Privacy Policy

Last updated 14 September 2026

This policy covers the applications operated by Hodolist: AI Disclosure (Shopify) and the UAE e-Invoicing Bridge (Stripe and Shopify). Contact: puspalatha@hodolist.com.

What we collect

AI Disclosure

Your store domain and an offline access token, used to authenticate API calls.
Product and media identifiers you mark as AI-generated, plus your disclosure settings.

AI Disclosure does not collect buyer personal data. Storefront disclosure badges render from theme assets and do not call our servers.

UAE e-Invoicing Bridge

Connection credentials for Stripe, Shopify and your appointed accredited service provider (ASP), encrypted at rest.
Invoice, credit note and customer records required to build a compliant e-invoice: legal names, tax registration numbers, addresses, line items, tax amounts and payment status.
An immutable audit trail of validation results, submissions and status changes.

We do not collect or store card numbers or other payment instrument data. Stripe and Shopify retain that; we only read invoice-level amounts.

Why we process it

Solely to provide the service you installed: to render AI transparency disclosures, and to convert, validate and transmit e-invoices to the ASP you appoint. We do not sell personal data, and we do not use your data to train machine-learning models.

Who we share it with

Your appointed ASP — receives the e-invoice so it can report to the Federal Tax Authority and deliver to your buyer over Peppol. The ASP is an independent controller for that transmission.
Infrastructure providers — Fly.io (application hosting, Frankfurt) and Neon (database, Frankfurt). Both are bound by data processing terms.

We share nothing else with anyone, for any purpose.

Where it is stored

Data is processed and stored in the European Union (Frankfurt). If your jurisdiction requires in-country residency, contact us before installing.

How long we keep it

E-invoice records and their audit trail are retained for the statutory tax record-keeping period applicable to your business (in the UAE, at least five years). Everything else is deleted within 90 days of uninstalling the app. Uninstalling revokes our access tokens immediately.

Your rights

You can request access to, correction of, export of or deletion of your data by emailing puspalatha@hodolist.com. We respond within 30 days. Requests to delete records still inside a statutory retention window are honoured once that window closes. Shopify's mandatory customers/data_request, customers/redact and shop/redact webhooks are implemented and honoured.

Security

Credentials are encrypted with AES-256-GCM before storage. All traffic uses TLS. Access is scoped per tenant and role, every webhook signature is verified, and administrative actions are written to an append-only audit log.

Changes

We will post any change on this page and update the date above. Material changes affecting how we process your data will also be emailed to the contact on your account.

The UAE e-Invoicing Bridge is not an accredited service provider and is not endorsed by the UAE Ministry of Finance or Federal Tax Authority. Regulated transmission is performed by the ASP you appoint. Nothing here is tax or legal advice.