Privacy Policy · Sync Notify

Who we are

Sync Notify is a product of Dev Jins (devjins.com), a business based in Pakistan. In this policy, "Dev Jins", "we", "us" and "our" mean Dev Jins. Sync Notify is a Shopify app that sends automated emails for Shopify stores through each merchant's own SMTP email account.

This policy covers the Sync Notify Shopify app, the public website at syncnotify.com, and the unsubscribe pages we host for stores. It explains what we collect, why, how long we keep it, who we share it with, and the choices and rights you have. It is effective from 4 October 2026.

Merchants: Shopify store owners and staff who install and use Sync Notify. For merchant account information, Dev Jins is the data controller.
Store customers: People who shop at a merchant's store and receive emails from it. For their information, the merchant is the data controller and Dev Jins is the data processor (a "service provider" under US state privacy laws), acting only on the merchant's instructions.
Visitors: People who browse syncnotify.com or contact us. For their information, Dev Jins is the data controller.

Data we collect

From merchants

Store details from Shopify when you install the app: store domain and name, store contact email, store address, currency and money format, timezone, default language, and the logo, colours and fonts used for branding.
SMTP settings you enter: host, port, encryption type, username, password, From name, From email, optional Reply-To address and optional sending limits. The password is encrypted at rest and is never shown again after you save it.
Your plan, trial dates and billing status from Shopify Billing. Payments are handled by Shopify; we do not receive card or bank details.
Content you create in the app: automations, sequences, conditions, templates, translations, brand settings and attribution settings.
Usage and diagnostic information such as onboarding progress, send counts, queue state, SMTP errors and app logs, used to run and support the service.
Messages you send to our support team.

The store details, SMTP settings and billing status are needed to provide the app. Without a working SMTP connection the app cannot send emails.

About store customers, on the merchant's behalf

To run a merchant's automations, the app keeps its own synced copy of that store's customer and order data, received from Shopify through its APIs and webhooks. We request only the data the features need:

Customer details: name, email address, marketing consent status, language, tags, country and city, total spent and order count.
Order and checkout details: order number, totals, products and collections, discount codes used, fulfilment and shipping status, refunds, and checkout updates used for abandoned cart emails.
Email activity: which emails were queued, sent, failed or are waiting, the failure reason, and the time of opens (through a tracking pixel) and clicks (through a redirect link). Open and click requests can include technical data such as IP address and device or browser type.
Unsubscribe and suppression status, including manual suppressions set by the merchant.
Orders attributed to an email, used to report revenue to the merchant.

We do not collect payment card details, passwords of store customers, or special categories of data such as health or religious information.

From visitors

Contact form details you submit: your name, email address, store domain if you give it, and your message.
Standard server logs, such as IP address, browser type, page requested and time, kept for security and troubleshooting.

Cookies and analytics

The website does not use cookies, analytics tools or third-party tracking, and it does not store anything in your browser. The tracking pixel and click links in emails are part of the merchant's email service, described above.

How we use data

Providing the service: Syncing store data, evaluating triggers and conditions, queuing emails and sending them through the merchant's own SMTP account within its limits, and showing merchants their send logs, opens, clicks, orders and attributed revenue. Legal basis for merchant data: performance of our contract with the merchant. For store customer data, we act on the merchant's instructions and the merchant chooses the legal basis.
Service emails: Sending merchants SMTP failure alerts, trial reminders and important notices about the service or these terms from our own system mailbox. Legal basis: performance of our contract.
Support: Answering messages from merchants and visitors. Legal basis: performance of our contract, or our legitimate interest in answering questions sent to us.
Security and abuse prevention: Keeping the service secure, monitoring bounce and unsubscribe rates, and suspending sending for stores that break our Terms. Legal basis: our legitimate interests in protecting the service, email recipients and email providers, and our legal obligations.
Legal: Meeting legal obligations, answering lawful requests from authorities, and establishing or defending legal claims. Legal basis: legal obligation and our legitimate interests.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use store customer data for our own marketing, for advertising, to train models, or to build profiles across stores. Each store's data is kept separate from every other store's. We do not make decisions based solely on automated processing that have legal or similarly significant effects on anyone.

Marketing emails to store customers rely on the consent the merchant has collected through Shopify. Where we rely on legitimate interests, you can object at any time by contacting us.

How store customers' data is handled

Store customers do not have a Sync Notify account. The merchant decides which emails to send and to whom, and Dev Jins processes customer data only to carry out those instructions and as set out in the Data Processing Addendum in our Terms of Service.

Emails are sent from the merchant's own email account, not from a Sync Notify sending service.
Marketing emails are sent only to customers whose Shopify marketing consent allows it and who have not unsubscribed or been suppressed. Transactional emails, such as shipping updates, are sent for an order the customer placed.
Every email carries a footer the merchant cannot remove, with the store's name, postal address and a one-click unsubscribe link, as required by CAN-SPAM, CASL, the GDPR and Pakistan's PECA.
Unsubscribe requests take effect immediately, well inside the 10 business days that CAN-SPAM and CASL allow. The unsubscribe page shows the store's own branding.
Sync Notify staff can view a store's data only read-only, for support and abuse checks, and every such view is recorded in an audit log.

