Privacy Policy

Last updated: August 5, 2026

btodigital Facturas Siigo ("the App") is developed by btodigital (Sociedad de Profesionales Expertos SPE S.A.S., Medellín, Colombia) and integrates Shopify stores with the Siigo accounting platform to automate catalog sync, electronic invoicing to Colombia's tax authority (DIAN) and inventory reconciliation. This policy explains what data the App collects, how it is used, who it is shared with and the rights you have over it.

1. Data we collect

When you install the App on your Shopify store, we access the following data via the Shopify Admin API:

• Store data: domain (`shop.myshopify.com`), owner email, name, currency and timezone.
• Products and variants: title, SKU, price, available inventory and locations.
• Orders: number, amount, payment and fulfillment status, line items (with SKU) and billing information.
• Customers (limited to orders): name, email, phone, billing address, and tax ID type/number when present in `note_attributes` or `billing_address.company`.
• Refunds: amount, affected lines and associated original invoice.

Additionally we store the Siigo account credentials (username and access key) you enter manually so the App can issue invoices on your behalf. These credentials are encrypted with AES-256-GCM before being stored, using a master key held in Google Cloud Secret Manager.

The App does not collect browsing data, third-party cookies, or device information beyond the Shopify OAuth session required to authenticate you in the embedded admin panel.

2. How we use the data

• Sync products and variants from Shopify to your Siigo account, using SKU as the unique identifier.
• Issue electronic invoices and credit notes in Siigo from Shopify orders and refunds.
• Send issued invoices to DIAN when configured.
• Reconcile inventory between both platforms.
• Log sync activity for diagnostics and support.

We do not use your data for advertising, AI model training, aggregate analytics with third parties, or any purpose other than operating the App.

3. Who we share data with

• Siigo (siigo.com) — receives the information needed to create parties, products and invoices in your account. Siigo acts as an independent controller of the data stored there.
• Google Cloud Platform (Google LLC) — provides compute (Cloud Run) and database (Firestore) infrastructure in the `us-central1` region (Iowa, USA).
• DIAN (Colombia's tax authority) — receives electronic invoices when sending is authorized, through Siigo's official channel.

We do not sell, rent or transfer your data to any other third party. We do not transfer data outside these recipients except under a legal request from a competent authority.

4. Retention and deletion

We keep data while the App remains installed on your store. When you uninstall:

• We receive the app/uninstalled webhook and immediately revoke access.
• Within 30 days we permanently delete all data associated with your store, unless legally required to retain it.
• You may request earlier deletion by writing to siigo@btodigital.com.

We also honor Shopify's GDPR webhooks: customers/data_request, customers/redact, shop/redact.

5. Your rights

Under Colombia's Law 1581/2012 (Habeas Data), the EU General Data Protection Regulation (GDPR) and equivalent laws, you have the right to:

• Access, update and rectify your data.
• Request deletion of your data.
• Request a copy of the data we hold about you.
• Withdraw your consent to processing.
• File complaints with Colombia's Superintendency of Industry and Commerce or the applicable data-protection authority.

Exercise any of these rights by writing to siigo@btodigital.com. We respond within 15 business days.

6. Security

• All traffic between your store, the App and Siigo runs over HTTPS with TLS 1.2+.
• Siigo credentials are encrypted at rest with AES-256-GCM.
• Database access is restricted to the App's runtime service account (deny-all for public clients).
• Keys and secrets live in Google Cloud Secret Manager with access auditing.

7. Minors

The App is intended for merchants and does not knowingly process minors' data. If you detect that a minor's data is being processed, contact us and we will delete it.

8. Changes to this policy

We may update this policy. When we do, we update the "last updated" date at the top of the document and, if the change is material, we notify the installed store owner by email.

9. Contact

btodigital — Sociedad de Profesionales Expertos SPE S.A.S.
Contact email (privacy & support): siigo@btodigital.com
Website: btodigital.com