Privacy policy — Lilya: House Accounts for POS

This policy describes how Lilya: House Accounts for POS (“the app”) handles data when a Shopify merchant installs and uses it. The app is made by Lilya Work. Contact: support@lilya.work.

Who this applies to

The app is used by merchants and their staff in the Shopify admin and in Shopify POS. It lets staff charge POS sales to a customer’s house account, shows each account’s balance, credit limit and aging, and produces customer statements. The merchant decides which customers have an account. The customers whose accounts are managed with the app are the merchant’s customers; the merchant is responsible for their relationship with them, and the app processes their data on the merchant’s behalf.

Data the app accesses

When you install the app you grant it the Shopify permissions read_orders, read_customers, write_customers, write_draft_orders, read_payment_terms, write_payment_terms, write_merchant_managed_fulfillment_orders and read_locations. With them the app:

• Reads customers who have a house account, and customers you search for in the app: customer ID, name and e-mail address. It does not read addresses, phone numbers or payment card details. Staff can search for a customer, or match a row of an imported limits file, by a phone number they type; that number is only used to find the customer in Shopify and is never stored or shown by the app.
• Reads those customers’ orders that still have an amount outstanding: order number, date, totals, outstanding amount, payment terms and due date. These are summed into the account balance and the aging buckets (0–30, 31–60, 61–90 and over 90 days).
• Saves each customer’s credit limit in your own Shopify store, as app data on the customer (a customer metafield), not on our servers.
• When staff tap “Charge to account” in POS, creates the sale in your store as an unpaid order with payment terms (for example Net 30), the optional PO number and the tag “house-account”, and, if the items leave with the customer, fulfils it from the till’s location.
• Reads your store’s name, currency and locations, to show amounts and to assign stock to the right location.

Payments stay in Shopify: when a customer pays, staff collect the payment on the order in Shopify or Shopify POS as usual, and the balance in the app goes down because Shopify’s outstanding amount goes down.

Data the app stores

• Your store’s myshopify.com domain and the access token Shopify gives the app.
• Your plan and trial status.
• One record for each charge made with the POS tile: the Shopify customer ID, order ID and order number, amount and currency, due date, the PO number staff typed, the IDs of the POS location and staff member, the result (charged or refused, with the reason) and the time. This is the account’s audit trail and protects against charging the same sale twice.
• Short-lived locks (a few seconds) that stop two tills from charging the same customer at the same moment.
• One record for each statement or payment reminder e-mail: the Shopify customer ID, whether it was a statement or a reminder, the month or the order it was about, the time and the delivery result. It stops the same e-mail from being sent twice; the e-mail's content and the address it went to are not stored.
• Your statement e-mail settings (monthly statements on or off, reminders on or off, days after the due date).

The app does not store customer names, e-mail addresses, addresses, order line items or payment details on our servers. Names and e-mail addresses are read from Shopify when a page or statement needs them.

Data entered in POS

Staff can type an optional PO number when charging a sale. It is saved on the Shopify order and in the charge record described above. The app does not write it to its logs.

Statement emails

When you send a statement (by hand on any plan, or on the Pro plan automatically on the 1st of each month, all at once, or as a reminder a set number of days after an order’s due date), the app builds it from your Shopify data at that moment and e-mails it to the customer’s e-mail address in Shopify, from notify@lilya.work with your store’s name as the sender and your store’s contact e-mail as the reply-to address. The statement contains your store name, the customer’s name and the open orders with their dates, due dates, PO numbers and amounts, the aging and the total due. It has no tracking pixels and no marketing. The e-mail is delivered through Cloudflare Email Sending; we keep a record that a statement or reminder was sent (customer ID, kind, month or order, date, delivery result), not its content or the address.

How the data is used

Only to provide the app’s features: charging sales to accounts, checking credit limits, showing balances and aging, producing and sending statements, and applying your plan. We do not sell data, use it for advertising, profile customers, or share it with third parties other than the service providers below. The app never decides on its own whether a customer gets credit: you set each credit limit, and the app only refuses a POS charge that would go over the limit you set.

Service providers

• Cloudflare, Inc. runs the app and stores its data (Workers and D1 database, Western Europe), and delivers statement e-mails (Cloudflare Email Sending). Error logs contain your store domain and are kept by Cloudflare for a few days; request logs that could contain customer details are turned off.
• Shopify processes billing through Shopify App Pricing. The app asks Shopify’s Partner API which plan your store is on.

Retention and deletion

• Charge records and statement e-mail records are kept while the app is installed, so the account history stays complete and no e-mail is sent twice.
• When you uninstall the app, its access token is deleted and the app stops working in your store.
• 48 hours after you uninstall, Shopify asks us to erase your store’s data (shop/redact) and the app deletes all charge records, statement records, statement settings and plan data for your store. If you reinstall within those 48 hours, they are kept.
• When Shopify asks us to erase a customer’s data (customers/redact), the app deletes that customer’s charge and statement records.
• When Shopify forwards a customer’s data request (customers/data_request), we send you the records we hold for that customer within 30 days.
• The orders the app created and the credit limits saved on customers are part of your Shopify store. Shopify removes the app’s customer data (credit limits) when the app is uninstalled; the orders stay in your store.

Security

Admin requests are authenticated with Shopify session tokens and POS requests with POS session tokens. Data is sent over HTTPS only and is encrypted at rest by Cloudflare, including backups. The credit limit is checked on our server, not only in POS, before every charge. Only the developer has access to the production systems, with two-factor authentication.

Your rights

You can ask for a copy of the data the app holds about your store, or ask us to delete it before you uninstall, by writing to support@lilya.work. Your customers can contact you, and you can forward their requests to us. You can also complain to the data protection authority where you live.

Changes

If we change this policy we update the date at the top of this page.