About this policy
Syntra™ is a Shopify app made by DEMAND Technologies LLC ("we", "us"). It moves product, inventory, order, and customer data between a Shopify store and the systems the merchant connects, such as SFTP servers, APIs, and Google Sheets. This policy explains what data the app handles, why, who helps us process it, how long we keep it, and how to make a privacy request.
For the personal data of a store's customers, the merchant decides what is processed and where it goes, and we process it on the merchant's behalf. Customers with questions about their data should contact the store they bought from first.
Information we collect
Store and account details. When you install the app, Shopify gives us your store's domain, an access token for the permissions you approved, and your plan and billing status. Payments are handled by Shopify, so we never see card or bank details.
Settings you enter. Job configurations, field mappings, schedules, sample files you paste or upload to build a mapping, and connection details for your endpoints. Passwords, API keys, and Google connection tokens are encrypted before they are stored. If you connect Google Sheets, we also store the email address of the Google account you connected.
Store data processed by your jobs. When a job you set up runs, the app reads or writes the Shopify data that job covers through the Shopify Admin API. Depending on the job, that can include products, inventory levels, orders, and customer records, including customer names, email addresses, phone numbers, and postal addresses. The app only accesses this data to run the jobs you configure.
Run history and technical logs. Job results, error messages, rows that failed to import, export files waiting for you to download, and records of Shopify API rate limits, so you can see what happened and so we can support you.
We do not use advertising or analytics trackers, and we do not collect data from your store's shoppers through your storefront.
How we use it
- To run the imports, exports, and scheduled jobs you set up, and deliver the results where you choose.
- To show you run history, errors, and job status in the app.
- To apply the limits of your plan and manage your subscription through Shopify.
- To answer support requests and fix problems.
- To keep the service secure and meet our legal obligations.
We do not sell personal information, share it for advertising, or use store or customer data to train AI models.
Where your data goes
Job output is delivered only to the destinations you configure: your SFTP or WebDAV server, an API endpoint, a Google Sheet, or a file you download. Once data reaches a destination you control, that system's own terms and privacy practices apply.
If you use Shopify Sidekick, it can read your job list, recent runs, and plan limits through the app to answer your questions.
Service providers
We use these providers to run the app. Each one only receives what it needs for its role.
- Shopify: the platform the app runs on, and billing for paid plans.
- Heroku (Salesforce): hosting for the app, its database, and server logs.
- Redis Cloud (Redis Ltd.): the job queue that schedules and runs your jobs.
- Google: only if you connect Google Sheets, using the Google OAuth client you provide in the app.
Our providers may process data in the United States. Where the law requires it, we rely on appropriate safeguards for international transfers.
How long we keep data
The app does not keep a customer database. Customer and order data is read from Shopify while a job runs, and temporary copies are kept only as follows:
- Run history, including rows that failed to import and export files waiting for download, is deleted after 7 days.
- Import runs left unfinished are closed and deleted after 21 days.
- Order numbers in export and order update history are kept for 90 days, and deleted sooner for any order listed in a customer deletion request.
- Event error details are deleted after 7 days, and daily event run counts after 35 days.
- Shopify API rate limit records are deleted after 7 days.
- Records of customer data requests (the customer's Shopify ID and what we found) are kept for 90 days, and deleted sooner if that customer asks to be deleted.
- Job settings, saved samples, and encrypted connection details are kept until you delete them or uninstall the app.
When you uninstall the app, its access to your store ends right away and your scheduled jobs stop. Shopify notifies us 48 hours later, and we then delete all remaining data for your store.
Customer privacy requests
Shopify forwards customer privacy requests to the app, and we respond to each one:
- Deletion requests: we delete the order history records for the orders listed in the request, and remove the customer's email address and phone number from any samples saved in your job settings.
- Data requests: we identify what the app holds about that customer and provide it to you, the merchant, so you can answer the customer. Shopify gives us 30 days to do this.
Data the app has already delivered to your own destinations, such as a file on your SFTP server or a Google Sheet, is under your control and is not changed by these requests.
Your rights
Depending on where you live, including under the GDPR in the EU and UK and the CCPA in California, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict how it is used. To make a request, email support@demandtech.ai. We will respond within 30 days. You also have the right to complain to your local data protection authority.
Security
All traffic to the app uses HTTPS. Endpoint passwords, API keys, and Google tokens are encrypted at rest with AES-256-GCM and are never sent back to your browser. Each store's data is kept separate, and access to production systems is limited to the people who need it to run and support the service. No system is perfectly secure, and if a breach affects your data we will notify you as the law requires.
Children
The app is a business tool for Shopify merchants. It is not directed at children, and we do not knowingly collect children's personal data.
Changes to this policy
When we update this policy, we change the date at the top of this page. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect.
Contact
Questions about this policy or a privacy request can be sent to support@demandtech.ai.
You can also write to us at DEMAND Technologies LLC, 12198 Southeast 158th Avenue, Happy Valley, OR 97086.