Privacy Policy

Effective Date: February 20, 2026

This Privacy Policy describes how PromoSync (“we”, “our”, or “the app”), operated by PSRESTful, collects, uses, and protects information when you install and use the PromoSync Shopify application.

Information We Collect

Shop Data

When you install PromoSync, we collect and store:

Shopify shop domain and store name
OAuth access tokens issued by Shopify for API access
App configuration preferences (pricing strategy, inventory settings, import defaults)

Product and Supplier Data

During normal operation, PromoSync processes:

Product data imported from PromoStandards/PSRESTful suppliers (titles, descriptions, images, pricing, inventory levels)
Variant and metafield data synced to your Shopify store
Supplier configuration (supplier codes, brand mappings, custom pricing rules)

Order Data

Order data is only accessed when you enable the Procurement / Purchase Order feature.

When Procurement is enabled, PromoSync accesses:

Order line items (product names, SKUs, quantities)
Shipping addresses (recipient name, street address, city, state/province, postal code, country)

This data is used exclusively to generate purchase orders for your configured promotional product suppliers.

Session and Authentication Data

Shopify session tokens for authenticating requests between your store and PromoSync
No passwords are collected or stored by PromoSync directly

How We Use Information

Data	Purpose
Shop domain & tokens	Authenticate API calls and manage your app installation
Product data	Sync products, pricing, and inventory from suppliers to your Shopify store
Order line items	Generate purchase orders for your suppliers
Shipping addresses	Include fulfillment addresses on purchase orders sent to suppliers
Configuration settings	Apply your preferred pricing, inventory, and import rules

We do not use your data for advertising, profiling, or any purpose unrelated to the operation of PromoSync.

With Suppliers

When you use the Procurement feature to generate purchase orders, shipping addresses and order details are shared with your configured promotional product suppliers so they can fulfill orders. You control which suppliers receive this data through your procurement settings.

With Third Parties

We do not sell your data to any third party
We do not share your data with third parties for marketing purposes
PromoSync communicates with the PSRESTful API to retrieve supplier product data on your behalf
We use Shopify’s APIs to read and write data to your store, as authorized by the scopes you approve during installation

Data Retention

Data	Retention
Shop data & configuration	Retained while the app is installed on your store
Product sync data	Written directly to your Shopify store; not stored separately by PromoSync
Order & shipping data	Used transiently during purchase order generation; not persisted after PO creation
OAuth tokens	Revoked and deleted when you uninstall the app

Upon app uninstallation or upon your request, we delete all shop data and configuration from our systems.

Shopify Compliance Webhooks

PromoSync implements all mandatory Shopify data privacy webhooks:

customers/data_request — We confirm that no customer data is retained; order data used for purchase order generation is transient and not persisted
customers/redact — We acknowledge the request; since no customer data is stored, no deletion action is required
shop/redact — We delete all archived shop data, including uninstalled shop records, when Shopify requests redaction

Data Security

We protect your data through:

HTTPS encryption for all data in transit
Infrastructure-level encryption at rest — database and application data reside on encrypted volumes (Fly.io)
Encrypted database connections — PostgreSQL connections use TLS in production
Environment-based secret management — credentials and API keys are stored as encrypted platform secrets, never in source code
OAuth 2.0 authentication with Shopify (we never see or store your Shopify password)
Scoped API access — PromoSync only requests the Shopify permission scopes required for its features
Session token verification for all authenticated requests

For details on how we handle security incidents, see our Security Incident Response Policy.

For a complete mapping of how PromoSync meets all Shopify Protected Customer Data Access requirements, see our Data Protection Compliance page.

Data Loss Prevention

PromoSync employs a layered data loss prevention strategy to minimize risk of unauthorized data exposure:

Minimal data collection — Product and inventory data is written directly to your Shopify store via the Admin API; PromoSync does not maintain a separate copy. Order and shipping data used for purchase orders is processed transiently and not persisted.
Automatic data archival on uninstall — When you uninstall the app, shop configuration is archived internally before deletion, ensuring a clean and auditable removal process.
Environment-based secret management — All credentials and API keys are stored as encrypted environment secrets on our hosting platform (Fly.io), never in source code or configuration files.
Scoped API access — PromoSync requests only the minimum Shopify permission scopes required for its features, limiting the blast radius of any potential compromise.
Webhook signature verification — All incoming Shopify webhooks are validated using HMAC-SHA256 signatures, preventing spoofed or tampered data injection.
Containerized deployment — The application runs as a non-root user inside isolated Docker containers with concurrency limits enforced at the infrastructure level.
HTTPS enforced — All traffic between your browser, Shopify, and PromoSync is encrypted in transit. HTTPS is enforced at the infrastructure level with no option to downgrade.
Access logging — All access to endpoints handling protected customer data is logged with timestamp, shop domain, HTTP method, endpoint path, client IP address, and response status code.
GDPR compliance webhooks — customers/redact and shop/redact webhook handlers ensure customer and shop data is removed promptly upon request.

Merchant Rights

As a PromoSync merchant, you have the right to:

Access your data — View all configuration and synced data through the app dashboard
Export your data — Request a full export of your stored configuration by contacting us
Delete your data — Uninstall the app to trigger automatic data deletion, or contact us for immediate removal
Control permissions — Review and manage the Shopify API scopes granted to PromoSync from your Shopify admin

⚠️

Uninstalling PromoSync will remove app configuration data from our systems. Products already synced to your Shopify store will remain in your store and are not affected by uninstallation.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

The Effective Date at the top of this page will be updated
For significant changes, we will notify merchants through the app dashboard

We encourage you to review this policy periodically.

Contact Us

If you have questions about this Privacy Policy or your data:

Email: support@psrestful.com
Website: psrestful.com/contact-us

Data Protection Incident Response Policy