Privacy Policy

Last updated 17 July 2026.

The short version

TrueUp reads the limited Shopify order, gift-card and payout data needed to match your books and show known balances that need your accountant's attention. Everything we collect supports that one job, and nothing else. Specifically:

• Our queries do not request customer names, email addresses, phone numbers or postal addresses, and TrueUp does not store them. We do read limited order details, such as identifiers, dates, amounts, tax, line-item titles and transaction data, because the payout cannot be matched accurately without them.
• We never sell your data. Never have, never will.
• Uninstall and your operational data is erased automatically. TrueUp stops receiving Shopify data and stops running when you uninstall. Its operational data and encrypted accounting-connection credentials remain stored during Shopify's 48-hour grace window so a quick reinstall can resume; when Shopify sends its deletion signal, TrueUp revokes those accounting connections and erases the records. We retain a limited billing-policy record linked to your shop domain so trial and discount eligibility works as intended; it contains no payout, order, accounting or customer data.
• Everything is encrypted, both moving and at rest, and one merchant's data is walled off from every other merchant's at the database level, not just in our application code.
• No dark patterns. No pre-ticked marketing boxes, no consent-gated features.

1. What TrueUp uses to match payouts

1.1TrueUp connects to Shopify, and to QuickBooks Online or Xero, using scoped permissions, meaning we ask for exactly what the job needs and nothing else.

1.2What we access:

• Your shop's Shopify Payments payout and balance-transaction data (the fees, refunds, and adjustments that make up a payout). This is the core of the product.
• Limited order details needed to split those payouts correctly, including order identifiers, dates, amounts, tax, line-item titles and transaction data.
• Gift-card expiry status and remaining balances, used only to show the total expired balance that needs your accountant's attention. TrueUp stores the count and balance by currency, not individual card, customer or order details.
• Your shop's basic details (name, domain, currency, plan) needed to run the app.
• Your chart of accounts in QuickBooks Online / Xero, so we can post the matching journal entry.
• Billing information, handled entirely by Shopify's own Billing system. TrueUp never sees your card details.

1.3What our product queries don't request, and what we don't store:

• Your customers' names, email addresses, phone numbers or postal addresses. TrueUp's queries do not request these fields, TrueUp does not store them, and the app does not request Shopify's read_customers scope. It uses limited order data under read_orders because amounts, tax and transaction details are needed to reconcile payouts accurately.
• Your storefront, your marketing lists, your customers' payment methods.
• Anything beyond the payout and accounting data needed to do the one job you hired us for.

Specifically:

1.4The Shopify Admin API scopes TrueUp requests are limited to payout/order data and app-management scopes. The full list is visible in the app's listing and install-consent screen, so you don't have to take our word for it.

2. What we collect, and why

Specifically:

2.1The table above names the UK GDPR legal basis for each purpose. The full technical catalogue (every event, its legal basis, and its exact retention window) is written down in our engineering documentation and available on request.

3. How long we keep it

3.1While you're a merchant: operational account data is kept for as long as your account is active, so the product keeps working. The shorter diagnostic and product-usage windows below still apply while your account is active.

3.2When you uninstall: Shopify access ends and TrueUp stops running immediately. Your operational data and encrypted accounting-connection credentials remain stored during Shopify's grace window; when its deletion signal arrives around 48 hours later, TrueUp revokes those accounting connections and erases the operational records. That gap is Shopify's grace window, and it works in your favour: reinstall inside it and everything picks up where you left off, no re-setup. Either way it's well inside the 30 days GDPR and Shopify's own rules allow. We don't sit on it "just in case."

3.3Backups: erased means erased from our live systems on the schedule above. Encrypted database backups exist so we can recover from a disaster; they expire on a rolling basis, so anything erased is gone from those too within a further 7 days.

3.4Anonymous usage data: identified only for a rolling window (45 days for most product-improvement data, 90 days for the technical logs that help us catch outages), then permanently and irreversibly stripped of anything that could point back to your shop. After that, it's just a number in an aggregate, not a record about you. Technical page-performance measurements are never stored with a shop or user identifier and are deleted after 35 days; their daily count and p75 snapshots contain only aggregates.

3.5Matching diagnostics: copies of payout data, posting failures, and changes to entries TrueUp added to your books are kept for up to 90 days, then deleted. This is the window in which TrueUp can replay a payout, investigate a posting problem, or learn from a correction you made.

3.6The limited record we keep after uninstall: a billing-policy record linked to your shop domain. It records trial eligibility and any operator-set discount terms so those offers work as intended if the shop returns. It contains no payout, order, accounting or customer data.

