Privacy Policy

This policy explains what data Shopmentor [legal form] ("we", "us") processes when you visit cardsync.pro or use the CardSync app for Shopify, and what your rights are.

1. Who is responsible

Shopmentor [legal form], [registered address]. Contact: support@cardsync.pro.

2. The CardSync app — what we process

CardSync is a merchant tool. It is designed to process no customer personal data at all: we request no Shopify API access to your customers, their orders or their addresses.

When you install the app we process:

• Store identification: your .myshopify.com domain and Shopify session tokens required to operate inside your admin (legal basis: performance of contract).
• App settings: your markup, condition ratios and currency multiplier.
• Operational data: price-sync run statistics (products checked/updated, portfolio value, price changes) used to render your dashboard.
• Product data: read/written only for products CardSync creates or that you link — titles, prices, images, metafields, inventory levels.

3. Shopify privacy webhooks

CardSync implements all privacy webhooks mandated by Shopify:

• customers/data_request & customers/redact: acknowledged; since we store no customer data, there is nothing to return or erase.
• shop/redact: all data for your store — sessions, settings and sync history — is permanently deleted.
• Uninstall: the same full purge runs immediately when you uninstall the app.

4. Sub-processors

• Vercel Inc. (USA) — application hosting and content delivery.
• Supabase (AWS us-east-1, USA) — database hosting for the app data listed above.
• Collectr (USA) — market data provider; receives card catalog queries (card names/IDs), never your store's identity or data.
• [Email provider, e.g. Zoho Mail] — support email processing.

[If required for your jurisdiction: add international data transfer mechanism, e.g. SCCs.]

5. This website (cardsync.pro)

• Server logs: our host processes IP address, user agent and requested URLs for security and delivery (legitimate interest).
• Fonts: loaded from Google Fonts; your browser contacts Google servers when loading the page. [Optionally self-host fonts to remove this disclosure.]
• Cookies & tracking: this website sets no cookies and runs no analytics or advertising trackers.

6. Retention

App data is retained while the app is installed and deleted on uninstall or shop-redaction (see §3). Support emails are retained for [e.g. 24 months].

7. Your rights

Depending on your jurisdiction (e.g. GDPR), you have the right to access, rectify, erase, restrict and port your data, and to object to processing. Contact support@cardsync.pro. You also have the right to lodge a complaint with a supervisory authority.

8. Changes

We will update this policy as the product evolves and note the revision date above.