Privacy Policy

About Syncorde

Syncorde is an internal business system. It records sales, customers, products and deliveries, and keeps them in step with the accounting software the business already uses.

Syncorde is not offered to the public. There is no signup, and access is limited to authorised staff.

This policy explains what personal information Syncorde holds, why it is held, who it is shared with, and what you can ask us to do about it.

Information we hold

Syncorde holds three kinds of personal information.

• Staff: name, email address, phone number and role, for the people authorised to use the system.
• Customers: name, company name, email address, phone number, VAT number, billing and delivery addresses including Eircode, and any notes recorded against the account.
• Delivery recipients: where an order ships to someone other than the person who paid, the recipient name, address, phone number and email address, so that a label can be produced.

Sales and accounting records

Sales, invoices, estimates, payments and delivery details are held alongside the information above, together with a record of which staff member recorded each one.

Copies of customer and product records are mirrored from the connected accounting system so they can be displayed and reconciled. The accounting system remains the authoritative record.

Card payments

Syncorde does not store card details. No card number, security code, expiry date or cardholder name is held in our systems at any point.

When a card payment is taken, the details are sent from the browser directly to Stripe, which returns a reference. Only that reference reaches our servers. The card brand and the last four digits are kept afterwards as part of the financial record.

Who we share information with

Syncorde passes information to the services below so that it can do its job. Each receives only what its job needs.

• Supabase, which hosts the database, file storage and sign-in. It holds everything described above.
• Vercel, which hosts the application itself.
• Intuit, for QuickBooks Online. It receives customer names, contact details, addresses, VAT numbers, invoices, estimates and payments.
• Stripe, for card payments. It receives card details directly from the browser, along with the customer name, email address, phone number and billing address.
• An Post, for delivery. It receives the recipient name, company, address, county, Eircode, country, phone number and email address, so that a label can be produced and the parcel tracked.
• Amazon Web Services, which runs a network relay used only for An Post traffic, because An Post requires requests to arrive from a fixed address. Information passes through it and is not stored there.
• PrintNode, for printing. It receives the finished documents sent to a printer, which include invoices, receipts and delivery labels, and therefore the names and addresses printed on them.
• Fetchify, for address lookup. It receives an Eircode and returns the matching address.
• The European Commission VIES service and VatSense, for checking VAT numbers. Each receives a VAT number only, and neither result is stored.
• The WooCommerce store operated by the business, where one is connected. It sends order and customer details into Syncorde.

What we do not do

Syncorde uses no analytics, advertising or error-tracking services. Personal information is never sold, and it is never shared for marketing.

Where information is processed

All information at rest is stored in Ireland. The database, file storage and backups are held in the Dublin region, and the application is served from the same region.

A small number of paths reach the United Kingdom. Delivery traffic to An Post passes through a relay in London without being stored there. PrintNode, Fetchify and VatSense are United Kingdom services and receive the information described above. These transfers are covered by the European Commission adequacy decision for the United Kingdom, renewed on 19 December 2025 and valid until 27 December 2031, which places them on the same footing as a transfer inside the European Union.

Intuit and Stripe are international services and may process information outside the European Economic Area under their own safeguards.

How long we keep information

Financial records, including sales, invoices and payments, are kept for as long as Irish Revenue requires records of that kind to be retained.

Records of changes made in the system are kept indefinitely, because they exist to show what happened and when.

Shorter windows apply to the working data the system generates for itself.

• Cached responses, which make a repeated request safe to retry: 24 hours.
• Completed background sync jobs: 14 days.
• Notifications received from connected services: 30 days once processed, or 90 days if they were never processed.

Your rights

Under the General Data Protection Regulation you can ask for a copy of the personal information held about you, ask for it to be corrected, ask for it to be erased, ask for a portable copy, and object to or restrict how it is used.

Requests go to support@syncorde.com. We will respond within one month.

Erasure requests are carried out by hand rather than through a self-service tool. When a customer record is erased, the name, contact details, addresses, VAT number and notes are removed or replaced, and the financial record of what was bought and paid is kept, because we are required to retain it.

Copies held by the connected accounting system, the payment processor and the delivery service are separate from ours. We will tell you what has to be requested from each of them.

If you are not satisfied with how a request was handled, you can complain to the Data Protection Commission at dataprotection.ie.

Cookies

Syncorde sets three cookies, all of them necessary for the system to work.

• A sign-in cookie, so that you stay signed in.
• A short-lived security cookie used while connecting the accounting system. It lasts fifteen minutes and is deleted as soon as the connection completes.
• A preference cookie recording whether the sidebar is expanded. It lasts seven days.

Cookies set by Stripe

When a card payment is being taken, Stripe sets its own cookies on that page to help prevent fraud. They appear only on the sale screen, and only when a card is being used.

There are no analytics, advertising or tracking cookies anywhere in Syncorde. Because every cookie listed is strictly necessary for a service you asked for, no consent banner is required.

How we protect information

The protections below are enforced by the database and the platform, not by convention.

• Every table enforces row-level security, so a request can only reach the account it belongs to. The rule is applied by the database itself and cannot be bypassed by the application.
• Account identity comes from a signed token issued at sign-in, not from anything the browser can set.
• Credentials for connected services are held in an encrypted store, never in ordinary database columns and never in logs. Every read of one is recorded.
• Records of changes are append-only. The database gives no application user a way to alter or delete them, and erasing a record adds a new entry rather than rewriting history.
• Access is limited by role, and the more sensitive actions are restricted to owners and administrators.
• All traffic is encrypted in transit.

Changes to this policy

If this policy changes, the date shown at the top of the page changes with it.

Contact

Questions about this policy, or about the information held about you, go to support@syncorde.com.