the merchant's behalf as data processor (Art. 28 GDPR), solely to generate the requested reports and in line with Shopify's API terms.
3. Data we process
3.1 Store data
- the store domain (e.g. store-name.myshopify.com);
- the Shopify API access token, the permissions granted and their expiry;
- the store's time zone and currency, read when a report is generated.
The App uses "offline" tokens tied to the store: it does not store the name or email address of the staff members who use it.
3.2 App settings
The chosen reporting day, the list of spreadsheet columns and the mapping between payment gateways and columns. This information contains no personal data.
3.3 Order data
With the read_orders and read_all_orders permissions, the App reads only the order fields needed for the report and its filters:
- order ID and number, creation date and any cancellation date, test order flag;
- payment status, tags, sales channel, payment gateway, total amount;
- transactions: type, status, gateway, payment method name, date and amount;
- from shipping and billing addresses: only city, province code, country and company name (for location filters and to tell consumers and businesses apart).
The App does not read customers' first or last names, email addresses, phone numbers, street names or house numbers, or any payment card data. Order data is processed in memory at the time of the request and is not stored in our databases. The Excel file is generated on the fly and downloaded directly by the merchant, without being kept on our servers.
3.4 Subscription
The App is paid and the subscription is managed by Shopify: the merchant chooses the plan and pays for it on their Shopify invoice. We do not receive or process any card or bank account details. To grant access, we query the Shopify Partner API with the store identifier and receive only whether the subscription is active; the result is kept in server memory for a few minutes. Shopify provides us with the subscription billing data (store, plan, amounts) for accounting purposes.
3.5 Support requests
If you write to us at [email protected], we process your email address, the name you give us and the content of your message.
3.6 Technical data
The servers hosting the App and this website keep technical logs (IP address, date and time, page requested, any errors) needed to keep them secure and working. Shopify webhook notifications are logged with the store domain and event type only.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the App: authentication, subscription check, saving settings, generating the preview and the Excel file | 3.1, 3.2, 3.3, 3.4 | Performance of the contract with the merchant (Art. 6(1)(b)); for order data, the instructions of the merchant as controller (Art. 28) |
| Answering support requests | 3.5 | Performance of a contract or of pre-contractual measures (Art. 6(1)(b)) |
| Security, abuse prevention and error diagnosis | 3.6 | Legitimate interest of the controller (Art. 6(1)(f)) |
| Legal obligations, such as tax and accounting requirements | Subscription billing data (3.4) | Legal obligation (Art. 6(1)(c)) |
Data is not used for marketing, profiling or automated decision-making, and is never sold or passed on to third parties.
5. Retention and deletion
- Order data: not stored; it stays in memory only for the duration of each request.
- Access tokens: deleted when the App is uninstalled.
- App settings: deleted automatically when we receive the data erasure request that Shopify sends 48 hours after the App is uninstalled. The merchant can also delete them sooner, at any time, with the "Detect again from orders" button in Settings.
- Subscription check result: kept in memory for up to 5 minutes, never saved to the database.
- Subscription billing data: for the 10 years required by Italian tax law.
- Support requests: for as long as needed to handle them and for 24 months afterwards, unless the law requires otherwise.
- Technical logs: for no longer than strictly necessary for security and diagnostic purposes.
6. Recipients and transfers
Data may be processed, solely for the purposes stated above, by:
- Shopify, the platform through which the App is installed, from which it reads data and which handles subscription billing;
- cloud infrastructure providers (hosting and database) acting as data processors under an agreement pursuant to Art. 28 GDPR;
- public authorities, where required by law.
If a provider processes data outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission or on standard contractual clauses (Arts. 45–46 GDPR).
8. Security
All communication with the App and with Shopify takes place over encrypted connections (HTTPS). Access tokens are stored in a restricted-access database. The App requests only the read permissions it needs and never changes orders, products or customers.
9. Your rights
At any time you can request access to, rectification, erasure or restriction of processing of your data, and data portability, or object to processing based on legitimate interest (Arts. 15–22 GDPR), by writing to [email protected]. We reply within 30 days.
If you are a customer of a store that uses the App, the store is the controller of your data: please send your requests to the store. Access and erasure requests that Shopify forwards to us on behalf of stores are handled automatically; since the App does not keep any customer data, there is no data to export or delete.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
10. Changes
We may update this policy, for example when the App gains new features. The date at the top shows the latest revision; if we make significant changes, we will notify merchants through the App or by email.