Privacy Policy

Scope and legal basis

TicoSync is designed for merchants operating in Costa Rica and is structured to align with Costa Rica's personal-data framework, including Ley No. 8968 (Protección de la Persona frente al Tratamiento de sus Datos Personales) and its regulations under Decreto Ejecutivo No. 37554-JP and related reforms.

When TicoSync processes customer and order data on behalf of a merchant, the merchant remains responsible for the underlying commercial relationship and for having an appropriate legal basis to collect and use that data. TicoSync acts as a service provider and technical processor for those workflows. For direct website inquiries and account-level communications, TicoSync may act as the data controller.

Data we process

• Merchant account and configuration data, such as issuer details, store identifiers, signing settings, and support contact information.
• Order and document data, such as order numbers, order notes, document types, Hacienda statuses, PDFs, XML files, and related logs.
• Customer data included in Shopify orders or needed for legal documents, such as name, email address, billing details, identification number, and delivery or tax address data.
• Technical and security data, such as IP-related logs, request metadata, webhook events, and troubleshooting records needed to keep the service secure and operational.

Purposes of processing

• Generate, sign, submit, store, resend, and display legal tax documents required for Costa Rican electronic invoicing.
• Provide merchant configuration, analytics, order-status visibility, and troubleshooting support inside the embedded app and related static pages.
• Send customer-facing messages and attachments requested by the merchant, including accepted invoice documents and export-invoice PDFs where applicable.
• Maintain audit trails, fraud prevention, system integrity, and compliance evidence.

Sharing and transfers

TicoSync may share or route relevant data to service providers and platforms strictly as needed to provide the service, including Shopify, Costa Rican electronic invoicing systems and tax endpoints, email-delivery providers, file-storage providers, and infrastructure providers.

Where data is stored or processed outside Costa Rica, TicoSync aims to use commercially reasonable safeguards and contractual controls appropriate to the service. Merchants remain responsible for disclosing cross-border processing in their own customer-facing privacy notices when required.

Retention and security

Accepted tax XML, Hacienda responses, and related PDFs are retained for five years from issuance unless a longer legal hold applies. Temporary accounting exports expire after seven days, compliance-event records after 90 days, and operational request locks after their short configured lifetime. Signing credentials are retained while the service is active and are deleted when replaced, on uninstall, or on shop-redaction, subject to encrypted backup recovery periods. Merchants remain responsible for maintaining their own legally required archive.

TicoSync uses technical and organizational safeguards designed to limit unauthorized access, alteration, disclosure, or loss. No online system can guarantee absolute security, so merchants should avoid storing unnecessary sensitive information in order notes or free-text fields.

Service providers

TicoSync currently uses Amazon Web Services for application hosting, databases, encrypted storage, and backups; Shopify for commerce and order data; and Resend for transactional email. Electronic tax documents and required identity data are transmitted to Costa Rica's Hacienda systems as directed by the merchant. Infrastructure may be processed in the United States.

Read the Data Processing Addendum

Your rights under Costa Rican law

Consistent with Ley 8968, data subjects may request access, rectification, updating, cancellation, or opposition regarding personal data when applicable. Because TicoSync often processes order data on behalf of a merchant, requests about store-customer data should normally be directed to the merchant first. TicoSync will reasonably assist merchants with valid requests where appropriate.

If you believe your data has been handled improperly, you may also have the right to escalate a complaint to Costa Rica's data-protection authority, PRODHAB, subject to applicable procedures.