Privacy Policy

1. Two roles

For merchants who use Forto, we decide how your account and billing data is used, so we are the controller of it.

For a merchant’s customers (shoppers and parcel recipients), we handle their details on the merchant’s behalf to quote duties, buy shipping labels, clear customs, track parcels and process returns. For that we act as the merchant’s processor, under our Data Processing Agreement. Shoppers should contact the store they bought from first; we help the store answer.

Where Forto itself carries a tax or customs obligation on an order (for example as seller of record or as the store’s import VAT intermediary), the law requires us to keep the records of that obligation, and for those records we are a controller.

2. What we collect

• Account details: your name, email address, store address (myshopify domain), business name, country and address, and VAT number.
• Sign-in: one-time sign-in codes sent to your email, and the session that keeps you signed in.
• Billing: references to your card and customer record at Stripe (we never see or store full card numbers), your acceptance of the automatic-charge mandate, invoices, subscription status and wallet transactions.
• Store data from Shopify: store settings, products (titles, weights, customs codes), locations, markets and orders.
• Customer and recipient details from orders: name, shipping address, email, phone number, what was ordered and its value, tax identifiers where customs needs them, tracking events, and return requests.
• Technical data: IP addresses and request logs we keep for security, the date and IP address when you accept our Terms, and an approximate country derived from a shopper’s IP address so a storefront can show duties for the right country.
• Messages you send to our support team.
• Business check: your company registration (CVR) number and what the Danish company register publishes about your company: its legal name, registered address, legal form and status, and the names and roles of its directors, board members and owners. Also whether your VAT number is valid, the person you name as responsible for the business, and, on Pro and Enterprise, the result of that person’s photo ID check: the name on the ID and whether it matched. The photo of the ID and the selfie are taken and checked by Stripe; we do not receive or keep them.

3. Why we use it, and on what legal basis

• To provide the service you signed up for: rates, duty and tax quotes, labels, customs paperwork, tracking, returns, and the emails that go with them (GDPR Art. 6(1)(b), contract).
• To bill you for your plan and for the labels, duties and import VAT you ship with (contract).
• To meet legal obligations for tax, customs and bookkeeping (Art. 6(1)(c)).
• To keep Forto secure, prevent fraud and fix problems (Art. 6(1)(f), our legitimate interest in running a safe service).
• To check who we work for before Forto ships on its own carrier accounts or acts as a store’s taxpayer: we confirm the business in the company register and check it and the people registered on it against the EU, UN, UK and US sanctions lists, again whenever a list changes (Art. 6(1)(c) where sanctions law requires it, and Art. 6(1)(f), our legitimate interest in knowing who we work for). This covers directors and owners who never use Forto themselves; their details come from the public Danish company register. The photo ID check is carried out by Stripe, which asks for the person’s consent before comparing their selfie with the ID photo.

We do not sell personal data, and we do not use advertising cookies.

4. Who we share it with

Only with the providers we need to run the service, each for its own part:

• Shopify, the platform the app runs on.
• Hosting and processing: Vercel (hosting), Supabase (database), Upstash (caching), Inngest and Render (background processing).
• Payments: Stripe (card payments) and Airwallex (paying duties and taxes abroad).
• Email: Resend (service emails) and Google Workspace (our support mailbox).
• Shipping: the carriers and shipping platforms that carry each parcel, such as UPS, DHL, FedEx, PostNord, GLS and Shippo.
• Tax and customs: customs and tax authorities where the law requires, and the tax compliance partners that file on your behalf when your plan includes it (Numeral; TaxCloud for US sales tax).
• Customs classification: product details, never customer details, are sent to OpenAI and Anthropic to suggest customs codes for your products.
• Business check: we look up your company in the Danish company register (the Danish Business Authority) and your VAT number in the EU VAT number service, and Stripe carries out the photo ID check. The sanctions lists are downloaded from the EU, the UN, the UK government and the US Treasury; no data is sent to them.

Some of these providers process data outside the European Economic Area, for example in the United States. Those transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.

5. How long we keep it

• Account data for as long as your account is open, then as long as needed to settle open charges or legal claims.
• Order and shipment data for as long as needed to deliver, handle returns and settle carrier corrections, which carriers can bill up to 90 days after a shipment.
• Tax, customs and accounting records for as long as the law requires: 10 years for EU VAT records, 5 years under Danish bookkeeping law, and the audit period customs authorities set.
• Business check records for as long as your account is open and 5 years after, as the record of who Forto worked for. Stripe keeps the ID photos and selfies under its own retention rules.
• After a store uninstalls Forto, Shopify tells us 48 hours later; we then remove the store’s Shopify access and its customers’ personal details, keeping only the records the law requires.

6. Your rights

You can ask us for a copy of your personal data, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable format. Write to legal@forto.app. We answer within one month. Records the law requires us to keep cannot be deleted until that period ends.

A store’s customers can ask the store, which forwards the request through Shopify; we then send the store everything we hold about that customer, or erase it.

You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

7. Security

All traffic to Forto is encrypted in transit. Card details are held by Stripe, not by us. Access to personal data is limited to the people who need it to run the service, and every merchant request is checked against a signed-in session or a Shopify session.

8. Changes

When this policy changes, the version and date at the top change with it, and we tell merchants in the Forto admin and by email before a material change takes effect.

9. Contact

RLD Solutions, trading as Forto
CVR 41171790
Denmark
Email: legal@forto.app