TrueLanded

Privacy policy

Last updated 14 November 2026.

TrueLanded is a Shopify app that works out the landed cost of imported products, writes it to Shopify, posts matching journals to Xero, and estimates margin per product. This policy explains what data the app handles when a merchant installs it, why, where it is kept, and how it is deleted. Questions go to support@truelanded.com.

TrueLanded is provided by Fabio Henrique Filardi, a sole trader trading as Omega AX Cloud Consulting (ABN 33 857 714 665), based in Queensland, Australia. Our terms of service include the data processing agreement that applies between us and merchants.

What we collect

  • Store details from Shopify: the store's domain, an access token for the Shopify API, and the store owner's email address, which we use to send notices about the service.
  • Acceptance record: which version of our terms the store accepted, when, and the Shopify user ID of the person who accepted.
  • Product data: product and variant titles, SKUs, weights, inventory quantities and cost per item, read from and written to Shopify.
  • Shipments and invoices the merchant enters or uploads: supplier, freight and broker invoices (PDF or image files), the values read from them, and the shipments and cost changes made from them. Invoices can include the names and contact details of people at suppliers and brokers, and sometimes bank details. We store the supplier's business name, invoice details, line items, charges and totals, not those personal details.
  • Order data, for the margin report: products, quantities, prices, discounts, refunds, dates and order IDs. We do not request customer names, email addresses, phone numbers or addresses, and order data is not stored. The report is calculated each time it's opened.
  • Privacy requests from Shopify: when a store's customer asks for their data or its deletion, Shopify sends us the customer's identifiers. We use them only to check for records and respond, and we don't keep them.
  • Xero connection, if the merchant connects Xero: OAuth tokens (encrypted at rest), the organisation name, the chart of accounts and tracking categories, and the journals we post.
  • Plan and usage counts: the store's plan and how many invoices were read each month, for plan limits.
  • Support emails: your name, email address and what you write to our support address. Support is for questions about the app, so please don't email invoices, bank details, passwords or your customers' details. If you do, we delete them as soon as we see them.
  • Website visits: this website has no analytics or cookies. Like any website, our hosting providers see visitors' IP addresses and browser details.

How we use it

We use data to provide the app's features to the merchant who installed it: calculating landed cost, updating cost per item in Shopify, posting journals to Xero when the merchant confirms them, estimating margin, and applying plan limits. We also use it to answer support requests, send notices about the service, keep the service secure, and meet our legal and platform obligations. We don't sell data or use it for advertising. We share it only with the service providers below, with anyone the merchant asks us to, and where the law requires.

Service providers

  • Vercel runs the app, in Sydney, Australia. Vercel may process data, including traffic and logs, in the United States and other countries where it or its subprocessors operate. Logs can include store domains, record IDs and file names.
  • Supabase hosts the database and invoice files. They are stored and mainly processed in Sydney, Australia; Supabase's staff and subprocessors may access them from other countries.
  • Microsoft Azure reads uploaded invoice files with Azure OpenAI in Microsoft Foundry to extract the invoice values. Our Azure resource is in Australia East, and files are processed in Microsoft's Asia Pacific region, which can include countries outside Australia. Files are sent only when the merchant uploads them for reading, and Microsoft doesn't train on them. Content flagged by Microsoft's abuse monitoring is stored in Australia.
  • Shopify and Xero, whose APIs the app uses on the merchant's behalf. Each handles the data it receives under its own terms.
  • Cloudflare hosts this website and routes support email. Cloudflare forwards emails sent to support to a Google Gmail mailbox, protected with two-factor authentication. Google may hold them outside Australia, including in the United States. This website also loads fonts from Google, so a visitor's IP address reaches Cloudflare and Google.

The law in those countries may not protect personal information as Australian law does.

Security

Data travels over encrypted connections. The database and file storage are encrypted at rest by Supabase, invoice files are kept in a private storage bucket, and Xero tokens are also encrypted by the app. Each store's records are kept separate, and the app only shows a store its own data. Only the operator has access to production systems, protected by two-factor authentication.

Retention and deletion

  • Support emails are kept for up to 12 months after the conversation ends, then deleted.
  • Invoice files are deleted automatically once read, and never kept more than 24 hours after upload. The values read from them stay while the app is installed, with the rest of the store's data.
  • When a merchant uninstalls the app, their Shopify sessions are deleted and their Xero connection starts being released. That runs as a background job and usually finishes within minutes.
  • 48 hours after uninstall, Shopify asks us to erase the store's data. We then delete everything the app holds for that store: shipments, invoices and their files, Xero settings and journals, the contact email and acceptance record, usage counts and settings. If the store reinstalls before then, Shopify doesn't send this request and the data stays.
  • Background jobs (reading invoices, talking to Xero) run in our own app and database. Their records hold store domains and record IDs, not invoice contents or tokens, and are deleted within 30 days.
  • Copies held by providers go on their own schedules. Database backups, where our plan includes them, are overwritten within 7 days, and logs expire with the provider. Microsoft doesn't store invoices to read them, but if its abuse monitoring flags content it can keep that content for a limited time, in Australia, and it can keep data where the law requires.
  • A merchant can ask us to delete their data sooner by writing to support@truelanded.com. We'll do it within 30 days.

Your rights

Anyone whose information we hold can ask to see it, correct it or have it deleted, or make a complaint, by writing to support@truelanded.com. That includes merchants, and people named on invoices a merchant uploaded. We may check your identity, and for invoice data we may involve the merchant who uploaded it. On request we'll give a merchant a structured, machine-readable copy of the personal information we hold about them or their store. We'll look into each request or complaint and reply within 30 days.

We follow the Australian Privacy Principles as our own standard. Our business may be small enough to be exempt from the Privacy Act 1988 (Cth), so the Office of the Australian Information Commissioner (OAIC) may not be able to act on a complaint about us. If you're not satisfied with our response, you can still contact the OAIC at oaic.gov.au.

Changes

We'll update this page when the app's data handling changes, and change the date above. We'll email merchants about significant changes.