Invoice Bridge privacy notice

Invoice Bridge is provided by Robert Collie, operating as Fortylights, in Texas, United States. For support and privacy requests, contact rob@fortylights.com.

Invoice Bridge connects an authorized Shopify store with a Pipedrive company. It processes buyer names, email addresses, phone numbers, delivery addresses, order and invoice lines, payment results, refunds, staff assignment identifiers, approval requests and decisions, and optional tax exemption certificates. Shopify provides checkout and card processing. Invoice Bridge does not collect card numbers or security codes.

We use these records to prepare and send requested invoices, match purchases to the correct CRM records, reconcile payments, prevent duplicates, assign follow-up work, enforce the merchant's invoice rules, provide support and answer privacy requests. This application does not use buyer records for advertising, data brokerage or unrelated model training.

The merchant decides which store and company to connect, which employees can invoice, who approves invoices, and which customer records are used. Invoice Bridge acts on the merchant's lawful instructions. The merchant must have the required authority, notices, and permissions. Shopify and Pipedrive keep their own source records under separate agreements. The Subprocessor Register identifies hosting and mail providers. The current app host is DreamHost; its supporting processing is not promised to be limited to the United States.

Fortylights also handles business account information to administer the service, document acceptance, provide support, resolve disputes, and meet legal obligations. An acceptance receipt records the workspace, verified administrator identifier and platform, document version and hashes, and time. It does not require buyer records, payment-card details, or an extra IP-address history. Full store erasure removes the workspace's app-held acceptance records. A merchant may download its own copy.

Each store/company pair has separate connection credentials, encrypted ledger files and encrypted app backups. Shared event bodies, privacy exports, and acceptance receipt details are encrypted. The server checks current Pipedrive membership and applicable deal ownership for panel access. Regular users cannot change company policy or accept the service agreement for the company. Each user authorizes their own Pipedrive app access; a team member's authorization does not replace the company service connection. The Security Overview describes the tested controls and release checks. We use reasonable safeguards; no system guarantees that an incident, outage, or loss can never occur. Disclaimers do not remove mandatory security, privacy, or reporting duties.

Invoice Bridge keeps app-held buyer details for 90 days after an invoice or order is verified as resolved. Open payments, fulfillment, returns, disputes, and records with unverified resolution remain available for review. A later Shopify update can reopen the record or move the cleanup date. We keep the minimal Shopify and Pipedrive references and financial metadata needed to prevent duplicate records and reconcile later updates. The scheduled cleanup does not change records kept by Shopify or Pipedrive. Billing cancellation alone does not erase records or prevent reconciliation of earlier transactions.

App-managed ledger backups are encrypted and have a configured 14-day retention period. An applicable redaction or age-based cleanup removes app-managed backups that could restore the removed details. DreamHost's unmanaged VPS does not include automated backups. Any infrastructure recovery copies that DreamHost maintains are governed by its service terms and data-processing addendum. The 14-day period above applies to Invoice Bridge's own backups. Completed erasure requests must be reapplied before resuming ordinary processing from a backup. Privacy export results expire after 24 hours. Certificate download links expire after 60 seconds and one use. The app keeps access audit records for 90 days, using staff and workspace identifiers, operation, time, and result, without including buyer details or download links.

For a Shopify customer data request, the authenticated merchant administrator can retrieve app-held records for that request. Customer redaction removes matching local contact details, addresses, certificates, invoice details, approval records and affected pending payloads. It also removes local app backups that could restore the deleted details. Minimal order, deal and payment reference records can remain for duplicate prevention and reconciliation. These references can still identify someone when joined to the merchant's other records. We keep those references while the workspace is active to reconcile transactions and prevent duplicates. Store erasure removes the app-held workspace records, subject to any legally required retention. Outstanding invoices, goods orders or shipments affected by erasure require review in Shopify.

Uninstalling Shopify revokes store access and stops processing. Shopify's later store-erasure request removes the installation's local credentials, ledger, certificates and app backups after the platform's delay, unless the merchant reinstalls first. Removing an individual Pipedrive user's app access revokes only that user. Removing the company service installer disconnects the CRM connection. The app does not automatically erase source orders or CRM records in Shopify and Pipedrive.

Buyers should direct requests to the merchant they bought from. Merchants and staff can contact rob@fortylights.com about app-held records. We verify identity and authority before disclosure and will assist with applicable access, correction, deletion, and other rights. You may also complain to the appropriate regulator. The service terms do not waive rights that cannot legally be waived. Material changes will be announced through the app or an appropriate account contact. A Privacy Notice acknowledgment is not permission for unrelated marketing or processing.