Privacy Policy

Last updated: April 13, 2026

1. About BennySync

BennySync is a Shopify public app that connects a merchant's Shopify store to the Benny mobile application. It allows merchants to display their product catalogue in the Benny app and track orders placed through it.

2. Data We Collect

When a merchant installs BennySync, we collect and store:

• Shop domain — e.g. yourstore.myshopify.com
• OAuth access token — used to read your store's products and orders via the Shopify Admin API
• OAuth refresh token — used to automatically renew the access token without merchant interaction
• Token expiry time — to manage secure token rotation
• Granted API scopes — the permissions approved during installation
• Installation timestamp — date and time the app was installed

We do not collect, store, or process any personal data about the merchant's customers, including names, email addresses, phone numbers, or payment information.

3. How We Use Your Data

The data we collect is used solely to:

• Authenticate API requests to your Shopify store
• Fetch your product catalogue for display in the Benny mobile app
• Fetch and filter orders placed through the Benny app to display on your dashboard
• Automatically refresh your access token to maintain a seamless connection

We do not use your data for advertising, marketing, profiling, or any purpose beyond operating the app's core functionality.

4. Data Storage & Security

All merchant data is stored securely in AWS DynamoDB hosted in the ap-south-1 (Mumbai) region. Access tokens are stored at rest and are only accessed by our Lambda functions during API requests.

• Data is encrypted in transit using HTTPS/TLS
• AWS IAM roles restrict access to only authorised Lambda functions
• No third parties have access to your tokens or store data
• Access tokens expire every 1 hour and are automatically rotated

5. Data Retention

Your merchant data (shop domain, tokens) is retained for as long as the app is installed on your store. When you uninstall the app, Shopify sends a shop/redact webhook to our servers within 48 hours, at which point your data is permanently deleted from our database.

6. GDPR Compliance

BennySync complies with Shopify's mandatory privacy requirements including GDPR. We have implemented all three required compliance webhooks:

• customers/data_request — We acknowledge customer data requests
• customers/redact — We process customer data deletion requests
• shop/redact — We permanently delete all shop data upon uninstallation

7. Third-Party Sharing

We do not sell, trade, rent, or share your data with any third parties. Your store data is used exclusively to operate the BennySync app.

8. Your Rights

As a merchant using BennySync, you have the right to:

• Request a copy of the data we hold about your store
• Request deletion of your store's data at any time
• Uninstall the app at any time, which triggers automatic data deletion

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated date. Continued use of the app after changes constitutes acceptance of the updated policy.