Updated: 2026-10-31.
Provider: Jardim Idílico Unipessoal Lda. Privacy contact: support@caravelsuite.com.
The merchant controls customer data; the app processes it to prepare documents in the merchant’s own InvoiceXpress account. While processing an order, the app reads customer names, billing and shipping addresses, email, tax identifiers, line items and totals. These customer details are processed temporarily and transmitted to InvoiceXpress; they are not retained in document or queue rows.
Stored operational data includes the shop domain, authorization sessions, encrypted InvoiceXpress API credentials, settings, order and refund identifiers, document identifiers and numbers, statuses, attempts and sanitized review codes. Document rows contain no customer names, addresses, emails or tax identifiers. The app does not sell customer data or use it to train models. The app is free: there are no charges, and it does not process payment card details.
A verified customer data request exports the app’s document metadata for the requested customer orders. A customer deletion request removes app records for the specified order identifiers. A shop deletion request removes the shop’s application records and credentials. Fiscal documents remain in the merchant’s InvoiceXpress account and are subject to the merchant’s legal retention obligations; deleting app records does not cancel or delete them.
Hosting: Contabo (server in France, EU). Sub-processors: Contabo (hosting). Merchants are responsible for the lawful basis for sharing order data. Customers should contact their merchant for access or deletion; merchants may contact support@caravelsuite.com. InvoiceXpress’s own processing and retention terms also apply.
The app stores authorization sessions, encrypted account credentials, settings, order and refund IDs, document numbers, amounts, currencies, processing states, hashes and privacy-request metadata. Customer billing details are read temporarily to prepare documents; authorization sessions may contain staff profile details. Fiscal documents remain in your InvoiceXpress account.
Operational identifiers are retained while the app is installed to prevent duplicate documents. Records and credentials are deleted on a verified shop deletion request, or during daily maintenance once 30 days have elapsed after uninstall while the worker is running. Privacy-request exports and pseudonymous deletion receipts expire after 30 days. Export download does not itself deliver the data to the customer: the merchant must deliver it and confirm completion.
Separate from expiring deletion receipts, minimal pseudonymous suppression markers are retained without automatic expiry to prevent delayed webhooks or jobs from recreating erased records or duplicate fiscal documents. These markers contain no raw shop domain or order ID. Successful fresh Shopify authorization, including reauthentication, removes the shop marker; markers for customer-erased orders remain.
Dashboard access log: for security, we record the Shopify user ID of the staff member, the page of the app's dashboard opened (without parameters) and the time, never the content shown. It is kept for 365 days and deleted when the shop's data is erased (shop/redact, 48 hours after uninstalling).