Privacy and your data
What data Toldo keeps about your store, your Mercado Libre account and your customers, how it protects that data and when it deletes it.
In short
Toldo keeps only what it needs to sync and invoice: identifiers, statuses, an activity log and your stamped CFDIs. Access permissions for Mercado Libre and for stamping are stored encrypted and deleted as soon as you uninstall. Your CSD never passes through Toldo. 48 hours after you uninstall, we delete all of your store's data.
What Toldo keeps
| Data | What it's for |
|---|---|
| Your store's domain and the Shopify session | To use the Shopify API on your store |
| Each connected Mercado Libre account: its ID, its nickname and its access permissions | To read and update that account at your request |
| The links between listings and variants, with the last stock and price sent | To keep each listing up to date |
| The links between Mercado Libre sales and Shopify orders, with their status and tracking number | To import each sale only once and track its shipment |
| An activity log, without your customers' data | To show you what synced and what failed |
| Your stamped CFDIs (XML and PDF) and the cancellation receipts (acuses de cancelación) | They're your tax documents |
Your customers' data
- Mercado Libre buyers. Their name, their nickname and, when you handle the shipping yourself, their address and phone number go straight into the Shopify order. Toldo doesn't keep a copy: only the identifiers and the order status stay in its database. Toldo never uses this data for marketing.
- Customers who request an invoice. Their RFC, name, postal code and tax regime are stored encrypted and only used for invoicing. Stamped CFDIs include them because they're tax documents.
Your CSD
Your Certificado de Sello Digital (CSD) is uploaded directly to the stamping provider's portal. The private key and its password never pass through Toldo. See Set up your issuer and CSD.
How we protect your data
- All traffic is encrypted (TLS), and the database is encrypted.
- The access permissions for Mercado Libre and for stamping also have their own encryption, with a key that's stored outside the database.
- Those permissions never appear in the system logs.
How long we keep it
- When you disconnect a Mercado Libre account, its access permissions are deleted immediately.
- When you uninstall Toldo, all access permissions are deleted immediately: the Shopify session, the Mercado Libre accounts and the stamping service. Your invoices, your links and the activity log stay for 48 hours, in case you reinstall.
- 48 hours after you uninstall, Shopify asks us to delete all of your store's data, and we delete it.
While Toldo is installed, your CFDIs are kept and you can download them. You can also always download them from the SAT portal.
Your customers' privacy requests
Shopify sends us your customers' privacy requests:
- Data request: you see it in Toldo, with the documents we have from that customer's orders.
- Erasure request: we delete our local copies of their personal data and the tracking numbers of their orders. Stamped CFDIs are kept, because they're tax documents.
- Store erasure: we delete everything we have about your store.
Privacy notice
The legal details are in our privacy notice.
Frequently asked questions
Does Toldo sell my data or my customers' data?
No. We don't sell data or use it for advertising.
Can Toldo see my Mercado Libre password?
No. You authorize Toldo on Mercado Libre's site, which only gives it an access permission.
Was this guide helpful?
Your email app will open with a message ready to send us.