Privacy Policy — Payout Match

Last updated: 2026-09-03

This Privacy Policy explains how Glefferson Paiva Honorato ("we", "us") collects, uses, and protects data through the Payout Match application (the "App"), available on the Shopify App Store for installation on Shopify stores. By installing or using the App, the merchant ("you") agrees to the practices described here.

1. Who we are (data controller)

2. Scope

Payout Match is a detection tool that reconciles Shopify Payments payouts against the orders that compose them. It is not accounting software and does not sync with external systems.

3. What data the App accesses and stores

a) Session and authentication data (Shopify). To operate as an embedded app, we store the session data Shopify provides at installation: the store domain, the API access token, and merchant account identifiers (which may include the installing user's name and email). This is used solely to authenticate API requests to Shopify on your behalf.

b) Payout and transaction data. Using the Shopify Admin API (scopes read_shopify_payments_payouts and read_shopify_payments_accounts), we read your payouts and the balance transactions that compose them: amounts, fees, net values, transaction type (charge, refund, dispute/chargeback, adjustment), currency, dates, and the identifier of the order associated with each transaction. This is stored to compute and display the reconciliation.

c) Subscription status (billing). The App uses the Shopify Billing API to manage its subscription. Subscription status is handled by Shopify; we do not collect or store your card or payment method.

d) What the App does NOT collect. The App does not request the read_orders scope or any customer-data scope. It therefore does not collect your customers' personal data (names, emails, addresses, phone numbers, or order contents). It handles only the order identifier, to point you to the order responsible for a discrepancy.

4. Purposes and legal basis (GDPR)

We process the data above to:

The legal basis is performance of the contract with you (providing the App) and our legitimate interest in operating and securing the service.

5. How we store and protect data

Data is stored in Neon (managed PostgreSQL, EU region — Frankfurt) and the App is hosted on Fly.io (EU region — Frankfurt). Access is restricted to what is strictly necessary to operate the service. Communication with Shopify is encrypted in transit (HTTPS). Access tokens are treated as credentials and are not shared.

6. Retention and deletion

We keep data while the App is installed on your store. When you uninstall the App, or upon a deletion request, the associated data is deleted. We honor Shopify's mandatory compliance webhooks:

7. Sub-processors

8. International transfers

The App hosting (Fly.io) and database (Neon) are configured in regions within the European Economic Area (Frankfurt, Germany). Shopify, as the platform, may process data outside the EEA under its own appropriate transfer mechanisms (for example, the European Commission's Standard Contractual Clauses).

9. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your data, and to data portability. To exercise these rights, contact payoutmatch.app@gmail.com. You also have the right to lodge a complaint with the competent supervisory authority (in Portugal, the CNPD).

10. Data breaches

In the event of a personal data breach that poses a risk to your rights, we will notify you and/or the competent supervisory authority within the timeframes required by applicable law.

11. Changes to this policy

We may update this policy. Material changes will be communicated through the App or by email. The "Last updated" date above indicates the version in effect.

12. Contact

For any privacy question or about this policy: payoutmatch.app@gmail.com