Privacy policy

1. Who we are

Syncato ("we", "us", "our") operates the Syncato app and this website. We publish the Syncato: TikTok Shop Connector application on the Shopify App Store, which connects one or more TikTok Shops to a single Shopify store.

This policy covers that application and this website only.

2. Roles and responsibilities

When you install the application, you instruct us to move data between your Shopify store and the TikTok Shops you have authorised. In that processing you are the data controller and we act solely as your data processor. We do not determine the purposes of that processing and we do not use the data for our own purposes.

For information you give us directly through this website, such as a support enquiry, we act as the controller.

You are responsible for having a lawful basis to disclose your customers' personal information to us, and for maintaining your own privacy notice covering the sale channels you operate.

3. Information we collect

3.1 Information you give us

• Account and contact details: name, business name, email address, and the Shopify store domain.
• Support communications: the content of messages, tickets and attachments you send us.
• Configuration you set in the app: pricing rules, category mappings, stock locations, and which shops and products to publish.

3.2 Information collected automatically

• Application logs: timestamps, the action attempted, the result, and any error returned by Shopify or TikTok Shop.
• Website analytics: IP address, browser and device type, pages viewed, referring URL, and time zone.

3.3 Information from Shopify

On installation you grant the application specific API scopes. Within those scopes we access only what the app's functions require: products, variants, SKUs, images, prices, inventory levels and locations, orders and their line items, fulfilments and tracking, refunds and returns, and store settings such as currency and locations. We do not request scopes the app does not use.

3.4 Information from TikTok Shop

When you authorise a TikTok Shop, we access that shop's listings, inventory, orders, fulfilment status, cancellations and returns through the TikTok Shop Partner API. Section 4 describes buyer information in detail.

4. TikTok Shop buyer information

This section applies to every merchant who connects a TikTok Shop.

What we access

To create a fulfillable order in your Shopify store we retrieve, for each order: the buyer's name, the shipping address, the contact details TikTok makes available for delivery, the order's line items and quantities, the shipping method selected, and the order value.

Why it is necessary

An order cannot be picked, packed, labelled or shipped without a delivery address. This data is the minimum required to perform the function you installed the app to perform, and nothing beyond that minimum is requested.

How it is used

• Creating the corresponding order in your Shopify store with accurate delivery details.
• Returning fulfilment status and tracking numbers to TikTok Shop.
• Reflecting cancellations, returns and refunds against the correct order.

What we do not do

• We do not sell, rent or licence buyer information to anyone.
• We do not use buyer information for marketing, advertising or profiling, ours or anyone else's.
• We do not use buyer information for analytics, benchmarking, market research or aggregate reporting.
• We do not use buyer information, or your catalogue or order data, to train machine learning models.
• We do not disclose buyer information to any party other than the subprocessors named in section 6, and only to the extent needed to deliver the order to your store.
• We do not make buyer information visible to any merchant other than the one who authorised the shop.
• We do not retain buyer information beyond the periods stated in section 9.

Access controls

Buyer information is encrypted at rest and in transit, is segregated per merchant, and is reachable only by named personnel under role-based access control with multi-factor authentication, on the principle of least privilege. Every access is written to an audit log.

5. How we use information

We use the data described above only to:

• Operate the synchronisation functions you have enabled.
• Diagnose and resolve sync failures, and show you why an item or order was held.
• Answer your support requests.
• Protect the security and integrity of the service, and detect abuse.
• Meet our legal and regulatory obligations.

We send service messages about incidents, breaking changes and required action. Marketing email is sent only with your consent and every message carries an unsubscribe link.

6. Who we share information with

We do not sell personal information, and we have not done so in the preceding twelve months. We disclose it only in these circumstances:

• Subprocessors. Infrastructure, database, error monitoring and support-desk providers, each under a written agreement imposing confidentiality and security obligations no weaker than those in this policy. A current list of subprocessors is available on request through the live support chat inside the Syncato app, and we will give notice before adding one that processes buyer information.
• Shopify and TikTok Shop. As inherent in the function of the app, and governed by their own terms.
• Legal process. Where compelled by law, court order or valid legal process, or to protect rights and safety. Where we are legally permitted to do so, we will notify you first.
• Corporate transaction. In a merger, acquisition or sale of assets, subject to confidentiality and to this policy continuing to apply to the transferred data.

7. Cookies and tracking

This website uses cookies for necessary functions and for aggregate analytics. The application itself uses only session cookies required to keep you signed in inside the Shopify admin. We do not place advertising or cross-site tracking cookies on your storefront, and the application does not inject any script into your storefront.

You can block or delete cookies in your browser. Doing so may affect parts of this website.

8. Security

• TLS 1.2 or higher for all data in transit.
• AES-256 encryption for data at rest, with keys held in a managed key service.
• API credentials and tokens held in a dedicated secrets manager, never in source code or logs.
• Role-based access control, multi-factor authentication, and least-privilege access for personnel.
• Per-merchant data segregation, so one merchant's data is never returned to another.
• Audit logging of access to buyer information, with regular review.
• Vulnerability scanning, dependency patching, and periodic penetration testing.

No system is perfectly secure. If a breach affects your data we will notify you and the relevant authorities without undue delay and, where a legal deadline applies, within it. We will tell you what happened, what data was involved, and what we are doing about it.

9. Retention and deletion

We honour Shopify's mandatory compliance webhooks for customer data requests, customer redaction and shop redaction, and we act on TikTok Shop deletion notifications the same way. You may also request deletion at any time by contacting us through the live support chat inside the Syncato app, and you may revoke the application's access from your Shopify admin or from TikTok Seller Center without contacting us at all.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or port your personal information, to object to or restrict processing, to withdraw consent, and to opt out of marketing. You also have the right not to be discriminated against for exercising these rights.

Contact us through the live support chat inside the Syncato app. We reply within 30 days for requests under the GDPR or UK GDPR, and within 45 days under the CCPA or CPRA, and we will tell you if we need an extension the law allows.

If the request concerns a shopper rather than a merchant account, we will forward it to the merchant who controls that data, since we hold it only as their processor. If you are in the EEA or UK you may also complain to your local supervisory authority.

11. International transfers

We are based in the United States and our infrastructure is located there. Where data is transferred out of the EEA, the UK or Switzerland we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary technical measures including the encryption described in section 8. A copy of the relevant clauses is available on request.

12. Children

The application is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe we hold such information, contact us through the live support chat inside the Syncato app and we will delete it.

13. Third-party links and services

This website and the application link to Shopify, TikTok and other third-party services. A link is not an endorsement and does not imply affiliation. Those services are governed by their own terms and privacy policies, which we do not control.

TikTok, TikTok Shop and Shopify are trademarks of their respective owners. Syncato is an independent developer and is not affiliated with, endorsed by or acting on behalf of TikTok or Shopify.

14. Changes to this policy

We review this policy at least annually. When we make a material change we update the date at the top, and where the change affects how buyer information is handled we notify active merchants by email at least 14 days before it takes effect. Continued use after the effective date constitutes acceptance. Superseded versions are kept and available on request.

15. Contact

See also our Terms of Service.