Legal

Privacy Policy

Last updated: April 2, 2026

1. Information We Collect

MultiStore Sync collects only the data necessary to provide the multi-store product and inventory synchronization service. We collect:

  • Store information: Shopify store domain, store name, and OAuth access tokens
  • Product data: Product titles, descriptions, vendor, tags, product type, variant SKUs, prices, barcodes, inventory quantities, images, and metafields that you choose to sync between stores
  • Order data: When an order is placed on a server store, we receive the order ID, line item SKUs, quantities, and unit prices via webhook. This data is used solely for inventory write-back (decrementing inventory on client stores) and revenue analytics within the app
  • Session data: Shopify session tokens and identifiers for authentication
  • Contact information: Name, email, phone number, and company name provided during onboarding (optional, used for support)
  • Sync history: Records of sync operations including timestamps, status, and error messages

2. Shopify API Scopes

We request the following Shopify API permissions:

  • read_products / write_products: To read product data from client stores and create/update products on server stores
  • read_inventory / write_inventory: To read and adjust inventory levels across connected stores
  • read_orders: To receive order webhooks for inventory write-back when products sell on the server store

3. How We Use Your Data

Data is used solely to operate the sync service:

  • Product sync: Transferring product data between connected stores based on variant SKU matching
  • Inventory sync: Keeping inventory levels consistent across stores in real-time via webhooks
  • Inventory write-back: When an order is paid on a server store, we decrement the corresponding inventory on all contributing client stores
  • Revenue analytics: Displaying aggregated revenue data within the app so merchants can see which stores and products generate the most sales. Revenue data is only visible to the store owner within the app
  • Sync history: Providing visibility into sync operations, errors, and status

We do not sell, rent, or share your data with third parties. We do not store customer personal information (names, emails, addresses, payment details). From orders, we only store SKU, quantity, price, and order ID for inventory and analytics purposes.

4. Data Storage & Third-Party Services

All application data is stored in a PostgreSQL database hosted by Supabase (data region: US). The application is hosted on Cloudflare. No other third-party services have access to your store data.

Data stored includes:

  • Store relationships and connection tokens
  • SKU ownership records (which client store owns which SKU on which server)
  • Cached inventory quantities for delta calculations
  • Sync job history with status and error details
  • Revenue records (order ID, SKU, quantity, price — no customer PII)
  • Metafield type registry for schema consistency

5. Customer Data

MultiStore Sync does not store any customer personal information. When we receive order webhooks, we extract only the line item SKUs, quantities, and prices for inventory and analytics purposes. Customer names, emails, shipping addresses, and payment information are never stored in our database.

6. GDPR & CCPA Compliance

We comply with GDPR, CCPA, and other applicable privacy regulations. We handle the following Shopify compliance webhooks:

  • Customer data request: We report that no customer personal data is stored
  • Customer redact: We confirm deletion (no customer PII to delete)
  • Shop redact: We permanently delete all store data including relationships, sync history, inventory records, revenue data, and session tokens

You can request deletion of your data at any time by uninstalling the app or contacting us directly.

7. Data Retention

  • Session tokens: Deleted when the app is uninstalled
  • Sync history: Retained for 90 days after disconnection, then permanently deleted
  • Revenue analytics: Retained for 12 months, then aggregated and anonymized
  • Store relationships: Deleted when the relationship is removed or the app is uninstalled
  • All data: Permanently deleted within 48 hours of receiving a shop/redact webhook

8. Security

  • All webhook payloads are verified using HMAC-SHA256 signatures
  • Store-to-store connections use secure one-time tokens with 72-hour expiration
  • All data in transit is encrypted via TLS
  • Database access is restricted to service-role credentials
  • Admin panel access requires separate JWT authentication with SHA-256 hashing

9. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related requests or questions: privacy@promolyapps.com

PromolyApps
promolyapps.com