Account
Privacy & GDPR
What we store, what we never store, and the webhooks.
What the app stores, what it deliberately doesn't, and how the GDPR webhooks are handled.
What we store#
- Shop record
- your domain, plan, entitlements, install state and access token.
- Configuration
- mapped collections, filter mappings, normalization rules, ranking weights, copy templates.
- Fitment data you supply
- CSV rows, sheet contents, tag-derived mappings, editor overlays.
- Derived search documents
- the indexed representation of your catalog, in your own search collection.
- Aggregate analytics
- query strings, vehicle selections and counts, with no identifiers attached.
What we never store#
- Customer names, emails, phone numbers, addresses or payment details
- Order contents, totals or fulfilment data — only the line item properties the app itself wrote
- Payment information of any kind
- IP addresses or session tokens in analytics
- Your product data in any shared table — your index is yours alone
The app requests read_customers and write_customers, but they reach exactly one field — the wysync.garage customer metafield that stores a logged-in shopper's saved vehicles. No other customer field is read or written, and no feature in the app uses one. read_orders likewise reads only the line item properties the app itself wrote. Shopify classifies all three as Protected Customer Data; the app privacy policy sets out the scope-by-scope detail.
Analytics and personal data#
Search analytics record the query text, scrubbed of anything shaped like an email address or phone number, with no customer ID, IP or session identifier. This is why the GDPR customer redact webhook has no analytics work to do: there is nothing keyed to a person to erase.
The GDPR webhooks#
| Webhook | What we do |
|---|---|
customers/data_request | Respond with the customer data we hold for that shop — which is none, other than a garage metafield if the customer saved vehicles while logged in. |
customers/redact | Clear any saved garage metafield for that customer. Analytics needs no action, as above. |
shop/redact | Delete the shop's configuration, fitment data, index and analytics 48 hours after receipt. |
All three are HMAC-verified and shop-scoped.
Where data lives#
Application data is in a managed MySQL instance; search indexes are per-shop collections in Typesense; the cache is Redis, keyed by shop. Data is processed in the United States. Sub-processors are Shopify, our hosting provider, the search host and the cache host — the current list is available on request and named in the subscription agreement.
Isolation#
Every query, index name, cache key and webhook handler is scoped to one shop. There is no "default shop" fallback anywhere in the codebase; a single-tenant assumption is treated as a bug, not a shortcut.
Support is answered by the people who wrote this code — not a ticket queue.