Privacy policy

1. Who this policy is about

This policy explains how LÚMÉA Books ("the app"), published by LÚMÉA Apps ("we"), handles information when a merchant installs the app on a Shopify store and connects it to a QuickBooks Online company.

2. Our role

For the store's data, the merchant decides why and how it is used (the merchant is the "controller") and we process it only on the merchant's behalf, to provide the app (we are the "processor"). Our data processing terms are on the Data processing page and form part of our agreement with merchants.

For the merchant's own contact details, and for keeping the service secure, we are responsible for the data.

3. Information the app reads from Shopify

• Orders: order numbers, dates, amounts of products, discounts, shipping, taxes, tips and duties, whether a line is a gift card, refunds, and payment transactions (payment method, amount, date). The app does not request customers' names, addresses, emails or phone numbers.
• Shopify Payments payouts and their balance transactions (amounts, fees, types, dates).
• Store details: currency, time zone and store address (domain).

Access to Shopify is read-only: the app never changes anything in the store.

4. Information the app reads from and writes to QuickBooks

• Read: the QuickBooks company name, the list of accounts (names, types, active or not), and whether an entry with a given number already exists.
• Written: journal entries summarizing the store's sales, refunds, payments and payouts.
• Created: new accounts in the merchant's chart of accounts (for example "Shopify Payments Clearing" or "Shipping Income"), only when the merchant clicks a "Create" button on the app's accounts page. An account with the same name is reused instead of being created twice.
• The app never edits or deletes anything in QuickBooks.

5. Information we store

• The merchant's settings: first day to record, chosen QuickBooks accounts, decisions (accounts chosen for unusual payout lines, skipped items and their reasons), notification email and optional accountant email.
• A record of what was posted (item references, entry numbers and dates) so nothing is posted twice, and the items waiting for the merchant with their explanation.
• Access details: the access token Shopify gives the app and the QuickBooks connection tokens.
• Technical logs on our server (such as requests and errors), kept for a short period to run and secure the service.

6. How we use information

Only to provide the app: recording the store's activity in the merchant's QuickBooks company, showing what needs attention, sending the merchant at most one summary email a day, and providing support. Legal bases: providing the service the merchant signed up for (contract), the merchant's instructions, and our legitimate interest in running a secure service. We do not sell or share information, use it for advertising, or build profiles. We do not make automated decisions about people.

7. Service providers

• Hetzner Online GmbH (European Union, Germany): hosting of the app and its database.
• Brevo (Sendinblue SAS, European Union, France): delivery of the emails the app sends (the daily summary and alerts).
• Intuit (QuickBooks Online): the merchant connects their own QuickBooks company under their own agreement with Intuit. Data written to QuickBooks is held by Intuit under that agreement.
• Shopify: the platform the app runs on. Shopify's own privacy policy applies to data held by Shopify.

Data we store is kept in the European Union. Data written to QuickBooks is held by Intuit under the merchant's own agreement with Intuit.

8. How long we keep information

• Store data is kept while the app is installed.
• When the merchant uninstalls the app, its QuickBooks access is revoked and its Shopify access is removed at once; all data stored for that store is deleted when Shopify asks us to (within 48 hours of uninstalling).
• Entries already written to QuickBooks belong to the merchant and stay in their QuickBooks company.
• Backups are kept for a short period and then overwritten.

9. Security

Data travels over encrypted connections (HTTPS). Shopify access tokens and QuickBooks connection tokens are encrypted in the database with AES-256, with the key kept separately from the database. Access to the server is restricted, and data is backed up regularly.

If a security incident affects personal data, we will inform the affected merchants without undue delay and, where the law requires, within 72 hours of becoming aware of it.

10. Your rights

Depending on where you live (for example under the GDPR in the European Union or state laws in the United States), you may have the right to access, correct, delete or receive a copy of your personal data, and to object to or restrict its use. Merchants can write to us at contact@lúméa.com. You can also complain to your data protection authority.

11. Cookies

Our website uses no advertising or tracking cookies. Inside Shopify, the app uses the session token Shopify provides to know which store is signed in.

12. Children

The app is a business tool and is not directed at children.

13. Changes to this policy

We may update this policy as the app evolves. The date at the top shows the latest version; significant changes are announced in the app or by email.