Privacy note
Version 1.0 · Last updated: 28 August 2026 · This English version is controlling; a Polish summary is available.
Who we are
This application helps a Shopify merchant issue Polish structured invoices (FA(3)) to KSeF. The merchant is the data controller; we act as a sub-processor of the buyer data needed to build and file invoices.
Operator: Truewheel Software — currently operated by an individual, pre-incorporation; registered entity details will be published here upon incorporation.
What we process
- Buyer tax identifier (NIP / EU VAT), company name and address (from the order and public tax registries), and order line items;
- For consumer document delivery, a buyer email address;
- The merchant’s own seller profile (name, tax id, address, bank account) and KSeF access token (stored encrypted).
We minimize data to what an invoice requires. We do not intentionally process special-category data.
Legal bases
Processing is carried out on the merchant’s behalf to perform invoicing and to meet the merchant’s legal invoicing obligations (including transmission to KSeF).
Where data is stored
At rest in the European Union: primary hosting Cherry Servers (Lithuania); encrypted backups on Scaleway (EU). We do not store this data in the United States.
Who we share it with (sub-processors)
Cherry Servers (hosting), Scaleway (backups), Sentry (error monitoring), Fakturownia (invoicing partner — only if the merchant chooses that channel), Brevo (consumer invoice email, EU), and Shopify (the source platform).
Legal obligations (not commercial sharing): invoices are transmitted to KSeF (Polish Ministry of Finance); a tax identifier may be checked against Biała lista (Polish MF) and VIES (European Commission); exchange rates come from NBP (no personal data).
Our Data Processing Agreement (Art. 28 GDPR), including the full sub-processor table, forms part of our Terms of Service and is available to merchants on request at privacy@truewheel.app.
How long we keep it
Invoice data has a statutory retention period under Polish tax law, and KSeF retains structured invoices for 10 years. To that extent an erasure request cannot remove invoice data (Art. 17(3)(b) GDPR). Other operational data is minimized and not kept longer than needed.
Your rights
Access, rectification, erasure (subject to the statutory retention above), restriction, and portability. Requests are handled together with the merchant (the controller). You may also lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).
EU representative
EU representative (Art. 27): to be appointed; a contact slot is established and the appointment is scheduled. Until then, all data-protection matters reach us directly at the contact below.