Effective date / last updated: August 11, 2026
This privacy policy covers the Fedev EU VAT & VIES Shopify app ("the app"), operated by MB Fe dev.
For data protection questions, requests, or concerns, contact: privacy@fedevapps.com.
The app acts as a data processor. The Shopify merchant who installs the app is the data controller for their own store's data, including their customers' data — the app processes data on the merchant's instructions, for the purpose described below.
About your customers (the buyer):
This app does not process: your customers' names, email addresses, phone numbers, or full physical addresses (street, city, postal code). Only a customer ID, a VAT number, and — as described above — a saved address's country, read momentarily and never stored.
About you (the merchant):
Solely to apply the EU cross-border B2B reverse-charge VAT exemption correctly, and to keep a record showing that a customer's VAT number was validated before payment was taken. We never recompute or override Shopify's own tax calculation — we only tell Shopify's native exemption mechanism to apply. Your data is never sold, and never used for advertising or profiling.
The app processes data as a processor acting on the merchant's instructions. The merchant, as controller, is responsible for having a lawful basis for that processing (typically: performance of the sale contract with their customer, and their own legal/accounting obligations).
No other party has access to your data. We don't use analytics trackers or third-party marketing tools inside the app.
Stored in the EU — a Postgres database hosted in Frankfurt, Germany. Render, our hosting provider, is a US-incorporated company whose primary processing operations take place in the United States, so support and operations staff (and Render's own sub-processors) can access data from outside the EEA in the course of running that infrastructure. Where that happens, it's covered by the EU-US/UK/Swiss Data Privacy Framework or, where that doesn't apply, the Standard Contractual Clauses (European Commission Decision 2021/914) — specifically the Processor-to-Subprocessor module, since we're the merchant's processor and Render processes on our behalf as our subprocessor — both incorporated into our DPA with Render.
We apply appropriate technical measures to protect your data: encryption at rest on the production database, and encryption in transit (TLS) between the app and the database, in addition to the platform-level encryption Shopify itself provides for admin, webhook, and OAuth traffic. Render, our hosting provider, maintains SOC 2 Type II and ISO 27001 certifications.
Customer data (VAT checks and order records): deleted when Shopify notifies us that you've uninstalled the app — typically within 48 hours — and in any case within 90 days of the order date, whichever happens first.
You can download your own copy (CSV or PDF) from the VAT Records screen at any time before deletion. After that, keeping records for your own accounting and audit needs becomes your responsibility, the same way it would be for any other transaction record you keep outside Shopify.
Your own store data (VAT number, country, reverse-charge settings): kept for as long as the app is installed, then deleted when you uninstall.
Your customers' requests for a copy of their data, or for erasure, are handled through Shopify's standard data request and redaction mechanisms, which trigger the process described above automatically.
Your own requests, as the merchant — a copy of what we hold about your store, a question, or a concern — go directly to us: privacy@fedevapps.com.
If you believe your data has been processed unlawfully, you have the right to lodge a complaint with a data protection supervisory authority. For Lithuania, that's the State Data Protection Inspectorate (VDAI) — vdai.lrv.lt/en. If you're located elsewhere in the EU, your own country's supervisory authority is also able to hear complaints under GDPR's cooperation mechanism.
If we make a material change to this policy, we'll update the effective date above and, where required, notify you through the app or by email.
See also our Terms of Service and Data Processing Addendum.