Privacy Policy

1. Who we are and how to reach us

Syncroze (“we”, “us”, “our”) — the trading name of the sole proprietorship of Amit Jagdishbhai Sidhpura, based in Gujarat, India — operates the Syncroze website and platform, and is the controller of the personal information described in this policy. For anything to do with privacy — questions, requests or complaints — email support@syncroze.com.

Where we sync data on behalf of a business customer, that customer decides what is synced and why. In that role we act as a processor on their instructions, and their own privacy notice governs the information involved.

2. Information we collect

Information you give us. Your name, email address, phone number and the content of your message when you use our contact form; your email address when you subscribe to our newsletter; and, if you create an account, your account and company details and your login credentials.

Billing information. If you subscribe to a paid plan, we collect your billing name, billing address, tax details and a record of your transactions. Card numbers are entered directly with our payment processor, Stripe — we never receive or store your full card number, and we see only a masked identifier such as the last four digits and card brand.

Credentials for connected systems. The API keys, access tokens and connection settings you provide so that Syncroze can reach the systems you choose to connect, such as your storefront, ERP or CRM.

Data synced through the platform. The records that pass between your connected systems — for example products, orders, inventory levels and customer records. These may include personal information about your own customers, such as names, email addresses, phone numbers and delivery addresses. We process this data only to perform the syncs you configure.

Technical information. When you visit the site or use the platform, our servers record standard log data: IP address, browser type and version, device and operating system, pages requested, referring page, and date and time. We also keep operational logs of sync jobs, including timestamps, record identifiers and any errors.

Cookies. We use strictly necessary cookies to keep your session secure — for example to protect forms against cross-site request forgery and, once you are signed in, to keep you signed in. See section 9.

3. How we use this information

• To provide the Service — to authenticate you, connect to the systems you authorise, run the syncs you configure, and show you their results.
• To support you — to answer your contact-form message, investigate a sync problem, and respond to billing, cancellation or refund requests.
• To bill you — to take subscription payments, issue invoices and receipts, and meet tax and accounting obligations.
• To keep the Service secure and reliable — to monitor for faults, abuse and unauthorised access, to debug, and to maintain backups.
• To improve the Service — to understand which features are used and where they fail, using aggregated or de-identified information wherever it will do.
• To communicate with you — to send service notices such as outages, security alerts and changes to our terms, and, if you have subscribed, our newsletter.
• To meet legal obligations — to comply with applicable law and to establish, exercise or defend legal claims.

We rely on the performance of our contract with you, our legitimate interests in running and securing the Service, our legal obligations, and — for the newsletter — your consent. We do not sell your personal information, and we do not use the data synced through the platform to build advertising profiles or to train models.

4. Who we disclose information to

We disclose personal information only to the following categories of recipient, and only as far as each needs it:

• The systems you connect. By design, Syncroze sends your records to the destination systems you have configured. You choose those systems and what flows to them.
• Hosting and infrastructure providers, who host our application, databases and backups.
• Our payment processor, Stripe, which processes card payments, handles refunds and performs fraud and identity checks. Stripe handles your payment details under its own privacy policy.
• Email and communication providers, which deliver our transactional email, support replies and newsletter.
• Professional advisers — accountants, auditors, insurers and lawyers — where they need the information to advise us.
• Law enforcement, regulators and courts, where we are legally required to disclose information, or where disclosure is necessary to protect our rights, your safety or the safety of others.
• An acquirer, if we are involved in a merger, acquisition or sale of assets. We will tell you before your information becomes subject to a different privacy policy.

We do not sell, rent or trade personal information, and we do not disclose it to third parties for their own marketing.

5. How we disclose it

Disclosures happen in a limited number of ways. Data moving to a system you have connected is transmitted over an encrypted connection (HTTPS/TLS) directly to that provider's API. Data reaching a service provider does so through that provider's own secured interface, under a written contract that limits them to processing the information on our instructions, requires appropriate security measures, and prohibits using it for their own purposes. Disclosures to advisers, regulators or law enforcement are made case by case, in the minimum scope required, and we will notify you unless we are legally prohibited from doing so.

Some of our providers may store or process information outside India. Where that happens, we take steps to ensure the transfer is lawful and that a comparable standard of protection travels with the information, including through appropriate contractual safeguards.

6. How we protect your information

We maintain technical and organisational security measures appropriate to the risk, including:

• encryption in transit — the site and platform are served over HTTPS/TLS, and all calls to connected systems use encrypted connections;
• encryption at rest for credentials and access tokens for connected systems, which are stored encrypted and are never displayed back to you in full;
• passwords stored only as salted one-way hashes, never in a readable form;
• card details handled entirely by Stripe, a PCI-DSS Level 1 certified provider, so that they never reach our servers;
• access control on a least-privilege, need-to-know basis for our personnel, with individual accounts and multi-factor authentication on administrative systems;
• logical separation of customer data, so one customer's records are not exposed to another;
• regular patching of our servers and dependencies, encrypted backups, and monitoring and logging to detect faults and suspicious activity; and
• an incident response process — if a breach affects your personal information, we will notify you and the relevant authorities as required by law and without undue delay.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please help protect your account by using a strong, unique password and telling us promptly if you suspect any unauthorised use.

7. How long we keep it

We keep personal information only as long as we need it for the purposes above. Account and connection details are kept while your account is active and deleted within 30 days of account closure, except where we must keep them longer. Data synced through the platform is retained only as long as needed to run and audit the syncs you have configured. Billing and tax records are kept for the period required by applicable tax law. Contact-form messages are kept while we deal with your enquiry and for a reasonable period afterwards; newsletter subscriptions until you unsubscribe. Server and sync logs are kept for a limited period for security and troubleshooting, then deleted or aggregated.

8. Your rights and choices

Subject to applicable law, you may ask us to give you access to the personal information we hold about you, correct it if it is inaccurate or incomplete, delete it, restrict or object to certain processing, or provide it in a portable form. Where we rely on your consent — such as for the newsletter — you may withdraw it at any time, without affecting processing already carried out. Every newsletter includes an unsubscribe link; service and billing notices are not marketing and cannot be opted out of while your account is active.

To exercise any of these rights, email support@syncroze.com. We may need to verify your identity first, and we will respond within the period required by applicable law. If your information was synced through the platform by one of our business customers, we will refer your request to that customer, who decides how the data is used.

If you believe we have not handled your information properly, please contact us first so that we can put it right — and you also have the right to complain to the data protection authority in your jurisdiction.

9. Cookies

Our site uses only cookies that are strictly necessary to make it work: a session cookie and a cross-site request forgery token that protect our forms, and, once you sign in, a cookie that keeps you signed in. We do not use advertising cookies or sell data to advertisers. You can block or delete cookies in your browser settings, but the forms and sign-in will not work without the necessary ones.

Our pages load web fonts and an icon stylesheet from Google Fonts and Cloudflare's CDN, and those providers may receive your IP address and browser details when serving those files.

10. Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The current version is always published at www.syncroze.com/privacy-policy, with the date it last changed shown at the top. If a change is material, we will give you notice by email or in the Service before it takes effect.

12. Contact us

For any privacy question or request, email support@syncroze.com or use our contact form.