Privacy Policy

1. Introduction

SyncInOrder ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using our Service, you agree to the collection and use of information as described here.

2. Information We Collect

2.1 Information you provide directly

• Name, email address, and password when you create an account.
• Business name, industry, and monthly order volume.
• GST Identification Number (GSTIN) if provided.
• Phone number for WhatsApp notifications (optional).
• Payment information processed through Razorpay (we do not store card numbers).

2.2 Information from connected marketplaces

When you connect a marketplace account (Shopify, Amazon, Flipkart, Meesho), we receive and store:

• Order details: order IDs, customer names, delivery addresses, item details, and order values.
• Customer phone numbers and email addresses associated with orders.
• Product catalogue data (SKUs, inventory levels, pricing).
• Settlement and payment data from marketplace reports you upload.
• Marketplace API access tokens (stored encrypted using AES-256-GCM).

2.3 Information collected automatically

• IP address and browser/device information for security and rate-limiting.
• Usage data such as pages visited and features used, via Sentry for error monitoring.
• Log data including API request timestamps and sync activity.

3. How We Use Your Information

• To provide, operate, and improve the Service.
• To sync your orders across connected marketplaces.
• To run RTO risk analysis on your orders, including AI-assisted analysis via Anthropic's Claude API.
• To detect discrepancies in marketplace settlement reports.
• To send transactional emails (account verification, password reset, billing confirmations, monthly digests).
• To send WhatsApp notifications for order events, if you have enabled this feature.
• To generate GST-related exports from your order data.
• To prevent fraud, abuse, and unauthorised access.
• To comply with applicable Indian laws and regulations.

4. Legal Basis for Processing

We process your data on the following grounds: (a) performance of a contract — to deliver the Service you signed up for; (b) legitimate interests — to operate and improve our platform securely; (c) compliance with legal obligations under Indian law, including the Information Technology Act, 2000 and applicable data protection rules; and (d) your consent, where explicitly provided (e.g., for WhatsApp notifications).

5. Third-Party Services

We share data with the following third parties only to the extent necessary to operate the Service:

• MongoDB Atlas — cloud database hosting for all your stored data.
• Vercel — cloud infrastructure and hosting.
• Resend — transactional email delivery.
• MSG91 — WhatsApp message delivery (only if you enable WhatsApp alerts).
• Razorpay — payment processing. Razorpay's privacy policy applies to payment data.
• Anthropic (Claude API) — AI-powered RTO analysis. Order summaries are sent for analysis; we do not send personally identifiable customer data beyond what is necessary.
• Sentry — error monitoring and performance tracking.
• Upstash Redis — rate limiting and short-lived session data.

We do not sell your data to any third party for marketing or advertising purposes.

6. Data Security

We take reasonable technical and organisational measures to protect your data:

• Marketplace API tokens are encrypted at rest using AES-256-GCM.
• All data is transmitted over HTTPS/TLS.
• Passwords are hashed using bcrypt with a cost factor of 12.
• Access to production systems is restricted by role.
• Rate limiting is applied to all authentication endpoints to prevent brute-force attacks.

Despite these measures, no system is completely secure. We encourage you to use a strong, unique password and to contact us immediately at hello@syncinorder.com if you suspect a security incident.

7. Data Retention

We retain your account and business data for as long as your account is active or as needed to provide the Service. If you terminate your account, we will delete your data within 30 days, unless we are required to retain it longer by law (for example, for tax or audit purposes). Anonymised or aggregated data that cannot identify you may be retained indefinitely for analytics purposes.

8. Your Rights

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — request deletion of your account and associated data.
• Portability — receive your order data in a machine-readable format.
• Withdrawal of consent — opt out of WhatsApp notifications at any time via Settings.

To exercise any of these rights, email us at hello@syncinorder.com. We will respond within 30 days.

9. Cookies

We use only essential cookies required for authentication (session tokens via NextAuth). We do not use tracking, advertising, or analytics cookies. You can disable cookies in your browser, but this will prevent you from logging in.

10. Children's Privacy

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email or via an in-app notice. The "Effective date" at the top of this page indicates when the policy was last updated. Continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

12. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

13. Contact Us

For any privacy-related questions, data requests, or to report a concern, contact us at: hello@syncinorder.com.