This policy explains what personal data Synova Apps collects, why we collect it, how it is protected, and how to have it deleted. It covers this website, every Shopify app we publish, and every WordPress plugin we sell.
The short version
- We do not sell, rent, or trade your data — not to advertisers, not to data brokers, not to anyone.
- Our apps request the minimum Shopify permissions they need to work. An app that does not need your customers cannot see your customers.
- Nobody on our team browses your store data. Staff access is off by default, granted only when you ask us for help, time-limited, and logged.
- Everything is encrypted — in transit, at rest, and in every backup.
- Uninstalling deletes your data.Shopify's shop redaction request wipes your store's records, and backups age out on a fixed schedule.
- We never use your data to train AI models, or to build any cross-merchant dataset.
1. Who we are, and which role we play
Synova Apps builds and operates the software described on this site. For any question about this policy, or to exercise a right listed below, contact support@synovaapps.com.
Which data-protection role we hold depends on whose data it is:
- We are the controller for data about you as our customer — your account, licences, billing records, support tickets, and how you use this website.
- We are a processorfor the store data our apps handle on your behalf. Your products, your orders, and your own customers' personal data remain yours. We process them only to deliver the app you installed, on your instructions, and never repurpose them for our own ends.
2. Data we collect
When you visit this website
Pages viewed, referring page, approximate location derived from IP at country or region level, browser and device type, and the time of the request. We use privacy-respecting analytics and ordinary server logs for this — no cross-site advertising trackers, no ad pixels, and no selling of audience data.
When you install one of our Shopify apps
Shopify gives us a standard set of details about the store and the person installing it: the myshopify domain, shop name, store owner name and email, country, currency, timezone, locale, and plan. We store these to identify your store, send operational email, apply the right plan limits, and provide support. We also store an access token, which is encrypted at rest and never displayed anywhere in the interface.
Store data our apps process
Each app requests only the Shopify permissions its features actually require. The exact scopes appear on the permission screen you approve at install, and we cannot reach anything outside them. As a guide:
- Catalog and inventory apps — such as our supplier feed and catalog tools — request product, variant, inventory, and location permissions only. They do not request access to customers, orders, or payment data, and so cannot read any of it.
- After-sales and B2B apps — such as our warranty, returns, quoting, and sales-rep tools — necessarily work with orders and customer identifiers, because a warranty, a return, or a quote is attached to a real person and a real order.
Where an app can do its job without holding readable personal data, it does. Our returns product, for example, stores email addresses, phone numbers, and shipping addresses only as one-way salted hashes used for matching, keeps names as a first name plus last initial, and deep-links to the record in your own Shopify admin whenever your team needs the real details.
Personal data belonging to your customers
Some apps collect data directly from shoppers on your storefront — a warranty registration, a claim submission, a quote request. That can include name, email address, phone number, shipping address, proof of purchase, serial numbers, and uploaded photos. This data is collected for you and on your behalf: you are its controller, and we process it solely to run the feature you enabled.
When you buy a licence or a plan
Purchases on this site are processed by Stripe or PayPal. Your card number never reaches our servers — the processor handles it directly. We retain the order record, licence key, billing email, billing country, the card brand and last four digits, and any invoice or tax data we are legally required to keep. Shopify app subscriptions are billed through Shopify's Billing API, and Shopify holds those payment details.
When you contact us
Support emails, contact-form submissions, and any screenshots, logs, or store details you choose to send. We keep the thread so we have context the next time you write.
3. Why we use it, and our legal basis
- To deliver the service you installed or bought — running syncs, issuing warranties, processing claims and quotes, generating documents, validating licences. Basis: performance of a contract.
- To provide support and send transactional email such as receipts, licence keys, sync failure alerts, and security notices. Basis: performance of a contract.
- To keep the service secure and reliable — rate limiting, fraud and abuse prevention, error monitoring, audit logs, and backups. Basis: legitimate interests.
- To improve our products using aggregated, de-identified usage statistics that cannot be traced back to a store or a person. Basis: legitimate interests.
- To meet legal and tax obligations — invoices, accounting records, and responses to lawful requests. Basis: legal obligation.
- To send product or marketing email where you have opted in. Every such email carries a one-click unsubscribe. Basis: consent.
4. What we never do
- We never sell, rent, or trade personal data.
- We never share your data with advertisers or data brokers, and we run no advertising or cross-site tracking pixels inside our apps.
- We never use your store data, or your customers' data, to train machine-learning or AI models.
- We never pool one merchant's data into a shared or cross-merchant dataset. Every record is scoped to a single store, and a request for another store's data returns a not-found response by design.
- We never request a Shopify permission an app does not use, and we never read data outside the scopes you approved.
5. Who can access your data
In normal operation, no human at Synova Apps looks at your store data. Our apps run automatically: data moves between Shopify, our servers, and your admin interface without anyone reading it.
Staff access is the exception, not the rule, and is constrained by:
- Least privilege. Production access is limited to the small number of engineers who need it to operate the service, granted per role rather than by default.
- A reason, every time.We open a specific store's records only to investigate a support request you raised, to fix a confirmed bug or incident affecting you, or where the law requires it.
- Strong authentication. Multi-factor authentication is required on every account, and on every third-party service that holds production data.
