Privacy Policy

This policy explains how VentroSync handles information when merchants connect sales channels and use inventory, order, customer, purchasing, and reporting tools.

Effective and last updated: October 3, 2026

1. Who controls the data

VentroSync operates VentroSync. For merchant business data, the merchant is generally the controller and we act as its service provider or processor. Privacy questions can be sent to privacy@ventrosync.com.

2. Information we process

• Merchant account information, including authorized users, contact details, roles, and sign-in records.
• Connected-store information, OAuth tokens, granted scopes, store identifiers, product mappings, inventory, orders, and synchronization logs.
• Customer information supplied through connected stores, which may include names, email addresses, phone numbers, and billing or shipping addresses.
• Operational records entered by merchants, such as products, warehouses, purchase orders, vendors, expenses, employees, and uploaded documents.
• Security and diagnostic information needed to protect the service and troubleshoot failures.

3. Why we use information

We process information to provide the features selected by the merchant: synchronize products and inventory, import or create orders, maintain customer and operational records, generate reports and backups, prevent duplicate events, secure accounts, provide support, and meet legal obligations. We do not sell personal information or use Shopify customer data for independent advertising.

4. Shopify data

Shopify data is requested only through scopes approved by the merchant. Access tokens are encrypted at rest. Signed webhooks are verified before processing. When protected customer data is unavailable, VentroSync imports the operational order without inventing or exposing customer details.

5. Sharing and service providers

Information is shared only as needed with infrastructure, database, email, logging, and file-storage providers that help operate the service, or when the merchant directs a synchronization to a connected platform. We may disclose information where legally required or to protect users and the service.

6. Retention and deletion

We retain merchant data while the workspace is active and for only as long as needed for the purposes above, contractual obligations, fraud prevention, backups, and applicable accounting or legal requirements. Shopify uninstall events revoke the local connection. Shopify privacy requests are HMAC-verified and processed for customer access, customer erasure, and shop erasure. Data that must legally be retained is restricted and deleted when that obligation ends.

7. Security

We use HTTPS, encrypted integration credentials, tenant-scoped access controls, permission-based roles, private document storage, webhook authentication, and activity records. No online service can guarantee absolute security; merchants should use strong passwords and limit staff permissions.

8. International processing

Information may be processed in countries where our infrastructure or service providers operate. We use appropriate contractual and technical safeguards where required.

9. Your choices and rights

Merchants can update records, disconnect stores, export workspace data, and request deletion. Customers should normally contact the merchant that collected their information. We assist merchants with valid access, correction, portability, objection, and deletion requests as applicable.

10. Contact