Install CreditHold
Menu

Privacy policy

Last updated: Oct 30, 2026.

CreditHold is a Shopify app that sets credit limits for B2B companies and blocks checkout on payment terms when a company is overdue or over its limit. This policy explains what data the app processes for the merchants who install it, and what it deliberately does not keep.

Who we are

CreditHold is operated by Hicham Taki EI (Takisoft), entrepreneur individuel, 200 rue de la Croix-Nivert, 75015 Paris, France. For your merchant account data, Hicham Taki EI (Takisoft) is the controller. For data about your buyers that Shopify passes to us, you (the merchant) are the controller and Hicham Taki EI (Takisoft) is your processor. We can sign a data processing agreement on request.

What we store

  • Your shop's domain, plan, currency, time zone, languages and the app settings you choose.
  • Per-company aggregates: outstanding balance, overdue balance, number of overdue invoices, oldest due date, credit limit and the credit rules you turned on.
  • Order ids and order names (such as #1043) of open B2B orders, used to compute those aggregates and to name the overdue invoice in the checkout message.
  • Status events (for example, a company becoming overdue) and records of orders placed while a company was blocked.
  • Notes your staff type when allowing an order or unblocking a company. Don't put personal data in them.
  • The Shopify access token for your shop, encrypted at rest.

What we do not store

We never store buyers' names, email addresses, phone numbers or postal addresses. Order payment status and payment schedules are read from Shopify to compute balances; only the per-company aggregates and order ids above are kept.

Why we need these permissions

read_all_orders lets us read open orders older than 60 days, where overdue invoices on longer payment terms are. read_customers is used only to learn which company and location placed an order. read_locales tells us your store's language for the default checkout messages.

How we use it

Only to provide the app: computing balances, showing them to you in the Shopify admin, blocking checkout for the companies you protect, and sending you alerts. We do not sell data, use it for advertising, or share it beyond the subprocessors below.

We process this data to perform our contract with you (providing the app) and, for error monitoring and security, on our legitimate interest in keeping the service working.

Retention

  • Status events are kept for 90 days.
  • The log of customer data requests (order ids only) is kept for 90 days.
  • Records of orders placed while a company was blocked are kept for 13 months.
  • Webhook ids are kept for 7 days, to ignore duplicates.
  • Everything we keep about your shop is deleted within 30 days of uninstalling the app or of Shopify's shop/redact request, except, for a founding store, its domain and its place in the offer, kept so the offer stays yours and its free months are never given twice.
  • If your store takes the founding offer, we keep its myshopify domain, its place in the offer and the dates it joined the offer and subscribed after you uninstall, so the offer's price stays yours if you come back. The free months run from the day your store first protects a company and do not restart if you uninstall and reinstall.
  • While CreditHold is installed, it keeps the orders on payment terms of your companies (order numbers, amounts and dates) and their ledger entries. It keeps a log of the payment reminders it asked Shopify to send for 13 months. It keeps the Shopify Flow events it sends for 7 days after they are sent, or for up to 30 days while they wait to be sent. It deletes all of them 30 days after you uninstall, or sooner when Shopify asks it to.

Subprocessors and transfers

  • Microsoft Azure: application hosting (Paris, France (Microsoft Azure France Central)).
  • Microsoft Azure: managed Postgres database (Paris, France (Microsoft Azure France Central)).

Where a subprocessor processes data outside the European Economic Area, the transfer relies on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Cookies

Inside the Shopify admin, CreditHold uses Shopify's session tokens only. This website sets no tracking cookies.

Security

Data is encrypted in transit, Shopify access tokens are encrypted at rest, and provider accounts use two-factor authentication. To report a security or data incident, email support.credithold@takisoft.net. We acknowledge incident reports within one business day. If an incident affects your data, we'll notify you without undue delay.

Your rights (GDPR and similar laws)

You can ask to access, correct, export or delete the data we keep about your shop, or object to its processing, by emailing support.credithold@takisoft.net. Buyers' data requests made to your store reach us through Shopify's customers/data_request and customers/redact webhooks. On a data request we return the order ids and dates of any records tied to the listed orders; we keep no names, emails, phones or addresses. A redact request deletes those records. You may also complain to your local data protection authority.

Contact

Questions about this policy: support.credithold@takisoft.net.