Privacy Policy
Last updated: 22 April 2026 · Operator: HOST GATE SRL (Romania), trading as Shopgate.
This Privacy Policy explains how Shopgate("we", "our", the "App"), operated by HOST GATE SRL, a Romanian limited-liability company, processes personal data when Shopify merchants ("Merchants") install and use the App and when the App handles data of the Merchant's customers ("End Customers").
The App is a merchant-operations SaaS for Romanian Shopify stores. Its core functions are (a) generating shipping labels (AWB) via Romanian courier APIs, (b) issuing legally-compliant fiscal invoices (facturi fiscale), and (c) automating related order-fulfillment workflows.
Role under GDPR. For data of End Customers, the Merchant is the data controller and Shopgate is the data processor. Processing is governed by our Terms of Service, which include a Data Processing Agreement (DPA). See /terms.
1. Who we are & how to contact us
- Controller / Processor: HOST GATE SRL, registered in Romania
- Service: Shopgate — https://app.shopgate.ro
- Data protection contact: dpo@shopgate.ro
- Security incident contact: security@shopgate.ro
2. Categories of personal data we process
The data we process falls into two layers: data about the Merchant (our direct customer) and data about End Customers (accessed on behalf of the Merchant through the Shopify Admin API).
2.1 Merchant data
- Account data: name, business email, hashed password (bcrypt cost 12), role.
- Business identification: legal name, tax code (CUI), commercial registry number, registered address, IBAN, bank name — used to render the Merchant's identity on invoices.
- Shop connection metadata: Shopify shop domain, encrypted access token (AES-256-GCM), OAuth scopes, install/uninstall timestamps.
- Third-party credentials that the Merchant chooses to provide: courier API keys (Sameday, Cargus, Fan Courier, DPD), SmartBill credentials, SMTP credentials. These are stored encrypted at rest.
- Audit log entries: action name, entity reference, IP address, timestamp.
2.2 End Customer data
End Customer data is fetched on-demand from the Shopify Admin GraphQL API (version 2026-01) when the Merchant triggers a specific operation. We do not bulk-export, poll or pre-cache End Customer data. The fields used are:
- Name (first + last) — printed on the AWB label and on the fiscal invoice.
- Email— used to deliver the invoice PDF and tracking notification, via the Merchant's own SMTP server or SmartBill, when enabled.
- Phone — passed to the courier API for pre-delivery contact.
- Shipping address — passed to the courier API as delivery destination.
- Billing address — printed on the fiscal invoice, as required by Romanian tax law (Codul Fiscal, Art. 319).
- Order metadata — order ID, line items, monetary amounts — used to populate the invoice and the shipping manifest.
3. Purposes & legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Operate the Merchant's account | Merchant data §2.1 | Art. 6(1)(b) — contract performance |
| Generate AWB shipping labels | End Customer name, address, phone | Art. 6(1)(b) — contract (Merchant↔Shopgate) |
| Issue fiscal invoices (facturi fiscale) | End Customer name, billing address, email, company CUI (if applicable) | Art. 6(1)(c) — legal obligation (Codul Fiscal Art. 319; Legea Contabilității 82/1991) |
| Send tracking notifications | End Customer email, order tracking data | Art. 6(1)(b) — contract |
| Retain fiscal records for tax audit | Buyer name, CUI, registered address (in OrderFiscalBuyerCache), invoice PDFs | Art. 6(1)(c) — legal obligation (10-year retention under Legea 82/1991) |
| Security, fraud prevention, incident handling | Audit log, IP addresses, request metadata | Art. 6(1)(f) — legitimate interests |
4. Retention periods
- Shopify access tokens:for the lifetime of the Merchant's install. Deleted within 48 hours after the
shop/redactwebhook is received (i.e. ~48h after uninstall). OrderFiscalBuyerCacheand fiscal invoice PDFs: 10 years, as mandated by Romanian tax law (Legea Contabilității 82/1991, Art. 25). This legal obligation overrides GDPR erasure for these records, as permitted by GDPR Art. 17(3)(b).- Audit log: 2 years.
- Transient End Customer PII (email, phone, shipping addresses not used for invoicing): not persisted — read from Shopify, passed to the downstream service, discarded within the request lifecycle.
