Privacy Policy
Last updated: 8 July 2025
Sync-2-Shopy ("the app", "we", "us") is a Shopify application installed and operated at the explicit instruction of the merchant who installs it. This policy explains what we access, why, how long we keep it, and how we protect and delete it.
Who controls the data
The merchant is the data controller of their store data. We act as a data processor. We do not sell data, use it for advertising, or use it to train models.
What we access
- Product and inventory data (title, description, price, SKU, stock levels) from the primary store, pushed to the paired secondary store.
- An offline Admin API access token for each connected store, granted by you through Shopify's standard OAuth consent screen.
How we use it
To keep the secondary store's catalog and stock levels in sync with the primary store.
How we protect it
- TLS in transit; access tokens encrypted at rest with AES-256-GCM.
- HMAC-verified OAuth callbacks and webhooks; session-token-authenticated dashboard API.
- Data is transmitted over HTTPS/TLS only.
Data retention & deletion
- No snapshots are retained — this app syncs live data, it does not store historical copies.
- We honour Shopify's mandatory compliance webhooks:
customers/data_request,customers/redactandshop/redact. On uninstall and on the shop/redact webhook, which purges the shop's rows and, if it was the last connection in its pair, the pair itself. - Uninstalling the app or contacting us at support@shop-2-shop.com will remove your stored connection.
Sub-processors
The app runs on Cloudflare (compute, storage and DNS). No other third parties receive your store data.
Sharing
Nothing is sold, shared with third parties, or used for advertising.
Your rights
You may request access to, correction of, or deletion of your data at any time by emailing support@shop-2-shop.com. We respond to GDPR and CCPA requests within the timeframes required by law.
Contact
Questions about this policy: support@shop-2-shop.com.