Specifically:

3.7Retention windows above are enforced by an automated daily process, not a manual "someone remembers to delete it" step. Shopify's data-erasure signal (the shop/redact webhook, sent 48 hours after uninstall) triggers the purge the moment it arrives, ahead of Shopify's own 30-day deadline.

4. Security: the actual mechanics, not just a promise

4.1Encrypted in transit. All traffic to TrueUp runs over HTTPS/TLS, enforced automatically, with plain HTTP traffic redirected before it ever reaches us. This is also a Shopify requirement for any app running inside its admin.

4.2Encrypted at rest. Your data is stored on infrastructure that encrypts the underlying disks by default (AES-256). On top of that, the credentials that let TrueUp talk to your QuickBooks Online or Xero account are separately encrypted at the application level (AES-256-GCM) before they ever touch the database, so even a raw database backup doesn't hand over usable login credentials.

4.3One merchant's data can't leak into another's. This is enforced by the database itself, not just by our application's code remembering to filter correctly. Every query against your data is scoped to your shop at the database level: a bug in our code that forgot to filter by shop would get zero rows back, not someone else's rows.

4.4No back door. There's no admin panel, no "view as merchant" tool, no support-impersonation feature. The database itself is locked to internal traffic only. Reaching it from outside requires deliberately, temporarily opening access, which is logged.

Specifically:

4.5Encryption at rest and RLS enforcement details are available to a security reviewer on request. We don't publish exact infrastructure configuration publicly, for the obvious reason that doing so would only help an attacker, not a merchant.

5. Who can see your data

5.1Today, that's a small team (currently one person). There's no separate "support staff" with a different, wider view of your data than what's needed to answer your email. If we ever grow, this section gets updated before it happens, not after.

5.2Two different kinds of company touch your data, and the difference matters.

5.3The platforms you connect. Shopify, and QuickBooks Online or Xero. These aren't suppliers working for us: they're your platforms, handling your data under their own privacy policies. Connecting them to TrueUp is your instruction for us to exchange data with them: we read payout data from Shopify, and we post journal entries to your books.

5.4The services working for us. Our processors. They handle data on our instructions, under contract, and each only sees what its specific job needs:

5.5For everything described in this policy, the data controller is TrueUp Limited (details in §7).

5.6We do not use any third-party advertising, analytics-for-ads, or data-broker service. There is no tracking pixel, no ad network, nothing sold or shared for marketing purposes, to us or by us. We do not use analytics cookies or track you across sites. Shopify's embedded app measures technical page performance. TrueUp keeps an intentionally stripped-down copy containing the metric, its value, a one-use deduplication hash, and a broad app area so we can spot slow pages. It does not include your shop, identity, customers, business figures, or the page address.

5.7If something goes wrong and your data is affected by a security breach, we'll tell you promptly, not wait for you to ask.

6. Your rights

6.1Export. Ask and we'll give you a copy of your data in a usable format.

6.2Delete. Uninstall the app and erasure of your operational data happens automatically: Shopify access and product operation end immediately, then accounting connections are revoked and erasure follows at the 48-hour mark (§3). Ask sooner and we'll erase it sooner. The limited billing-policy record in §3.6 is retained separately as described there.

6.3Correct. If something we hold about you is wrong, tell us and we'll fix it.

6.4Pause. While we're sorting out a correction or an objection, you can ask us to restrict what we do with your data in the meantime.

6.5Object. You can object to our use of matching diagnostics and product-usage data under legitimate interests. Tell us and we'll stop that processing for your account.

6.6Complain. If you think we've got this wrong, you can complain to the UK Information Commissioner's Office (ico.org.uk). We'd rather you told us first, but it's your right either way.

6.7None of the above requires a form, a retention specialist, or a "why are you leaving" survey. Email privacy@trueup.shop.

7. Where your data lives (and when it leaves)

7.1TrueUp's infrastructure runs in the EU (Frankfurt). TrueUp Limited is a UK company, registered in Scotland, No. SC894246, registered office 51 Penicuik Drive, Glasgow, Scotland, G32 6FD.

7.2Render, Sentry and Resend are US companies. Each handles data for TrueUp under its standard data-processing agreement, which contains the processor terms required by Article 28 of the UK GDPR: the Render DPA, the Sentry DPA and the Resend DPA.

7.3For transfers to the US, we rely on the UK Extension to the EU–US Data Privacy Framework where it applies. The agreements also incorporate the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum where that adequacy route does not apply.

7.4The platforms you connect, Shopify, Intuit (QuickBooks Online) and Xero, are global businesses. When you connect them, your data flows to them wherever they operate, under their own privacy policies.

8. Changes to this policy

If this changes in a way that matters, we'll email you directly, not just update the date at the top of this page.

9. Contact

privacy@trueup.shop (read by a human, not a ticketing queue).