App: Billoxi · Website: www.xloxi.com
This Privacy Policy explains how XLOXI (“we”, “us”, “our”) collects, uses, stores, and shares information when you install or use Billoxi.
Billoxi runs inside Shopify Admin and helps merchants create order documents (sales orders, invoices, drafts, packing slips, credit notes, and returns).
1. Roles (who is responsible)
Merchant / store owner
You are the business using Billoxi. For your customers’ personal data that appears on orders and documents, you are typically the data controller (or “business”). You decide what to send, print, and store.
XLOXI / Billoxi
We provide the app. For merchant account and billing data, we are typically the controller. For customer and order data we process only to generate documents and run the app for you, we act as a processor (or “service provider”) on your instructions.
Shopify
Shopify is a separate platform. Shopify’s privacy policy applies to data Shopify holds. We receive store data through Shopify APIs and webhooks after you install the app.
2. Information we collect
2.1 From Shopify (after you install)
Shop / merchant data may include shop domain and shop identifiers; store name, address, phone, email, website (if you load or save store details); staff user id, name, email, locale, and account-owner flag from the Shopify session (used to keep you logged in); access tokens needed to call Shopify APIs; and billing and subscription status through Shopify Billing.
Orders, drafts, returns, and related records
As needed to build documents, this may include:
- Order id, order name / number, dates, payment and fulfillment status
- Line items, SKUs, barcodes (as text), quantities, prices, discounts, tax, shipping, totals, currency
- Customer name, email, phone, billing and shipping addresses
- Company / B2B fields (company name, company id) when present
- Customer notes and order notes
- Product images and product / customer metafields if you enable them on a template
- Return and refund information when you use return or credit-note features
Shopify scopes
We request only the Shopify access scopes required to provide Billoxi. Current scopes are listed in the app’s Shopify listing and in the install prompt.
2.2 Information you enter in Billoxi
- Logo and store details
- Custom header fields
- Template settings (layout, colors, fonts, language, paper, labels)
- Document numbers, prefixes, dates
- Notes, terms, and credit-note reasons you save on a document
- SMTP host, port, username, password, from name, and from email
- Email subject lines and email body templates
- Automation choices (auto invoice on paid; auto credit note on cancel / refund)
- Multi-currency preference
- Admin language preference
- Setup-guide progress
2.3 Usage data we create
- Which documents were printed, downloaded, or emailed
- Monthly usage counters (for plan limits and the home dashboard)
- Activity / event log entries (document type, document number, order name / id, action, time) on eligible plans
- Technical logs needed to run and debug the app (for example, shop domain, error messages, timestamps)
2.4 Live chat (Tawk.to)
The app may load Tawk.to so you can contact support from inside Billoxi. Tawk.to may collect the messages you send, your IP address, browser type, and similar technical data under Tawk.to’s own policy. You do not have to use chat. You can email us instead.
2.5 We do not intentionally collect
- Payment card numbers (Shopify Billing handles charges)
- Sensitive categories of data unrelated to order documents
- Data from visitors to your storefront, except when that data is already on a Shopify order and needed to produce a document
We do not sell personal information.
3. How we use information
We use information to:
- Authenticate your Shopify session and keep the app embedded
- Read order and shop data to generate previews, PDFs, and printouts
- Save your templates, numbers, store details, and automation settings
- Send emails you request through your SMTP server
- Create customer PDF download links you paste into Shopify emails
- Count usage against your plan and show analytics
- Provide Shopify Admin download / print actions
- Respond to support requests
- Maintain security, prevent abuse, and fix bugs
- Comply with law and Shopify’s app requirements (including GDPR webhooks: customers/data_request, customers/redact, shop/redact)
- Process subscriptions through Shopify Billing
We do not use your store’s customer list to send our own marketing.
5. Customer download links
On eligible plans you can paste a Billoxi download link into Shopify notification emails. The link is a public URL with a secret token. Anyone who has the link can download that document.
- Place the link only in the correct customer email
- Do not post download links on a public page
- If a document has not been created yet, the customer sees a notice instead of a PDF
We generate the PDF when the link is used, using store and order data needed for that document.
6. SMTP and email
SMTP passwords and server settings are stored so the app can send mail on your behalf. Protect your mailbox and use an app password where required (for example Gmail).
We are not responsible for how your SMTP provider stores or logs mail. You are responsible for the content of emails and for complying with anti-spam and privacy laws.
8. Data retention
We keep shop data for as long as the app is installed and you need the service (templates, numbers, settings, document metadata, usage).
When you uninstall Billoxi, Shopify typically sends a shop/redact request about 48 hours later. We then delete shop-scoped data we store in our database, including sessions, settings (including SMTP), templates, document numbers, and related status records, except:
- Information we must keep for legal, tax, security, or billing reasons (kept only as long as required)
- Backups, which are removed on the backup cycle
- Anonymized usage that cannot reasonably identify a shop
If Shopify sends a customers/redact webhook, we delete or anonymize personal data we store for that customer / those orders, as required by Shopify’s privacy rules.
Order line items and full order payloads are primarily read from Shopify when you open or export a document. We store document metadata (such as Billoxi document numbers, dates, notes, terms, and conversion status) keyed to the shop and order.
9. Security
We use reasonable technical and organizational measures, including:
- Shopify OAuth / session authentication
- HTTPS for the app
- Webhook HMAC verification
- Access limited to staff who need it to operate the service
No method of transmission or storage is 100% secure. You must also protect staff accounts and SMTP credentials.
10. International transfers
We may process data on servers in [YOUR COUNTRY] and in other countries where our hosting providers operate. If you are in the EEA, UK, or Switzerland, we rely on appropriate safeguards (such as standard contractual clauses used by our providers, or your instructions as merchant) where required.
11. Your rights
Merchants
You can access and update store details, templates, and settings in the app. You can uninstall Billoxi at any time. You may request a copy or deletion of merchant account data by emailing billoxi@xloxi.com.
Your customers
Customers should contact you (the store) first. You are the merchant of record. Shopify will forward certain privacy requests to us through mandatory webhooks (data request, customer redact, shop redact). We respond to those webhooks as required. If you are a customer of a store that uses Billoxi and you cannot reach the store, you may email billoxi@xloxi.com. We may need to verify the request and involve the merchant and Shopify.
Depending on where you live (for example GDPR, UK GDPR, CCPA/CPRA), you may have rights to access, correct, delete, restrict, or port personal data, to object to certain processing, and to lodge a complaint with a supervisory authority.
We do not “sell” or “share” personal information for cross-context behavioral advertising as those terms are commonly used in US state privacy laws.
12. Children
Billoxi is for businesses using Shopify. It is not directed at children under 16 (or a higher age where required). We do not knowingly collect personal data from children.
13. Automated decision-making
Billoxi does not use automated decision-making or profiling that produces legal or similarly significant effects about individuals. Automation in the app (for example creating an invoice when an order is paid) only follows settings you choose.
14. Changes to this policy
We may update this Privacy Policy. The “Effective date” will change. Material changes will be posted in the app, on our website, or on the Shopify App Store listing. Continued use after the effective date means you accept the updated policy.
15. Contact
Privacy and data-protection requests:
XLOXI — Billoxi
Email: billoxi@xloxi.com
Website: www.xloxi.com
Shopify: apps.shopify.com/billoxi
If you are in the EEA/UK, you may also contact your local data protection authority. See also our Terms of Service.