Toldo privacy policy

Toldo is one Shopify app with modules. Which modules a store sees depends on its country and setup:

• Marketplace sync: connects the store to seller accounts on online marketplaces (Mercado Libre first) to keep stock and prices in step, bring marketplace orders into Shopify and pass tracking both ways.
• CFDI 4.0 (Mexico): issues Mexican electronic invoices: a self-invoicing portal for buyers, the factura global, credit notes and cancellations. The invoices are stamped by an authorized certification provider (PAC); Toldo is not a PAC.
• KSeF (Poland): issues Polish structured invoices and sends them to KSeF, the national e-invoicing system. WooCommerce and Wix stores use it through our platform API.

This policy explains what personal data the app processes, why, who receives it, how long we keep it and what rights people have. The public website's application form has its own privacy notice (aviso de privacidad) at https://toldo.io/en/legal/privacy-notice-mexico (section 11).

1. Who we are

Toldo is provided by Pending: [Company legal name], Pending: [Registered address], Pending: [Registration number and tax ID] ("we", "us").

• Privacy contact: Pending: [Privacy email address]
• Data protection officer: Pending: [Data protection officer contact]

2. Our role

• Merchants' customers (buyers): the merchant decides why and how its orders are synced and invoiced. The merchant is the controller of its buyers' data and we process it on its behalf:
  • in the EU, as its processor under Article 28 GDPR. The data processing agreement is at https://toldo.io/legal/dpa.
  • in Mexico, as its persona encargada under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 2025-03-20).
  • in Brazil, as its operador under the LGPD (section 12).
• Merchant accounts: we are the controller of the data we need to run the merchant's account, billing and support.

3. What we process

3.1 Every module

3.2 Marketplace sync

Buyers' details in marketplace orders. When the app imports a marketplace order, it reads what the marketplace provides to fulfil it and creates the Shopify order. If you ship the order yourself, the app writes the buyer's name, delivery address and, where available, phone into the Shopify order. It doesn't write the buyer's email or create a customer record. We don't keep a copy: our database keeps the order's ids, status and tracking number. The one exception is invoicing (section 3.3): if you choose Toldo to invoice your marketplace sales, the buyer's tax details are stored with the invoice request.

3.3 CFDI 4.0 (Mexico)

3.4 KSeF (Poland)

We don't place advertising or analytics cookies, in the admin app or on your storefront.

4. Why we process it

We use buyer data only to sync and invoice the merchant's orders. We don't sell personal data, use it for advertising or profiling, or use it to train AI models.

5. Who receives it

• Our hosting provider, as our processor: Pending: [Hosting provider and location].
• Shopify. The app works through Shopify's APIs. It creates the orders imported from marketplaces and writes invoice numbers and document links to app-owned fields (metafields) on the order.
• The marketplaces you connect (Pending: [Marketplaces you can connect]), under their own terms and privacy policies. We send them what you ask the app to sync: listing stock and prices, shipment status and tracking numbers and, if you choose Toldo to invoice your marketplace sales, the stamped invoice (XML and PDF), which the marketplace makes available to the buyer.
• The PAC (Mexico) that stamps your CFDI, Pending: [Certification provider (PAC)], located in Pending: [PAC location]. It receives each invoice's content, including the receiver's RFC, name, postal code and tax regime, and passes it to the SAT. Depending on your settings it may also email the invoice to the buyer.
• The tax authorities. Mexico's SAT receives every stamped CFDI through the PAC. Poland's Ministry of Finance receives every invoice sent to KSeF's production environment. Both keep these as tax records under their own laws, not on our behalf: such invoices can't be deleted, only corrected or cancelled.
• Narodowy Bank Polski (NBP). For KSeF invoices in another currency, the app downloads the NBP exchange rate from its public API. Each request contains only a currency code and a date.
• Support and email tools, only when you contact us: Pending: [Support tools].
• Error monitoring, set up so it doesn't receive buyer data: Pending: [Error monitoring].
• Authorities, when the law requires it.

6. Where the data is stored

• Our database is hosted in Pending: [Where the data is stored].
• When data from the European Economic Area is processed outside it, we rely on the European Commission's Standard Contractual Clauses or another valid transfer mechanism: Pending: [Providers outside the EEA and their safeguards].
• Mexican law allows us to use processors outside Mexico. We bind them to the same obligations we have.
• For data from Brazil, see section 12.

7. How long we keep it

8. Shopify's privacy requests

Shopify sends apps three mandatory privacy requests (webhooks). We answer each within 30 days.

