Privacy Policy
for Merchants & Website Visitors

Introduction

Welcome to Syncnity, a Shopify application that provides an online review collection and marketing solution, owned and operated by Syncnity (a trade name of Syncnity Team, Proprietor) ("we", "us", "our").

This Privacy Policy (for Merchants and Website Visitors) (the "Policy"), which is incorporated into our Terms of Service and our Website Terms of Use, describes what personal information we collect and the policies and procedures we use regarding your personal information ("You", "Merchant" and "Website Visitor") through our syncnity.com website and through our Shopify web application (together — the "Service").

We are committed to complying with applicable data protection laws, including the General Data Protection Regulation (GDPR), UK GDPR, the California Privacy Rights Act (CPRA), and India's Digital Personal Data Protection Act 2023 (DPDP Act).

The Service is not directed to Merchants or Website Visitors under the age of 18. We do not knowingly collect information from children under 18 or knowingly allow them to use the Service.

This Policy may be amended from time to time. We will post any change at a reasonable time in advance of the effective date and will make efforts to proactively notify you by email where we have your email address.

Contact Us

If you have any questions, comments or concerns regarding this Policy or our processing of your personal information, please contact us:

What We Collect and Why

The table below details the personal information we collect from Merchants and Website Visitors, why we collect it, and the legal basis under GDPR where applicable.

Methods and Sources for Collecting Your Personal Information

We collect personal information from several sources:

• Directly from Shopify when you install and use the Service through the Shopify App Store, or directly from you when you provide information through contact forms, support channels, and email communications.
• From your Shopify store via the Shopify API — specifically, order data and customer contact details needed to send review requests on your behalf.
• From your customers when they interact with the review collection page and submit review content (text, photos, videos).
• From our service providers who help us operate the Service (see our Sub-processors page).
• Through your device when you access the Service, including through third-party cookies and analytics tools, and our own internal event tracking.

Sharing Your Personal Information

We will not sell your personal information. We will not share your information with third parties, except in the circumstances listed below or when you provide explicit and informed consent.

Data Retention and Security

We retain your information for as long as we need it to operate the Service and our business, and thereafter as needed for legal, record-keeping, and dispute resolution purposes. The overall retention period is approximately 7 years.

Security Measures

We implement measures to reduce the risks of damage, loss of information, and unauthorized access or use. These include:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls and multi-factor authentication on all internal systems
• Regular vulnerability scanning and penetration testing
• Data hosted in SOC 2 Type II certified data centres
• Incident response procedures with mandatory breach notification protocols

Additional Information for Individuals in the EU or UK

Controller & Processor Status

Syncnity is the data Controller for personal information it collects directly from Merchants and Website Visitors as described in this Policy.

Syncnity is the data Processor for personal information it processes on behalf of Merchants (i.e. your customers' data), as described in our Data Processing Addendum and our Privacy Policy for End Users.

EU & UK Representatives (GDPR Article 27)

As a company based in India offering services to individuals in the EU and UK, we have appointed representatives in these regions:

International Data Transfers

If we transfer your information from within the EU or UK to India or other countries not recognised as having adequate data protection, we will do so under a data transfer agreement incorporating Standard Contractual Clauses (SCCs) as determined by the EU Commission (Decision 2021/914), or the UK International Data Transfer Agreement (IDTA) for UK transfers. All transfers include supplementary technical safeguards (encryption in transit and at rest).

Legal Basis for Processing Your Personal Data

The table below sets out the legal basis under GDPR Article 6 for each processing activity:

Your Data Subject Rights

If you are in the EU or UK, you have the following rights under GDPR:

Additional Information for California Residents

If you are an individual residing in California, we provide the following information pursuant to the California Privacy Rights Act (CPRA). We do not sell or share your personal information for cross-context behavioural advertising and have not done so in the past 12 months.

Categories of Personal Information Collected (Past 12 Months)

Disclosures to Third Parties for Business Purposes (Past 12 Months)

Your CPRA Rights

• Right to Know — the categories and specific pieces of personal information collected about you, the sources, the business purpose, and the third parties to whom we disclose.
• Right to Delete — request deletion of your personal information, subject to applicable legal exceptions.
• Right to Correct — request correction of inaccurate personal information we hold about you.
• Right to Opt-Out of Sale/Sharing — we do not sell or share your data for cross-context behavioural advertising.
• Right to Non-Discrimination — we will not discriminate against you for exercising any CPRA right.
• Right to Limit Use of Sensitive Personal Information — we do not collect sensitive personal information as defined by CPRA beyond what is necessary.

Exercising Your CPRA Rights
Contact us at info@syncnity.com. We will use a 2–3 point identity verification process before responding. You may also designate an authorised agent — provide the agent with written permission and we will require your independent identity verification as well.

If you are a Merchant's customer wishing to exercise CPRA rights regarding data we processed on the Merchant's behalf, please note that we act as a Service Provider following the Merchant's instructions. Submit your request directly to the Merchant.

Do Not Track

We do not currently respond to browser "Do Not Track" signals or similar mechanisms. We do permit third-party analytics providers to collect usage data when you use our Service, as described in our Cookies Policy.

Additional Information for Individuals in India

If you are an individual residing in India, the following additional provisions apply pursuant to the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

Grievance Officer

In accordance with the DPDP Act 2023 and the IT Act, we have appointed a Grievance Officer to address any concerns regarding our processing of your personal data:

Your Rights Under the DPDP Act 2023

• Right to Access — request a summary of personal data processed and processing activities.
• Right to Correction and Erasure — request correction of inaccurate or incomplete data, or erasure where retention is no longer necessary.
• Right to Grievance Redressal — raise a grievance with our Grievance Officer; we will respond within 30 days.
• Right to Nominate — nominate another individual to exercise rights on your behalf in the event of death or incapacity.

Consent

Where we rely on your consent to process personal data under the DPDP Act, you have the right to withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of processing prior to withdrawal. To withdraw consent or exercise any DPDP right, contact our Grievance Officer at info@syncnity.com.