Privacy policy · LG Factura México

Last updated: 8 October 2026

This policy explains which personal data the LG Factura México app for Shopify (the “app”) processes, why, and for how long. The app issues the digital tax receipts (CFDI 4.0) for the store's orders, has them stamped by a SAT-authorised certification provider (PAC) and sends them to customers.

1. Controller and processor

Controller: the merchant (the Shopify store that installs the app), who decides to process its own customers' data and sets the purpose.

Processor: the app developer, which processes the data on the merchant's behalf and only to provide the service:

2. Data the app processes

Customers' tax details for invoicing

• RFC (tax ID), name or company name, tax regime and tax address postal code.
• The CFDI use stated by the customer.
• Email address, to send the receipt.
• Order number, products, amounts, taxes and payment method of the purchase.

Customers give their tax details on the order thank-you page, in their account or in the store's self-invoicing portal. If they don't, the purchase is included in the period's global invoice to the general public, without their details.

Store data

• The merchant's tax details, shown as the issuer of the receipts.
• The merchant's digital seal certificate (CSD) and its password, needed to seal the CFDI. The private key and the password are stored encrypted (AES-256-GCM) with a key only the server holds; they are never shown or downloadable and are only used to seal that store's receipts.

Shopify permissions

• read_orders and write_orders: read orders, cancellations and refunds to issue CFDI and credit notes, and note the tax folio on the order.
• read_customers and write_customers: read and save the customer's tax details so they aren't asked for on every purchase.
• read_products: read products to classify them in the CFDI.
• Customer account permissions: customers view and download their receipts from their account.

The app does not use tracking or advertising cookies and does not profile customers.

3. Purpose and legal basis

Data is processed to issue, stamp, send, cancel and keep the merchant's tax receipts. This is needed for the merchant to meet its tax obligations (Federal Tax Code, arts. 29 and 29-A) and to perform the customer's purchase, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties and, as regards the developer, the EU General Data Protection Regulation (art. 6.1.b and c).

4. Storage and security

• Data is stored on servers located in the European Union.
• A stamped CFDI is never modified: if it is wrong, it is cancelled and replaced, as the SAT requires.
• All traffic is encrypted with TLS/HTTPS. Each receipt's download link carries its own random code.

5. Recipients

• The authorised certification provider (PAC) that stamps the receipts and forwards them to Mexico's Tax Administration Service (SAT) (legal obligation).
• Shopify, the platform the store runs on.
• The email provider the app uses to send the receipts.

Personal data is not sold or shared with third parties, nor used to train AI models.

6. Retention

CFDI are part of the merchant's accounting records and are kept for 5 years (art. 30 of the Federal Tax Code). During that period they cannot be deleted, not even at the customer's request or if the store uninstalls the app. After it, they are deleted automatically.

The store's settings and CSD are deleted when Shopify reports the store's removal (48 hours after uninstalling the app).

7. Your rights

Anyone may exercise their rights of access, rectification, cancellation and objection (ARCO rights), as well as erasure, restriction and portability. As the merchant is the controller, the main route is to contact the store where the order was placed. The app implements Shopify's compliance webhooks:

• customers/data_request: the customer's receipts are located so the merchant can provide them. Customers also see them in their account.
• customers/redact: receipts are not deleted while they must be kept; the request is recorded and the customer's email is removed from each receipt once its period ends.
• shop/redact: the store's settings and CSD are deleted; receipts are deleted when their retention period ends.

You can also write to soporte@lineagrafica.es or to the data protection officer at dpo@lbo-abogados.com.

8. International transfers

The app is hosted in the European Union, and receipts are sent to the PAC and the SAT in Mexico for stamping, which is essential to issue them. Shopify may process data in other countries under its own contractual safeguards.

9. Changes to this policy

If the processing changes, this page will be updated along with the date at the top. Previous versions are available on request at the support address.