Privacy Policy

Last updated: March 11, 2026

This Privacy Policy describes how MadSync collects, uses, and protects information when you use our sneaker resale management application (MadSync) integrated with Shopify.

1. Information We Collect

1.1 Shopify Store Data

When you install our App on your Shopify store, we collect and process:

• Shop Information: Shop name, domain, email, currency, timezone, and Shopify access token
• Order Data: Order numbers, status, totals, line items, timestamps, fulfillment status, and financial status
• Customer Information: Names, email addresses, shipping addresses, and phone numbers (only as provided through Shopify orders)
• Product Information: Product titles, descriptions, SKUs, variants, sizes, prices, images, and StockX catalog links
• Inventory Data: Stock levels, product variants, inventory item IDs, and availability across locations

1.2 User Account Data

• Account Information: Email address, company name, and authentication credentials (hashed)
• Business Data: Seller information, consignor details, invoice data, and payment account information

1.3 Automatically Collected Data

• Webhook Events: Real-time notifications from Shopify for order creation, updates, product changes, and inventory updates
• API Usage Logs: Request timestamps, endpoints accessed, and response status (retained for 90 days)
• Browser Storage: JWT authentication tokens and language preferences stored in localStorage

1.4 Third-Party Data

• StockX Pricing Data: Market prices and product catalog information for pricing automation

2. How We Use Your Information

We use the collected information solely for the following purposes:

• Order Processing: Syncing orders from Shopify, tracking fulfillment, and managing order lifecycle
• Inventory Management: Real-time stock level synchronization, multi-location inventory tracking, and automatic stock updates
• Pricing Automation: Dynamic price updates based on StockX market data and custom pricing rules
• Invoice Generation: Creating compliant purchase and sales invoices with VAT calculations
• Email Notifications: Sending order confirmations, consignor sale notifications, and purchase form links
• WTB Matching: Matching Want To Buy requests with available inventory across locations
• Customer Support: Troubleshooting issues and providing technical assistance
• Service Improvement: Analyzing usage patterns to improve app functionality (anonymized data only)

We do not: Use your data for marketing purposes, sell your data to third parties, share data with advertisers, or use it for any purpose other than those explicitly stated above.

3. Shopify API Permissions

Our App requests the following Shopify API scopes:

• read_products, write_products: To sync product catalog, update prices, and manage product variants
• read_inventory, write_inventory: To track and update stock levels across locations
• read_orders, write_orders: To process orders, update fulfillment status, and manage order data

These permissions are essential for the App to function. We only access data necessary for the features you use.

4. Data Minimization

We collect only the minimum amount of personal data necessary to provide our services. We do not request or store unnecessary customer information such as browsing history, social media profiles, payment card details, or any personally identifiable information beyond what Shopify provides through orders.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS 1.2+
• Encryption at Rest: All data stored in our database is encrypted using AES-256 encryption
• Secure Authentication: JWT tokens with secure hashing algorithms
• Access Controls: Role-based access controls to limit data access
• Regular Security Updates: We maintain up-to-date security patches and monitoring

6. Data Retention

We retain your data according to the following policies:

• Active Orders: Retained indefinitely for business operations and customer service
• Archived Orders: Retained for 7 years to comply with tax and legal requirements
• Customer Data: Retained as long as necessary for order fulfillment and legal obligations
• Application Logs: Retained for 90 days for troubleshooting and security purposes
• Upon App Uninstallation: We comply with Shopify's GDPR requirements. Within 48 hours of uninstallation, we process mandatory GDPR webhooks to delete or anonymize your data as required by law. Financial records (invoices, tax documents) are retained for 7 years to comply with legal obligations.

7. Data Sharing and Third-Party Services

We do not sell, trade, or rent your personal information. We may share data only in these limited circumstances:

• Shopify: We access your Shopify store data via OAuth and Shopify API. Shopify's own privacy policy governs their data handling.
• Supabase (Database): We use Supabase for secure database hosting. Data is encrypted at rest and in transit. Supabase is SOC 2 Type II certified.
• Render (Hosting): Our application is hosted on Render with enterprise-grade security and compliance.
• StockX: We fetch public pricing data from StockX for market price synchronization. No personal data is shared with StockX.
• Email Service: We use a transactional email service to send notifications. Only necessary recipient information is shared.
• Legal Requirements: We may disclose information if required by law, court order, or to protect our legal rights.
• With Your Consent: We may share data with third parties only with your explicit consent.

All third-party service providers are carefully vetted and bound by strict data protection agreements. We ensure they comply with GDPR and applicable data protection laws.

8. Your Rights Under GDPR

You have the following rights regarding your data:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data (subject to legal retention requirements)
• Right to Data Portability: Request your data in a structured, machine-readable format (JSON/CSV)
• Right to Restriction of Processing: Request limitation of how we process your data
• Right to Object: Object to processing of your personal data for specific purposes
• Right to Withdraw Consent: Uninstall the app at any time to stop data processing
• Right to Lodge a Complaint: File a complaint with your local data protection authority

To exercise these rights, please contact us at contact@madsync.io. We will respond within 30 days as required by GDPR.

9. GDPR Compliance

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we fully comply with the General Data Protection Regulation (GDPR) and equivalent data protection laws.

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Contractual Necessity: Processing is necessary to provide the App services you requested
• Consent: You have given explicit consent for specific processing activities (e.g., marketing emails if opted in)
• Legal Obligation: Processing is required to comply with tax, accounting, and legal requirements
• Legitimate Interests: Processing is necessary for our legitimate business interests (e.g., fraud prevention, security)

Data Transfers

Your data may be transferred to and processed in countries outside the EEA. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Service providers certified under recognized data protection frameworks
• Ensuring all data transfers comply with GDPR Chapter V requirements

10. Children's Privacy

Our App is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

11. App Uninstallation and Data Deletion

When you uninstall the App from your Shopify store:

• We immediately stop collecting new data from your store
• All Shopify webhooks are automatically deregistered
• GDPR Compliance: Within 48 hours of uninstallation, Shopify sends us mandatory GDPR webhooks
• Customer Data Redaction: We anonymize all customer personal data (names, emails, addresses) in response to Shopify's customer/redact webhook
• Shop Data Deletion: We permanently delete all shop data (orders, products, inventory, sellers, invoices) in response to Shopify's shop/redact webhook
• Legal Retention: Financial records required by law (invoices, tax documents) are retained for 7 years with personal data anonymized
• Data Requests: You can request a copy of your data or immediate deletion by contacting us at contact@madsync.io

We have implemented the three mandatory GDPR webhooks required by Shopify:

• customers/data_request: Provides all data we hold about a specific customer
• customers/redact: Anonymizes customer personal data
• shop/redact: Permanently deletes all shop data

12. Cookies and Tracking

Our App does not use cookies for tracking or advertising purposes. We only use:

• Essential Storage: localStorage for authentication tokens and user preferences (language settings)
• No Third-Party Trackers: We do not use Google Analytics, Facebook Pixel, or any advertising trackers
• No Cross-Site Tracking: We do not track your activity across other websites

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Company Name: MadSync
• Email: contact@madsync.io
• Website: https://madsync.io

For GDPR-related requests (data access, deletion, portability), please email contact@madsync.io with "GDPR Request" in the subject line. We will respond within 30 days as required by law.