Carnet: Line Sheets & Orders
This policy explains how Carnet handles personal data of merchants who install the App, and the personal data of the merchants' buyers ("stockists") that the App processes on the merchant's behalf. A separate notice is shown to buyers on the order page.
1. Who we are
The App is published by TAKISOFT 2.0 ("Carnet", "we"), the controller of your merchant account data. Contact for privacy: [email protected].
We have two roles:
- Controller of your merchant account data (section 2.1).
- Processor of your buyers' data (section 3). You are the controller. The DPA governs this.
2. Data we collect
2.1 Merchant data (we are controller)
- From Shopify when you install and use the App: your shop domain, shop name, contact email, time zone and language, primary domain, plan information, granted access scopes, and an access token. For staff who sign in: Shopify's session record, which can include the staff member's name, email, locale and account-owner flag. Sessions are removed when you uninstall.
- What you enter in the App: legal name, legal contact and address (shown to buyers as the data controller), line sheets, links, texts, brand assets and fonts you upload, price and market settings, flags and preferences.
- Store data read through Shopify scopes: products, variants, images and prices; B2B companies, locations and contacts; markets and tax display settings; translations and locales; theme colours and fonts (read-only). The App keeps the copies it needs to build and serve your line sheets.
- Usage data: counters and events (for example link opens and sends), kept in aggregate form per day, and technical logs. Event rows are deleted after 12 months. Logs are scrubbed of buyer email addresses and link tokens.
- Billing: your plan and trial status from Shopify. Payment is handled by Shopify; we do not receive card details.
- Emails we send you: order notifications and, if enabled, a funnel digest, sent from
[email protected]through Azure Communication Services.
Purposes and legal bases (Art. 6 GDPR): to provide the App and support (contract, 6(1)(b)); to secure and prevent abuse of the service (legitimate interest, 6(1)(f)); to meet legal obligations such as tax and compliance requests (6(1)(c)); and to send service messages. We do not sell personal data and do not use it for advertising.
2.2 Cookies and similar
The merchant admin runs inside Shopify admin and uses Shopify's session mechanisms. Buyer pages use one session cookie on the order pages and the cart quantities in the browser's storage; no contact data is stored there (see the buyer notice).
3. Buyer (stockist) data: our role as processor
When a buyer sends an order request through one of your links, the App processes: name, email, company, phone, delivery and billing address, VAT number, order lines and notes, the optional sales agent name and PO number. The buyer details block (name, email, company, phone, addresses, VAT number) is encrypted per store (AES-256-GCM) in the database; the sales agent name, PO number, order lines and totals are stored unencrypted; email and VAT number are also stored as keyed hashes (so that duplicates and deletion requests can be matched without reading them). Carnet then creates a draft order in your Shopify store; that copy in Shopify is under your and Shopify's control, not ours.
You decide the purposes and means: you are the controller. We process this data only to run the App for you, according to the DPA. The buyer notice names you as the responsible party and Carnet as your processor. We do not use buyer data for our own purposes.
We provide you with tools to answer data-subject requests: export (Shopify's customer data request is handled automatically), erase ("Delete buyer data"), and automatic deletion after the retention period. Buyers who write to [email protected] have their message forwarded to you. We do not respond to them ourselves, except where the law requires.
4. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Shopify | Platform: authentication, store data, draft orders, billing | per Shopify |
| Microsoft Azure | Hosting (App Service), PostgreSQL database, secret storage (Key Vault), blob storage of deletion records, outbound email (Azure Communication Services) | France Central (EU); email data location: Europe |
| Cloudflare | Network and proxy, custom hostnames for buyer links, Workers and KV (host-to-store routing), static hosting of the buyer information site, email routing of [email protected] | global edge network (see section 7) |
The full list with processing details is in Annex III of the DPA. We will update the list and notify you as the DPA describes.
5. Retention
| Data | Kept |
|---|---|
| Order request details (buyer name, email, address, VAT, agent name) | 180 days after the request is processed; then erased from the request; order reference, lines and totals are kept for your records |
| Requests never processed (pending, held, failed, expired) | 60 days, then deleted |
| Request stuck before reaching Shopify | Redacted after the same retention period (not deleted, so an order is not lost silently) |
| Email bodies and recipient addresses of sent emails | 7 days after sending |
| Spreadsheet import contents | 30 days |
| Usage events | 12 months |
| Shopify webhook de-duplication rows | 7 days |
| Privacy-request records | 30 days after completion |
| Deletion records (tombstones) | 42 days, and kept in an hourly export for 42 days |
| Database backups | Encrypted copies expire after 35 days at most |
| After uninstall | Links are paused and staff sessions are deleted at once. Shopify sends a store-deletion request about 48 hours after uninstall; we delete your store's data from the live database when we receive it, normally within an hour, and shred the store's encryption key. If no request arrives, we delete it 60 days after uninstall. In short: about 2 days after uninstall, 60 days at most. |
Erasure in backups completes when the backups expire. If a backup is restored, Carnet re-applies every recorded deletion before resuming normal processing.
6. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where we rely on it, and to complain to your data protection authority (in France, the CNIL). Write to [email protected]. For data we process as processor, we will forward your buyers' requests to you and help you answer them as set out in the DPA.
7. International transfers and security
Production data is hosted in the EU. Cloudflare serves traffic from its global network; Shopify is a global provider. Where personal data leaves the EEA, we rely on the providers' standard contractual clauses and/or the EU-US Data Privacy Framework. Our security measures (encryption, access isolation, rate limits, logging hygiene, deletion) are summarised in Annex II of the DPA and on the Security page.
8. Changes
We will post updates here and, for material changes, notify you in the App or by email.