Introduction #
Welcome to Syncrozon ("we", "our", "us", or "Syncrozon SaaS"). Syncrozon operates a specialized e-commerce software-as-a-service (SaaS) platform designed to connect Shopify storefronts with Amazon Multi-Channel Fulfillment (MCF). Our core service automatically routes incoming customer orders from Shopify to Amazon fulfillment centers, fetches real-time carrier tracking information from Amazon MCF, updates fulfillment statuses on Shopify, and maintains precise, continuous inventory synchronization across connected sales channels.
We take data privacy, security, and statutory compliance with maximum priority. This Privacy Policy details how Syncrozon collects, uses, encrypts, stores, processes, and protects personal data and store telemetry when merchants ("Merchants", "You") install, connect, and operate the Syncrozon application.
Syncrozon adheres strictly to the Shopify API License and Option Agreement, the Shopify Data Protection Addendum (DPA), and the Amazon Selling Partner API (SP-API) Data Protection Policy (DPP). We process customer Personally Identifiable Information (PII) solely for order fulfillment operations and auto-purge PII in accordance with Amazon and Shopify policy requirements.
Information We Collect #
To provide automated fulfillment integration, Syncrozon collects specific categories of data from Merchants and end-customers who place orders on connected Shopify stores:
A. Merchant Account Information
- Store Contact Information: Merchant name, store owner email, store name, primary domain (`myshopify.com` domain URL), store currency, and timezone settings.
- Authentication Credentials: OAuth 2.0 access tokens for Shopify API access and encrypted Amazon Selling Partner API (SP-API) tokens. Syncrozon never stores or sees raw Amazon seller passwords or master credentials.
- Subscription & Billing Metadata: Active subscription tier, usage quotas, invoice history, and billing status processed securely via the official Shopify App Store Billing API.
B. End-Customer Personally Identifiable Information (PII)
When a buyer places an order on your Shopify store, Syncrozon receives the exact PII required to construct and send a valid Amazon MCF Fulfillment Order request:
- Recipient Shipping Information: Recipient full name, delivery address (street, apartment/suite, city, state/province, postal code, country code).
- Communication Details: Customer email address and phone number (strictly used by delivery carriers such as UPS, FedEx, USPS, or Amazon Logistics for shipment tracking notifications and delivery updates).
- Order Line Items: Ordered product titles, SKU identifiers, quantities, order IDs, and shipping speed selections (e.g. Standard, Expedited, Priority).
C. Technical & Telemetry Data
- API Access Logs: Webhook request headers, IP addresses, user-agent strings, response latency times, and system error tracebacks to maintain application reliability and diagnose API synchronization failures.
Shopify & Amazon Data Integration #
Syncrozon functions as an authorized API bridge between Shopify APIs and Amazon Selling Partner (SP-API) Amazon MCF endpoints. Our handling of data across both platform ecosystems complies with rigorous technical rules:
| Ecosystem | API Permissions Scope | Data Standard & Compliance Rule |
|---|---|---|
| Shopify Platform | `read_orders`, `write_orders`, `read_inventory`, `write_inventory`, `read_products`, `read_fulfillments`, `write_fulfillments` | Strict compliance with Shopify Data Protection Addendum (DPA). Handles Shopify Mandatory Mandatory Privacy Webhooks (`customers/redact`, `shop/redact`, `customers/data_request`). |
| Amazon MCF (SP-API) | Fulfillment Outbound API (`createFulfillmentOrder`, `getFulfillmentOrder`, `listAllFulfillmentOrders`) | Adheres to Amazon SP-API Data Protection Policy (DPP) & Acceptable Use Policy (AUP). PII encryption at rest (AES-256) and in transit (TLS 1.3). |
Shopify Mandatory Privacy Webhooks Handling
Syncrozon has fully implemented Shopify's automated privacy webhooks to respect merchant and customer data rights:
- `customers/data_request`: Upon receiving a data request webhook from Shopify, Syncrozon compiles and provides all stored order logs linked to the specified customer within 72 hours.
- `customers/redact`: Upon receiving a customer redaction request, Syncrozon immediately purges all PII associated with that customer's past orders from our databases.
- `shop/redact`: When a merchant uninstalls Syncrozon or closes their store, receiving this webhook triggers an automated complete purge of all store tokens, catalog maps, and order history within 14 calendar days.
How We Use Information #
Syncrozon uses collected merchant and order data solely for the following explicit operational purposes:
- Automated Order Fulfillment: Transforming Shopify paid orders into valid Amazon MCF Fulfillment Requests in real time.
- Carrier Tracking Back-Sync: Polling Amazon MCF API for carrier tracking numbers (e.g. UPS, FedEx, Amazon Logistics) and automatically fulfilling the corresponding Shopify order with live tracking links.