If you are a store customer and want to access, correct or delete your data, please contact the store you bought from. Shopify forwards your request to us, and we act on it as described below. If you contact us directly, we will pass your request to the store and help it respond.

Data retention

We keep personal data only as long as we need it for the purposes above:

Send log entries (one record per email): 90 days.
Raw Shopify webhook events: 30 days.
Synced customer and order data: while the app is installed. When a store uninstalls, Shopify sends a store deletion request about 48 hours later and we delete the store's synced data then.
A single customer's data: deleted when we receive a customer deletion request for them.
SMTP credentials: deleted with the store's data, or when the merchant removes them.
Encrypted database backups: up to 14 days, after which deleted data is gone from backups too.
Records of a store's trial: the store domain and trial dates are kept after uninstall so that a trial is given once per store.
Support messages and contact form messages: 24 months.
Audit log entries of staff access: 24 months, for security and accountability.
Server and security logs: up to 30 days.

We may keep data longer only where the law requires it or where it is needed to establish or defend a legal claim, and only for as long as that need lasts.

Your rights

European Union, United Kingdom and Switzerland

You have the right to access your personal data, to correct it, to delete it, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting earlier processing. You also have the right to complain to your local data protection authority or, in the United Kingdom, to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first.

California and other US states

Under the California Consumer Privacy Act as amended by the CPRA, and similar laws in other US states, you have the right to know what personal information we collect, use and disclose, to access it, to correct it, to delete it, and not to be treated differently for using these rights. In the last 12 months we have collected the categories described in "Data we collect": identifiers (such as name, email and IP address), commercial information (such as plan and order data), internet activity (such as email opens and clicks and server logs) and the content of messages. We collect them from you, from Shopify and from your device, for the purposes in "How we use data", and disclose them only to the service providers listed below.

We do not sell or share personal information, and we do not use or disclose sensitive personal information for any purpose that would give a right to limit it. You can make a request yourself, or through an authorised agent, at privacy@syncnotify.com. For store customer data, we act as the merchant's service provider and will pass your request to the store.

Pakistan and other countries

We handle data in line with the Prevention of Electronic Crimes Act 2016 and the privacy laws that apply where you live. You can contact us at privacy@syncnotify.com to use any right those laws give you.

Third-party services

We use a small number of service providers (sub-processors) to run Sync Notify. Each receives only the data it needs and is bound by a written contract to protect it:

Hostinger: Servers in its Frankfurt, Germany data centre, where the app, database and file storage run, and the mailbox we use for service emails to merchants.
Cloudflare (R2): Encrypted off-site database and file backups, stored in the European Union (Cloudflare R2 EU jurisdiction).
Vercel: Hosts the public website syncnotify.com and its server logs until the website moves to our Hostinger servers.
UptimeRobot: External uptime checks of our public endpoints. It does not receive store or customer data.

Sync Notify also works with services that the merchant chooses and contracts directly. Shopify provides the app platform, store and customer data, privacy requests and billing under the merchant's agreement with Shopify. The merchant's SMTP provider (for example Google, Microsoft, Zoho or Hostinger) carries the emails under the merchant's own agreement with that provider. We do not control how these services use data.

We may also disclose data if the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganisation of our business, in which case this policy will continue to apply to the data.

International transfers

Our servers and backups are in the European Union. Dev Jins is based in Pakistan, and our team accesses data from there to run and support the service. Some service providers are based in other countries, such as the United States.

Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, including Pakistan, we rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK law applies, together with the security measures described below. These clauses are part of the Data Processing Addendum in our Terms of Service. You can ask for a copy at privacy@syncnotify.com.

Security

SMTP passwords and Shopify access tokens are encrypted at rest and never displayed after saving.
Data is encrypted in transit with TLS.
Each store's data is isolated from every other store.
Only authorised staff who need it for their work can access store data. Staff access to the admin panel requires two-factor authentication, is read-only for store data, and is audit logged.
Backups are encrypted and stored with a different provider from our servers.

No method of transmission or storage is completely secure. If a personal data breach happens, we will inform affected merchants without undue delay so they can meet their own obligations, and we will notify the authorities and affected people where the law requires it.

Children

Sync Notify is a business tool for Shopify merchants and is not directed at children under 16. We do not knowingly collect children's data for our own purposes. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the effective date. For material changes, we will also tell merchants in the app or by email before they take effect.

Contact information

Sync Notify is a product of Dev Jins. For privacy questions or requests, email privacy@syncnotify.com. For anything else, email support@syncnotify.com or use the Contact page.

Privacy policy.