---
url: /gst-manager-shopify/data-and-privacy.md
description: >-
  What data GST Manager accesses on Shopify, how Protected Customer Data works,
  data storage practices, and GDPR compliance.
---

# Data & privacy

GST Manager processes customer and order information solely to calculate GST and generate legal tax invoices. The app adheres strictly to Shopify's **Protected Customer Data** security and privacy standards.

## What store data the app accesses

| Data type | Why it is needed |
| --- | --- |
| **Order details** (products, prices, discounts) | To calculate the correct CGST/SGST/IGST breakdown and generate line items |
| **Customer name & billing address** | To print the "Bill To" section on the tax invoice and determine place of supply |
| **Shipping address** | To print the "Ship To" delivery details on the tax invoice |
| **Customer email** | To deliver PDF invoice copies directly to the buyer |
| **B2B Company Tax ID** | To capture the business GSTIN for Shopify Plus B2B orders |
| **Store locations & themes** | To determine dispatch state and insert the cart-page GSTIN block |

The app does **not** track customer browsing activity, sell merchant data, or use customer information for marketing.

## Understanding Protected Customer Data

Under Shopify's privacy policies, any app that accesses customer names, addresses, or emails must receive **Protected Customer Data approval**.

* **For live stores:** Approval is handled during the standard Shopify App Store review process.
* **For development/test stores:** You can enable access immediately in your Shopify Partner Dashboard under **Apps → gst-manager → API access requests → Protected customer data**.

::: tip While approval is pending
If order webhooks are temporarily delayed, you can always click **Generate now** inside any order page to generate the tax invoice instantly.
:::

## Where your data is stored

1. **On your Shopify store:** All invoice numbers, tax breakdowns, and buyer GSTINs are saved directly to your store as Shopify **Metafields**. Even if the app is removed, this data remains in your store records.
2. **In secure cloud database:** Settings, invoice sequence counters, and report generation history are stored in an encrypted database communicating over HTTPS/TLS.

## GDPR & data privacy compliance

GST Manager complies fully with global privacy regulations (GDPR, CCPA) through Shopify's mandatory automated privacy webhooks:

* **Customer data request:** When a customer requests a copy of their data, Shopify notifies the app to export relevant records.
* **Customer data deletion:** When a customer requests deletion, the app permanently redacts their stored records.
* **Store data deletion:** When an app is uninstalled, Shopify sends a deletion notice (`shop/redact`) 48 hours later, permanently wiping the store's settings and history from the database.

## Related pages

* [Requirements](/gst-manager-shopify/requirements) — store prerequisites
* [Installation](/gst-manager-shopify/installation) — setup walkthrough
* [Uninstalling](/gst-manager-shopify/uninstalling) — what happens upon app deletion
* [FAQ](/gst-manager-shopify/faq) — data security questions