- Real-Time Inventory Synchronization: Fetching available Amazon MCF FBA inventory levels and adjusting Shopify stock quantities to eliminate overselling.
- SKU & Bundle Mapping: Storing merchant configuration mappings between Shopify variant SKUs and Amazon FBA SKUs.
- Service Monitoring & Support: Diagnostic debugging when fulfillment calls return API errors (e.g. invalid shipping address format or out-of-stock SKU warnings).
Syncrozon NEVER sells, rents, leases, trades, or monetizes merchant store data, customer PII, order volume figures, or product revenue statistics to any third party, broker, or advertiser.
Data Security #
We implement enterprise-grade security protocols designed to prevent unauthorized access, data leakage, alteration, or destruction:
- Encryption in Transit: All data transmitted between Shopify, Syncrozon servers, and Amazon SP-API endpoints is encrypted using modern Transport Layer Security (TLS 1.3) protocols with strong cipher suites.
- Encryption at Rest: All sensitive database fields—including OAuth tokens, Amazon SP-API credentials, and customer PII—are encrypted at rest using industry-standard AES-256 algorithm with KMS managed keys.
- Access Controls & Network Isolation: Production databases are restricted to isolated Amazon Web Services (AWS) VPC subnets accessible strictly through role-based access control (RBAC) and multi-factor authentication (MFA).
- Vulnerability Management: Automated daily dependency scanning, vulnerability monitoring, and periodic third-party penetration testing.
Data Retention & Purging Policy #
Syncrozon strictly limits data retention to the duration necessary to deliver our fulfillment integration services and satisfy statutory legal obligations:
| Data Category | Retention Period | Purging Action |
|---|---|---|
| End-Customer PII (Name, Address, Phone) | 30 Days post fulfillment completion | Automated cryptographic wipe / anonymization from active production tables in compliance with Amazon SP-API DPP requirements. |
| Anonymized Order Metrics & Sync Logs | 90 Days | Archived to cold storage for sync history reporting before automatic permanent purge. |
| Merchant Store Credentials & Tokens | Active Subscription Period | Permanently deleted within 14 calendar days upon app uninstallation or receiving `shop/redact` webhook. |
Cookies & Tracking Technologies #
Syncrozon uses strictly necessary operational cookies and local storage tokens within the Syncrozon Merchant Admin Dashboard:
- Session Authentication Cookies: Secure, `HttpOnly`, `SameSite=Strict` session cookies to authenticate merchant login sessions within the Shopify Embedded App iFrame.
- UI Preference Tokens: `localStorage` items used to remember merchant dark/light theme display preferences (`syncrozon_theme`).
We do not deploy cross-site tracking cookies, behavioral ad pixels (such as Meta Pixel or Google Ads Remarketing), or third-party data broker analytics on merchant stores or end-customer checkout flows.
Third Party Services & Subprocessors #
To deliver our SaaS application, Syncrozon engages trusted infrastructure subprocessors that comply with rigorous security standards (SOC 2, ISO 27001, GDPR):
- Shopify Inc. (Canada/USA): Store platform API provider and app billing gateway.
- Amazon Web Services, Inc. (AWS): Secure cloud hosting, serverless compute (AWS Lambda), and encrypted database infrastructure (RDS PostgreSQL / DynamoDB).
- Amazon Selling Partner Services (Amazon MCF): Order fulfillment warehouse execution and carrier tracking provider.
- Datadog & Sentry: Application performance telemetry and error monitoring (configured with automated PII masking filters).
User Rights (GDPR, CCPA & International Data Rights) #
Depending on your geographic location (e.g. European Economic Area, United Kingdom, California, Canada), Merchants and end-customers possess statutory data protection rights:
- Right of Access: The right to request copies of all personal data held by Syncrozon.
- Right to Rectification: The right to request correction of inaccurate or incomplete store data.
- Right to Erasure ("Right to be Forgotten"): The right to request deletion of personal data, executed seamlessly via Shopify Privacy Webhooks or direct written request.
- Right to Data Portability: The right to receive exported copies of SKU mappings and order sync logs in standard JSON/CSV format.
- Non-Discrimination: We will never deny services, charge different prices, or alter service quality if you exercise your privacy rights.
To submit a privacy rights request, merchants or buyers may email our Data Protection Officer at support@syncrozon.com.
Contact Information #
If you have questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact our dedicated privacy team:
Changes to Privacy Policy #
Syncrozon reserves the right to update or modify this Privacy Policy periodically to reflect changes in legal regulations, platform API terms, or operational features. When material changes are made, we will notify merchants via email, in-app notifications within the Syncrozon Shopify app dashboard, and by updating the "Last Updated" timestamp at the top of this document.
Continued use of the Syncrozon application following notice of updates constitutes acceptance of the revised Privacy Policy.