• Customer data request (customers/data_request): we prepare a list of the invoices and invoice requests we hold for that buyer's orders and give it to the store owner in the app, with a download of the invoices concerned.
• Customer erasure (customers/redact):
  • We remove the buyer's personal data from our local copies (invoice drafts, invoice requests, tracking numbers) unless the law requires it to be kept.
  • Invoices accepted by KSeF stay in KSeF. A stamped CFDI stays with the SAT, and we keep its XML because Mexican tax rules require the issuer to keep it. The legal invoice file itself can't be altered.
  • We record what we removed and what was kept and why, and we tell the store owner.
• Store erasure (shop/redact, 48 hours after uninstalling): we delete everything we hold for that store, including connections, tokens, keys, settings and local invoice copies. Backups expire as stated in section 7.

9. Security

• In transit: all traffic to and from the app uses TLS.
• At rest: the database and backups are encrypted. Marketplace tokens, PAC keys, KSeF tokens and buyers' tax details in invoice requests are also encrypted with AES-256-GCM, using a key kept outside the database (Pending: [Where the encryption key is kept]).
• Never shown again: tokens and keys are not displayed after you save them; for KSeF we show only the last 4 characters.
• Your CSD stays with the PAC: if you upload it in the app, the certificate, its private key and its password pass through our server only to reach the PAC. We never store or log them.
• Access: limited to Pending: [Who has production access] who need it, with strong passwords and two-factor authentication. Access to customer data is logged.
• Test data: test and production data are kept apart. Sandboxes receive only test orders and sample invoices, and before anything goes to the KSeF sandbox, the app replaces seller and buyer details with fictional ones.
• Incidents: if a personal data breach affects a merchant's data, we tell the merchant without undue delay, within Pending: [Breach notice period] of becoming aware of it.

10. Your rights

• Everyone: you can ask for access to your data, correction, erasure, restriction, portability, or object to processing. In Mexico, you can exercise your ARCO rights: access, rectification, cancellation and opposition. Write to Pending: [Privacy email address]. We reply within one month (in Mexico, within 20 business days, as the law requires; in Brazil, within the time limits in section 12).
• Buyers: please contact the store you bought from first. The store is the controller, and we help it answer. Rights over invoices are limited by tax law: an invoice that the law requires a business to keep can't be erased.
• Complaints:
  • In Poland: the Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in the EU country where you live or work.
  • In Mexico: the Secretaría Anticorrupción y Buen Gobierno (https://www.gob.mx/buengobierno), within 15 business days of our answer to an ARCO request.
  • In Brazil: the Autoridade Nacional de Proteção de Dados (ANPD), see section 12.

11. The toldo.io application form

When someone applies to the founding-partner program on https://toldo.io, we are the controller of that application (name, email, Mercado Libre seller nickname, Shopify store address, order volume, current tool, what they want to solve). It is covered by the toldo.io privacy notice (aviso de privacidad) at https://toldo.io/en/legal/privacy-notice-mexico, not by this policy; for people in Brazil, section 12 applies too. The site uses no cookies or trackers. Against form abuse it keeps a keyed hash of the visitor's IP address, never the address itself, for 7 days.

12. Brazil (LGPD)

This section applies when Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD, Lei 13.709/2018) governs the processing of your data. The rest of this policy applies too.

• Who decides about your data: Pending: [Company legal name] is the controlador (controller) of merchant-account data and of the data of people in Brazil who use the forms on https://toldo.io. For buyers' data, the merchant is the controlador and we are its operador (processor): we process that data only on the merchant's instructions.
• Purposes and legal bases (art. 7):
  • running the app and your account, billing you, giving you support and assessing your application to the program: performance of a contract, or of steps you asked for before entering into one (art. 7, V);
  • meeting our legal duties, such as accounting and tax: compliance with a legal obligation (art. 7, II);
  • keeping the service secure, preventing abuse and fixing errors: our legitimate interest (art. 7, IX);
  • sending you optional news about Toldo: your consent (art. 7, I). If you don't give it, we simply don't send it. You can revoke it at any time.
• International transfer (art. 33): we store data outside Brazil (section 6). We make this transfer as article 33 of the LGPD allows, with contractual safeguards in our contracts with our providers.
• Your rights (art. 18): you have the right to:
  • confirm whether we process your data, and access it;
  • correct incomplete, inaccurate or out-of-date data;
  • ask for anonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach of the LGPD;
  • ask for portability of your data to another provider;
  • ask for deletion of the data we process with your consent;
  • know which public and private entities we share your data with;
  • revoke your consent;
  • object to processing we do without your consent, if it breaches the LGPD.
• How to exercise them: write to Pending: [Privacy email address]. It's free. We answer within the LGPD's time limits: for example, a full statement confirming or giving access to your data within 15 days of your request (art. 19). If you are a buyer, write to the store you bought from first: it is the controlador, and we help it answer.
• Encarregado (DPO): Pending: [Data protection officer contact]
• Complaints: you can also file a petition with the Autoridade Nacional de Proteção de Dados (ANPD), https://www.gov.br/anpd.

13. Changes

We will announce material changes in the app and by email at least Pending: [Days of notice] days before they take effect.

14. Contact

Pending: [Company legal name], Pending: [Postal address], Pending: [Privacy email address].