Legal
Privacy policy
Last updated 3 November 2026
1. Who we are
SyncFlow is an online tool that helps businesses selling on marketplaces such as Amazon, Flipkart and Meesho manage their products, stock, costs and team. It is operated by CYCUS INNOVATIONS, Kerala, India ("SyncFlow", "we", "us").
This policy explains what personal data we collect, why, how we protect it and the choices you have. It applies to our website and to the SyncFlow app. If you have a question, write to us at syncflow25@gmail.com.
2. What we collect
We collect only what we need to run SyncFlow for you:
- Demo requests. When you book a demo: your name, business name, email address, phone number, the marketplaces you sell on and any message you write. We also note the internet (IP) address the request came from, only to stop the form being misused.
- Your account. Your name, email address and password. Your password is stored only in a scrambled (hashed) form that cannot be turned back into the password. If you sign in with Google, we receive your name, email address and profile picture from Google.
- Sign-in and activity records. When you sign in we keep a session, with the IP address and browser it came from, so you stay signed in and so suspicious use can be spotted. Changes made in the app (for example editing a product or inviting a person) are recorded with who made them, when, and from which IP address and browser, so each business has a reliable history.
- Your business's information. What you and your team put into SyncFlow: business details (such as name, GSTIN and address), products, prices, costs, stock, sales channels and the people you invite with their roles.
- Billing records. The amounts and dates of payments you make to us and a payment reference. We do not collect or store card numbers or bank login details.
- Partners. If a firm brought your business to SyncFlow, its name and contact details, which business it brought, the coupon used and its commission on what that business pays us. The business itself sees none of this.
- Packing videos. If you use the packing station, videos of parcels being packed (which may show your staff and their hands) are saved on your own computer. We keep only what each video is of, when, by whom, and a fingerprint of the file. A video you send for a claim is stored in our cloud (Amazon Web Services, Singapore) for 30 days. If your business keeps every video in the cloud, each is stored there for the number of days you choose, then deleted.
- Marketplace data (when you connect a marketplace). If you choose to connect a marketplace account, such as your Amazon seller account, we receive the information you authorise: your listings, prices, fees and stock levels, and your orders (order number, items, quantities, amounts, status and the state the order goes to). We do not receive or keep buyers' names, phone numbers or addresses. If you turn on sending stock, we also update your stock quantities on the marketplace. With the Payments feature we also receive your marketplace payouts: what the marketplace paid you and for which order (sales, fees, refunds, reimbursements, TCS and TDS) and the last digits of the bank account it went to. See Marketplace data below for the extra rules that apply. We also receive your marketplace's returns and reimbursement reports (order number, item, quantity, reason, condition and amounts); customers' comments in them are not kept.
- Your own customers (when you enter orders by hand). If you add orders taken outside the marketplaces, for example on Instagram, WhatsApp or by phone, we keep the customer details you type in with the order: name, mobile number, delivery address, pincode and state. Your business decides what to enter and should have its customers' agreement; we use these details only to run your orders. They are shown only to people in your business allowed to see customers, and they are never copied into the change history.
- Your suppliers (when you record purchases). If you record what you buy, we keep the supplier details you type in: business name, GSTIN, state and, if you add them, a contact phone number, email and address. They are used only to run your purchases, and you can change or archive a supplier at any time.
We do not knowingly collect information about children. SyncFlow is meant for businesses and for people aged 18 or over.
3. How we use it
- To provide SyncFlow: run your account, show your business's data to the people you allow, and calculate stock and profit.
- To contact you about a demo you asked for, about your account and billing, and to send the emails the app needs (such as invitations and password resets).
- To keep SyncFlow secure: preventing misuse, investigating problems and keeping records of changes.
- To meet legal and tax obligations.
We do not sell your data, we do not use it for advertising, and we do not use your business's data for any purpose other than providing SyncFlow to you.
4. Marketplace data
When you connect a marketplace account (for example through Amazon's Selling Partner API), the following rules also apply:
- We access only the information needed for the features you use, and only after you authorise it in the marketplace's own sign-in page. We never see your marketplace password.
- The access key the marketplace gives us is stored encrypted. You can disconnect at any time, and you can also remove our access from the marketplace's own settings.
- Marketplace data is shown only to people in your business, according to the access you give them. It is never shared with other businesses or sold.
- If a feature needs your customers' personal details (such as a buyer's name or delivery address for an order), we use them only for that feature, keep them encrypted, and delete them within 30 days after the order is delivered, unless the law requires us to keep them longer.
- We follow the data protection rules of each marketplace we connect to, including Amazon's Data Protection Policy and Acceptable Use Policy.
6. How we protect it
- Everything travels over an encrypted connection (HTTPS), and data is encrypted where it is stored.
- Each business's data is kept separate from every other business's, and this separation is tested automatically.
- Passwords are stored hashed. Secrets such as database credentials are kept encrypted and are never written into our code.
- Access within a business follows the roles and permissions you set, and the activity history cannot be edited or deleted, even by us through the app.
7. How long we keep it
- Your account and your business's data: for as long as your business uses SyncFlow. If your business stops using SyncFlow, we delete its data within 90 days of a request, except what we must keep by law.
- Demo requests that do not lead to an account: up to 12 months.
- Billing records: as long as Indian tax law requires.
- Customers' personal details from marketplaces: as described in Marketplace data.
- Your own customers' details: until your business removes them or its data is deleted. A customer's details can be removed at once from any of their orders; the order stays, without them. Invoices already made keep the name and address printed on them for as long as tax law requires invoices to be kept (currently about six years).
8. Your rights
Under India's Digital Personal Data Protection Act, 2023 and other applicable law, you can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct or complete it;
- delete it, where we are not required to keep it;
- withdraw consent you have given, for the future;
- nominate someone to act for you in case of death or incapacity.
Write to syncflow25@gmail.com from the email address on your account. We reply within 30 days. If someone in your business added you (for example as a team member), you can also ask that business's owner.
If you are a customer of a business that uses SyncFlow and your details were entered for an order, ask that business: it can remove them at once. You can also write to us and we will pass the request on.
10. Questions and complaints
For any question or complaint about your personal data, contact our Grievance Officer at syncflow25@gmail.com, CYCUS INNOVATIONS, Kerala, India. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our answer, you can approach the Data Protection Board of India.
11. Changes to this policy
We will update this page when the way we handle data changes, and change the date at the top. If a change is significant, we will tell account owners by email before it applies.