Privacy

SyncEcom connects a Shopify store to an Amazon seller account. To do that it holds a copy of the data both sides need to stay in step. This page says exactly what that is, why it is held, how long for, and how to have it removed.

SyncEcom does not sell, rent or share any of this data with anyone. It is not used for advertising, it is not used to train anything, and no third-party analytics, tracking or marketing service runs in this app.

Who operates this app

Operator

Kayease Global Solutions LLP

Address

3rd Floor, RSEB Officers Colony, 11B, Ram Marg, opposite Inox, D-Block, RSEB Colony, Amrapali Circle, Vaishali Nagar, Jaipur, Rajasthan 302021, India

Contact

support@kayease.com

Data location

Servers in Mumbai, India. Data stays there and is not moved between countries afterwards. A merchant outside India is therefore sending their data to India when they install the app.

What the app stores

From the Shopify store

• Products, variants, SKUs, titles, descriptions and images
• Prices and inventory levels, and the locations they sit at
• Orders, their line items and their fulfilment status
• The store’s domain, name, currency and time zone

About the merchant

• The store owner’s email address, and the separate contact address Shopify holds for customer enquiries
• The store’s business name, street address, phone number and country, where the merchant has entered them in Shopify
• Anything written on the Support page, with the shop and the sender it came from, so it can be answered

These are used to reach the merchant — alerts, replies to support, and billing questions — and for nothing else.

The SyncEcom account

SyncEcom opens on this website, not inside the Shopify admin, so each store has an account the merchant creates the first time they open the app.

• The name and email address entered when the account is created
• A phone number, only if the merchant chooses to give one
• The password, stored only as a one-way scrypt hash — the password itself is never stored and cannot be read back by anyone, including the operator
• A sign-in cookie, set when the merchant signs in and kept for up to seven days, and a second one for up to thirty minutes while an account is being created, which records the store it is for. Neither is used for anything else; there are no advertising or tracking cookies

The email address is used to sign in and to send a password-reset link when one is asked for. It is not used for marketing.

From the Amazon seller account

• The seller id and which Amazon marketplaces the account sells in
• Listings, their SKUs, ASINs, prices and stock
• Orders, their line items, totals and status

Buyer details

Where Amazon provides them, a buyer’s name, email address and delivery address are stored so an Amazon order can become a complete Shopify order. Amazon releases these only to applications it has approved for customer data, so they are frequently absent — an order without them is imported anyway rather than dropped.

These three fields are encrypted at rest with AES-256-GCM and are never written to logs.

Connection credentials

The tokens that authorise access to Shopify and Amazon are stored encrypted with the same cipher. They are never displayed, never logged, and are deleted when the connection is removed.

Why it is stored

Every item above exists to perform the function the merchant installed the app for: publishing Shopify products to Amazon, keeping price and stock in step, and bringing Amazon orders back into Shopify. Nothing is collected for any other purpose.

A local copy is necessary rather than convenient. Amazon limits how often it may be asked — some endpoints to roughly one request per minute — so a page that fetched live would be unusable, and stock could not be compared between two systems without holding both sides.

How long it is kept

Buyer details

Erased 30 days after the order is placed. The order and its financial record are kept; the name, email address and shipping address are removed.

Orders and listings

Kept while the app is installed, because they are the record of what was synchronised.

Credentials

Deleted when the connection is disconnected.

The SyncEcom account

Kept while the app is installed and deleted with the rest of the store’s data after it is uninstalled. A password-reset link works once and expires thirty minutes after it is sent.

Everything else

Deleted when the app is uninstalled, in response to Shopify’s own data-erasure requests.

SyncEcom subscribes to Shopify’s mandatory privacy webhooks — customer data request, customer redact and shop redact — and acts on them.

Who else sees it

Almost nobody. There is no analytics provider, no error-reporting service and no advertising network. The only parties involved are Shopify and Amazon themselves, which are the sources of the data rather than recipients of it.

The one exception is email. Where this installation is configured to send it, an email provider delivers two things on our behalf: alerts to the address the merchant chose, and replies to messages they send us from the Support page. Those messages carry the shop name and whatever the merchant wrote. Nothing else is emailed — no order, buyer or catalogue data leaves this way. An installation with no email provider configured sends none of it, and the app says so on its own Notifications page.

Data is disclosed otherwise only where the law requires it. If that ever happens, the affected merchant is told unless telling them is itself unlawful.

How it is protected

• Buyer details and credentials are encrypted with AES-256-GCM
• Account passwords are stored as scrypt hashes, and the sign-in cookie cannot be read by scripts on the page
• All traffic is over HTTPS
• Access to the production database is limited to the operator named above
• Buyer details are excluded from application logs by design, not by filtering

Rights, and how to use them

A merchant may ask what is held about them, ask for a copy, ask for it to be corrected, or ask for it to be deleted. Uninstalling the app starts the deletion automatically; write to us if you would rather not wait, or if you want any of the others.

A buyer whose details reached this app through an Amazon order should contact the merchant they bought from, who can act on it directly. We will help that merchant if asked.

Write to support@kayease.com. We answer within five working days.

Changes to this notice

The date at the top of this page changes whenever the text does. A change that affects what is collected or who sees it will also be told to merchants inside the app rather than left here to be found.