Privacy Policy

VATShift (the “Service”) is operated by First Penguin Apps (“we”, “us”). We act in two different roles under the EU General Data Protection Regulation (GDPR), depending on whose data is involved:

• for data about you and your business (your account, settings, and subscription), we are the data controller;
• for data about your own customers that we process to decide and document the VAT treatment of an invoice, you are the data controller and we act as your data processor — see Section 4.

You can reach us at firstpenguinapps38@gmail.com.

Your business account data (we are the controller)

When you connect your CRM account, we receive and store:

• your CRM account identifier, and API tokens (encrypted at rest) that let the Service act on your behalf;
• your business's own VAT country and VAT number, the legal wording template used on invoices, which field on your customer records holds their VAT number, and your credit note numbering settings;
• your subscription plan, as reported by your CRM platform's billing system — we do not collect or process payment card details ourselves.

Your customers' data (you are the controller, we are the processor — see Section 4)

To decide whether an invoice qualifies for the reverse charge and to produce the documents involved, we receive and store the following about your customer, sourced from your CRM account:

• company name, address, and country;
• VAT number, and the outcome of checking its format;
• a record of each invoice we evaluated, the determination made, and — where applicable — a credit note document (stored as a file, together with the transaction details it describes) that you can download to send to your customer yourself.

The Service uses only strictly necessary cookies: one that keeps you signed in, and a short-lived one used while a new connection is being completed. We do not use analytics, advertising, or tracking cookies, and we do not send email to your customers ourselves — any document we produce is one you download and send.

For your business account data, where we are the controller:

• To provide the Service — connecting to your CRM, determining and applying the reverse charge, producing credit notes, and managing your subscription (performance of a contract, Art. 6(1)(b) GDPR);
• To operate and secure the Service — error logging and abuse prevention (legitimate interests, Art. 6(1)(f) GDPR);
• To meet legal obligations — bookkeeping and tax records relating to payments (Art. 6(1)(c) GDPR).

For your customers' data, we do not rely on our own legal basis: we process it strictly on your instructions, as your processor, and it is your responsibility to have a lawful basis (typically your existing business relationship with that customer) for sharing that data with us. See Section 4.

Where we process your customers' personal data (Section 2) to determine and document the VAT treatment of an invoice on your behalf, we commit to:

• process that data only on your documented instructions — as configured in your account settings and as necessary to run the Service you have subscribed to — and not for our own purposes or those of any other customer;
• keep it confidential and limit access to personnel and sub-processors who need it to provide the Service;
• apply appropriate technical and organizational security measures, including encryption of stored access credentials, a private (non-public) file store for credit note documents, and tenant-level data isolation;
• use the sub-processors listed in Section 6 to help provide the Service, and remain responsible for their processing of your customers' data;
• assist you, to the extent reasonably possible, in responding to requests from your customers who wish to exercise their GDPR rights, and in meeting your security, breach-notification, and data protection impact assessment obligations;
• notify you without undue delay if we become aware of a personal data breach affecting your customers' data;
• delete your customers' data on your request, and make it available to you on request beforehand;
• make available to you the information reasonably necessary to show that we meet these commitments, and allow for and contribute to audits carried out by you or an auditor you appoint — on reasonable notice, and no more than once a year unless a supervisory authority requires otherwise;
• tell you in advance if we intend to add or replace a sub-processor, so that you have a reasonable opportunity to object.

These commitments, together with this Privacy Policy, form the data processing terms between you and us for this data; see also Section 7 of the Terms of Service.

• While your CRM account is connected, we keep the business account data and customer data needed to provide the Service.
• If you disconnect the Service, your business account data and your customers' data are retained so that reconnecting restores your settings and history. You can ask us to delete them at any time by contacting us.
• Records we must keep for accounting or tax purposes are retained for the statutory periods required by applicable law.

We use the following service providers to run the Service. They process data on our behalf under data-processing agreements:

• Supabase — database and file storage hosting (our database and the credit note documents we generate are hosted on Supabase infrastructure, which may be located in the United States);
• Vercel — application hosting and delivery;
• Your CRM platform — the platform your data originates from and, where applicable, is written back to (invoice updates), and which handles billing for your subscription to the Service.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

Some of our processors store or process data outside the EU/EEA, in particular in the United States (for example, Supabase database and file storage hosting, and Vercel infrastructure). Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework adequacy decision.

If you are a business using the Service, under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased (“right to be forgotten”);
• restrict or object to certain processing;
• receive your data in a portable format.

To exercise these rights, contact us at firstpenguinapps38@gmail.com. You also have the right to lodge a complaint with a supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY, imy.se) — or with the authority in your country of residence.

If you are a customer of a business using the Service and wish to exercise your rights over your own data (company name, address, or VAT number), please contact that business directly — they are the data controller for that data, as explained in Section 4. We will assist the business in responding to your request.

We may update this policy from time to time. Material changes will be announced in the app before they take effect. The date at the top of this page shows when it was last revised.

First Penguin Apps · firstpenguinapps38@gmail.com