Privacy Policy

Last updated: October 18, 2026

Manca: EPR Compliance ("the App") is developed and maintained by Valerio Manca. This policy explains what data the App accesses, how it is used, how it is stored and when it is deleted.

What data we access

The App reads data from your store through the Shopify Admin API. For each order, it reads only:

• Order ID and order number (e.g. #1001) — so you can assign a package to a specific order.
• Processing date — the date the order was processed, used to count it in the right year.
• Shipping country code — the two-letter ISO code of the destination country (e.g. DE, FR, ES), not the rest of the address.
• Order status — whether the order is a test order, whether it was cancelled and whether it requires shipping.

The App also reads the status of your App subscription, to know which plan you are on.

We do not access customer names, email addresses, phone numbers, street addresses, postal codes or payment information.

How we use the data

The data is used only to provide the App's features to you: finding in which countries you may have Extended Producer Responsibility (EPR) obligations, computing a compliance status per country and, if you describe your packaging, calculating packaging weight by country, year and material for your declarations. Test orders, cancelled orders and orders that do not require shipping are excluded from the counts.

What we store

Our database contains, for your shop:

• Scan results per destination country: number of shipments, first and last shipment date, computed compliance status and the number of orders without a shipping country.
• Your packaging data: package names, materials and weights, the dates from which they apply, and which package is your default over time.
• Package assignments to specific orders, if you make them: the Shopify order ID, order date, destination country and assigned package.
• Your seller profile, if you fill it in: the country where your business is established, the countries you ship from and the date you confirmed it.
• Your answer to "How did you hear about us?", if you give one, including any optional free-text detail.
• The technical session that Shopify provides when you install the App (shop domain, access token and granted permissions), needed to call the Shopify API.

We do not store customer names, contact details, addresses or payment information. Individual orders are stored only as Shopify order IDs, and only for the orders you assign a package to.

The database is hosted on Render in Frankfurt, Germany (EU). Our hosting provider also keeps technical server logs (for example, which shop sent a webhook and how many orders were counted during a scan); these logs contain no customer data.

Data sharing

We do not sell, share, or transfer your data to any third parties. Our hosting provider (Render) processes it only to run the App. Your data is visible only to you within your Shopify admin.

Data retention and deletion

Your data is kept as long as the App is installed. When you uninstall the App, the technical session is deleted immediately. 48 hours later, Shopify sends us a shop/redact request and we permanently delete all data stored for your shop.

You can request deletion of your data at any time by contacting us at the email address below.

Privacy requests (GDPR)

The App handles Shopify's mandatory privacy webhooks:

• customers/redact: we delete the package assignments for the orders listed in the request.
• customers/data_request: we do not store customer contact details; if the request concerns orders you assigned a package to, we send you (the store owner) those records (order ID, order date, destination country and package) within 30 days.
• shop/redact: we delete all data stored for your shop, as described above.

Contact

For any questions about this privacy policy or your data, contact:
Valerio Manca — mancavalerio1@gmail.com