Privacy
WonderSync stores the minimum needed to sync your listings: your account details, the marketplace credentials you connect, the products you choose to cross-list, and a record of sales and sync jobs. Marketplace credentials are encrypted at rest and never shown again after saving.
What we store
- Account data: your email address, a hashed password held by Supabase Auth, your account name, team membership and role.
- Marketplace credentials: your Shopify shop domain, Shopify Admin API token and webhook secret, and your eBay OAuth access and refresh tokens. All of these are encrypted before they are written to the database.
- Catalogue data: the products you choose to import — title, price, quantity, condition, tags, and the Shopify CDN URLs of your photos. We do not copy or host your images.
- Sync records: sale events (channel, order ID, SKU), listing IDs and offer IDs on each marketplace, delist jobs and their outcomes, activity logs and alerts.
- Billing data: a Stripe customer ID and your subscription status. Card details are handled by Stripe and never reach our servers.
Where it is stored
Application data lives in a Supabase Postgres database hosted in the European Union (Frankfurt, eu-central-1). The application itself runs in a container on a dedicated virtual server behind TLS. Every database table enforces row-level security, so one account can never read another account’s rows — a cross-tenant read returns “not found”, not an error.
How credentials are protected
Shopify tokens and eBay tokens are encrypted with AES-256-GCM before storage, using a key held only in the server environment and never in the database. Once saved, a credential is never rendered back to the browser — not to you, and not to anyone on your team. All traffic to and from the application is served over TLS.
Processors we rely on
- Supabase — database, authentication and scheduled jobs (EU region).
- Stripe — subscription billing, checkout and the customer billing portal.
- Shopify — read and write access to the store you connect, for products, inventory and orders.
- eBay — listing management and order retrieval on the marketplaces you connect.
- Our hosting provider — the virtual server running the application.
Cookies and tracking
WonderSync sets session cookies to keep you signed in. There are no advertising cookies, no third-party trackers and no cross-site profiling on this site.
Disconnecting and deleting your data
Disconnecting a marketplace removes its stored credentials. Closing your account removes your products, listings, sale events, jobs, logs and alerts. WonderSync also implements eBay’s marketplace account deletion notification endpoint, so deletion requests originating from eBay are honoured automatically.
Your rights
If you are in the EU or UK you have the right to access, correct, export or erase your personal data, and to object to or restrict its processing. Contact us from the email address on your account and we will action the request.