ComplyStream Privacy Policy

ComplyStream stores Shopify shop credentials, order data required for FBR invoice submission, and merchant-provided FBR API tokens. Tokens are encrypted at rest. Each merchant uses their own FBR credentials; invoice data is transmitted only to FBR endpoints configured by the merchant.

We do not sell merchant data. Merchants may request deletion of their shop data by uninstalling the app or contacting support.

ComplyStream is not affiliated with, endorsed by, or operated by the Federal Board of Revenue (FBR) or Pakistan Revenue Automation Limited (PRAL).

GDPR and Shopify mandatory webhooks

We respond to Shopify mandatory privacy webhooks for customer data requests, customer redaction, and shop redaction. Customer-related information stored in FBR submission records is redacted when Shopify sends a redaction request. Shop data is deleted after shop redaction or uninstall, subject to Shopify's webhook timeline.

Privacy questions: contact support@complystream.pk.