- Logging. Administrative actions are recorded with actor and timestamp, so access can be reviewed after the fact.
- Revocation. Access is removed when someone changes role or leaves, and everyone with access is bound by written confidentiality obligations.
6. How we protect it
- Encrypted in transit. All traffic — browser to server, server to Shopify, server to database, and every webhook — runs over TLS 1.2 or higher. Plain HTTP is redirected and HSTS is enabled.
- Encrypted at rest. Databases, object storage, and uploaded files such as claim photos and generated PDFs are encrypted at rest with AES-256.
- Encrypted backups. Database backups and snapshots are encrypted to the same standard, both in storage and in transfer, and are restricted to the same narrow set of operators as production. Encryption is not dropped anywhere in the backup chain.
- Secrets get a second layer. Shopify access tokens, supplier FTP, SFTP and API credentials, SMTP passwords, and similar secrets are additionally encrypted at the application level with AES-256-GCM before they are written to the database, and are never shown back to anyone in the interface — you can replace them, but they cannot be read out.
- Tokens are hashed and expiring. Customer portal links, magic links, and claim trackers are HMAC-signed and unguessable; session and API tokens are stored hashed, never in plain text.
- Tenant isolation. Every record carries the store it belongs to, and every query is scoped to it.
- Hardened endpoints. Shopify webhooks are HMAC-verified before processing, embedded app requests are authenticated with session tokens, and public endpoints are rate-limited per IP.
- Managed, patched infrastructure. We run on established cloud platforms with SOC 2 certified providers. Databases are not publicly reachable, and dependencies are monitored and patched.
- Incident response. We maintain a written incident response procedure. If a breach affects your personal data we will notify you and the relevant supervisory authority without undue delay, and within 72 hours of becoming aware, as the GDPR requires.
No system can promise perfect security, but every control above is in place today rather than aspirational.
7. How long we keep data, and how it gets deleted
- While you are a customer, we keep the data the app needs to function — your configuration, history, and records.
- When you uninstall a Shopify app,we stop processing immediately and delete your store's data. Shopify sends a shop redaction request 48 hours after uninstall, and that request triggers a hard delete of your records, credentials, and history. Some apps also purge on a short grace period, so a quick reinstall does not lose your setup.
- Shopify's mandatory privacy webhooks are implemented in every app. A customer data request produces a complete export of what we hold about that person; a customer redaction request anonymizes their personal data while preserving de-identified statistics; a shop redaction request erases the store entirely.
- Backups. Deleted data can persist in encrypted backups until they rotate out on their normal schedule — no longer than 35 days — after which it is gone permanently.
- Billing and tax records are kept for as long as accounting and tax law requires, typically six to seven years.
- Support threads are kept for up to 24 months, then deleted.
8. Service providers we rely on
We use a short list of established sub-processors. Each is bound by a data processing agreement, may act only on our instructions, and is prohibited from using your data for its own purposes.
- Shopify — the platform your store runs on, and the source of app data.
- Vercel and our managed cloud hosts — application hosting and delivery.
- Supabase — managed PostgreSQL and object storage, the database and file storage behind this site.
- Stripe and PayPal — payment processing for purchases made on this website.
- Brevo — transactional email. Some apps send through your own SMTP provider instead, so the mail comes from your brand.
We keep this list current. If you would like advance notice of changes to our sub-processors, email support@synovaapps.com and we will add you to the notification list.
9. International transfers
We and our providers may process data in the United States, the European Union, and the United Kingdom. Where data leaves the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses, the UK Addendum, or an adequacy decision, alongside the encryption and access controls described in section 6.
10. Your rights
Depending on where you live, you have the right to access the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time. Under the GDPR and UK GDPR you may also lodge a complaint with your local supervisory authority.
If you are a California resident, you have the right to know what personal information we collect and why, to request deletion or correction, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as the CCPA/CPRA defines those terms, and we will never discriminate against you for exercising a privacy right.
To exercise any of these, email support@synovaapps.comwith "Privacy request" in the subject line. We respond within 30 days and charge nothing for it. We may need to verify your identity first, so that nobody can use this process to reach someone else's data.
11. If you shopped at a store that uses our apps
When you register a warranty, file a claim, or request a quote through one of our apps on a merchant's storefront, that merchant is the controller of your data — we only process it for them. Please send your access or deletion request to the store you bought from. They can fulfil it directly, or through the Shopify privacy request our apps implement. If you contact us instead, we will forward your request to the relevant merchant and help them complete it.
12. Cookies
This website uses cookies that are strictly necessary — keeping you signed in, protecting forms against cross-site request forgery, and remembering your theme — plus privacy-respecting analytics that do not follow you across other websites. We run no advertising cookies. Our embedded Shopify apps use only the session cookies Shopify requires to authenticate the embedded frame. You can block or delete cookies in your browser settings, though signing in will stop working without the necessary ones.
13. Children
Our products are business tools and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.
14. Changes to this policy
If we change this policy we will update the date at the top of the page. For changes that materially affect how we handle your data, we will notify you by email or in the app before they take effect.
15. Contact
Questions, privacy requests, or a data processing agreement — write to support@synovaapps.com and a human will reply, usually within one business day.
