1. Introduction
Syncronify Ltd ("Syncronify", "we", "us", or "our") operates the Syncronify unified commerce API and the websites, dashboards, and tools that support it (collectively, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it.
This policy applies to account holders, the people who use Syncronify on behalf of an organisation, and visitors to our marketing site. It does not change any data-processing agreement you have signed with us — where such an agreement applies, it governs in the event of a conflict.
For the purposes of the EU and UK General Data Protection Regulation (GDPR), Syncronify acts as a data controller for the account and billing data we collect, and as a data processor for the store and integration data you connect through the Service.
2. Information we collect
We collect only what we need to run the Service. This falls into four categories:
- ◈Account data — your name, email address, password hash, organisation name, and the workspaces you create.
- ◈Billing data — your plan, billing cycle, and the limited card metadata returned by our payment processor. We never see or store full card numbers; payments are handled by a third-party payment processor.
- ◈Integration & store data — the credentials and API tokens you provide to connect your platforms and stores, and the product, order, and inventory records we retrieve on your behalf to fulfil API requests.
- ◈Usage & technical data — log entries, request counts, IP addresses, browser and device information, and error diagnostics generated when you use the API or the dashboard.
We do not intentionally collect special-category personal data (such as health, biometric, or political data) and ask that you do not route such data through the Service.
3. How we use your data
We use the data described above to:
- ◈Provide, maintain, and secure the Service, including authenticating requests and serving normalised API responses.
- ◈Process payments, manage subscriptions, and send billing-related notices.
- ◈Enforce usage limits and protect against abuse, fraud, and unauthorised access.
- ◈Diagnose problems, monitor performance, and improve reliability.
- ◈Respond to your support requests and send essential service announcements.
- ◈Comply with our legal obligations and enforce our Terms of Service.
We do not sell your personal data, and we do not use your store or integration data to train machine-learning models or for advertising.
4. Legal bases for processing
Where the GDPR applies, we rely on the following legal bases:
- ◈Performance of a contract — to provide the Service you have signed up for and to bill for it.
- ◈Legitimate interests — to secure the Service, prevent abuse, and improve the product, balanced against your rights.
- ◈Legal obligation — to meet accounting, tax, and other statutory requirements.
- ◈Consent — for any optional communications, which you may withdraw at any time.
6. International transfers
Syncronify is operated primarily from the European Union, and we prefer to keep data within EU regions. Where data is transferred to a country without an adequacy decision, we rely on Standard Contractual Clauses or equivalent safeguards to protect it.
7. Data retention
We retain personal data only for as long as needed to provide the Service and meet our legal obligations:
- ◈Account and billing records are kept for the life of your account and for up to seven years afterwards where required for tax and accounting.
- ◈Integration credentials are retained until you disconnect the integration or delete the workspace, after which they are purged.
- ◈Request logs and usage counters are retained for up to 90 days for security and diagnostics, then aggregated or deleted.
When you delete a workspace or close your account, we delete or anonymise the associated data within 30 days, except where retention is legally required.
8. Security
We protect your data with encryption in transit (TLS) and at rest, scoped API keys, role-based access controls, and least-privilege access for our team. Integration credentials are encrypted and never exposed in API responses or logs. No system is perfectly secure, but we work continuously to reduce risk and will notify you and the relevant authorities of any qualifying breach without undue delay.
9. Your rights
Depending on where you live, you may have the right to:
- ◈Access the personal data we hold about you and receive a copy.
- ◈Correct inaccurate or incomplete data.
- ◈Delete your data ('right to be forgotten') where applicable.
- ◈Restrict or object to certain processing.
- ◈Receive your data in a portable, machine-readable format.
- ◈Withdraw consent at any time, without affecting prior processing.
To exercise any of these rights, email us at privacy@syncronify.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.
11. Children's privacy
Syncronify is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the 'Last updated' date above and, where appropriate, notify you by email or through the dashboard. Continued use of the Service after an update constitutes acceptance of the revised policy.
13. Contact us
If you have questions about this policy or how we handle your data, contact our privacy team at privacy@syncronify.com. For general enquiries, visit our contact page.
Have a question about this document? Get in touch →