- Merchant account data: kept while the Merchant account is active. Deleted or anonymized within 30 days after account closure, except where a longer retention is required by law.
5. Subprocessors
We share End Customer PII only with the following third parties, and only when the Merchant explicitly enables them in their tenant settings:
| Subprocessor | Purpose | Data shared |
|---|---|---|
| Sameday | AWB generation (courier) | Name, shipping address, phone |
| Cargus | AWB generation (courier) | Name, shipping address, phone |
| Fan Courier | AWB generation (courier) | Name, shipping address, phone |
| DPD Romania | AWB generation (courier) | Name, shipping address, phone |
| SmartBill | Fiscal invoice issuance (optional — only when Merchant enables it) | Name, billing address, email, CUI (if company customer) |
| ANAF (Romanian tax authority) | Public registry lookup of Romanian company identification (CUI only — not personal data) | Company tax code (CUI) |
| Merchant's own SMTP server | Transactional email delivery | Recipient email, message body |
| Hosting infrastructure (EU, Romania) | Server and database hosting | All data at rest (encrypted) |
We do not share data with advertising networks, data brokers, analytics providers, AI/ML training pipelines or any party not contracted by the Merchant.
6. International transfers
All primary processing takes place on infrastructure located in the European Union (Romania). Subprocessors listed above are Romania-based entities (EU). Where a subprocessor transfers data outside the EU, the transfer is covered by the EU Standard Contractual Clauses (SCCs) or an adequacy decision.
7. Security measures
- Encryption at rest: Shopify access tokens and third-party API credentials are encrypted with AES-256-GCM using a per-installation key held in environment variables (never in the database).
- Encryption in transit: TLS 1.2 or higher on all external communication (Shopify API, courier APIs, SmartBill, SMTP, browser ↔ server).
- Encrypted backups: database dumps are encrypted with AES-256-CBC (PBKDF2 key derivation) before being written to disk; the passphrase is stored in a permission-locked file (chmod 600) outside the web root.
- Authentication: Merchant login uses Auth.js with JWT session cookies (HttpOnly, Secure, SameSite=Lax), bcrypt (cost 12) for password hashing, and rate-limited login / registration endpoints.
- Webhook verification: every Shopify webhook is HMAC-SHA-256 verified against
SHOPIFY_CLIENT_SECRETbefore any handler runs. - Tenant isolation: every database query is scoped by
tenantIdat the application layer — cross-tenant data access is impossible. - Staff access: production infrastructure is accessed only via SSH keys; credentials are not shared; no PII is written to application logs.
- Access logging: the
AuditLogtable records sensitive operations (invoice issuance, AWB creation, GDPR webhook events, setting changes that touch PII) with tenant, user, IP and timestamp.
8. Your rights (End Customers & Merchants)
Under GDPR, you have the right to:
- Access the personal data we hold about you (Art. 15)
- Request rectification of inaccurate data (Art. 16)
- Request erasure (Art. 17), subject to legal-retention exceptions (fiscal records kept 10 years per Romanian tax law — Art. 17(3)(b))
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Lodge a complaint with the Romanian supervisory authority (ANSPDCP — dataprotection.ro)
How to exercise rights. End Customers should first contact the Merchant (data controller) from whom they purchased. Merchants can contact us directly at dpo@shopgate.ro.
We also process requests that arrive through Shopify's standard GDPR webhook channel (customers/data_request, customers/redact, shop/redact), fulfilling data export within 30 days and erasure immediately (non-fiscal data), as required.
9. Automated decision-making & profiling
We do not perform automated decision-making with legal or similarly significant effects. We do not profile End Customers. No AI/ML is applied to End Customer data.
10. Children's data
The App is a business-to-business service. We do not knowingly process data of children under 16. Any incidental End Customer data handled via the App is processed under the Merchant's own privacy notice to End Customers.
11. Data breach notification
We will notify affected Merchants within 72 hours of becoming aware of a personal-data breach that is likely to result in risk to individuals, in line with GDPR Art. 33. Merchants, as data controllers, are then responsible for notifying their End Customers and the supervisory authority, where applicable.
12. Changes to this policy
We may update this Privacy Policy. Material changes will be announced to active Merchants by email at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
13. Contact
Questions about this Privacy Policy or about how we process personal data:
- Data protection: dpo@shopgate.ro
- Security incidents: security@shopgate.ro