Privacy policy

1. What we collect

Sellers: account email and password (stored hashed by our login provider), username, display name, profile photo and links, and the products you upload. Your payment settings: whether you offer Cash on Delivery or bank transfer, the bank details you choose to show buyers, and your own payment gateway's keys (stored encrypted). Your store rent payments, including any transfer slip you upload.

Buyers: name and email; for physical orders, phone number and delivery address; what you bought, when, how you chose to pay, and the payment status. You pay the seller directly: card and wallet details are entered on the seller's payment provider's page, and bank transfers and cash go straight to the seller. Synq never sees or stores your card number.

People who report a product: the reason and details you give, your email if you choose to leave it, and a one-way scrambled (hashed) form of your IP address used to stop abuse of the report form.

Everyone: basic technical data our hosting provider records to keep the site running and secure (such as IP address and browser type), and anonymous store-view counts.

2. People shown in products (for example swimwear photos)

Some products contain photos or videos of people. The seller who uploads them is responsible for having each person's written consent and proof that they are 18 or older (see the content policy). Synq stores these files on the seller's behalf:

• The thumbnail is public on the product page. The product files are private and only delivered to buyers through a short-lived download link.
• We don't collect the models' ID documents or releases unless we ask a seller for them during a review. If we do, we use them only for that review, restrict access to the Synq team handling it, and delete them when the review and any follow-up are closed.
• If you're shown in a product, you can ask us to remove it or tell us you withdraw consent, at safety@synqtogether.store or with the "Report this product" link. We'll hide the product while we check. We won't give your contact details to the seller without your agreement.

3. Why we use it

• To run your store or account, record orders, deliver digital products and collect store rent (to perform our contract with you).
• To show sellers what they need to fulfil an order: a physical order's buyer name, phone and delivery address.
• To prevent fraud, handle refunds and disputes, enforce the content policy and protect people shown in products (our legitimate interests, and protecting others' vital interests).
• To keep records that tax, accounting and payment rules require (legal obligations).
• To send service messages such as order confirmations and rent reminders. We don't send marketing without your consent.

4. Who we share it with

• The seller you buy from: your name, email and order, plus your phone and address for physical orders. The seller uses them to deliver and to contact you about the order, and is responsible for how they handle them.
• The seller's payment provider (e.g. payments.lk or PayHere) when you pay by card, wallet or QR.
• Our technology providers: Supabase (database, files and login) and Cloudflare (hosting and security). They process data for us under contract.
• The authorities, when the law requires it or to protect someone at risk, including reports of suspected child sexual abuse material to the Sri Lanka Police and the National Child Protection Authority.

We never sell personal data.

5. Where it's stored

Our providers' servers are outside Sri Lanka (our database is currently hosted in Asia). We use providers that protect data with encryption in transit and access controls, as the law requires for cross-border transfers.

6. How long we keep it

• Account data: while your account is open, then deleted or anonymised, except what we must keep by law.
• Orders and store rent payments: as long as Sri Lankan tax and accounting law requires.
• Reports and moderation decisions: up to 3 years after the report is closed, longer only if needed for a legal case.
• Products removed for breaking the content policy: deleted, except evidence we're required to keep or hand to the authorities.

7. Your rights

You can ask to see the personal data we hold about you, correct it, have it deleted, or withdraw consent you gave, and you can object to how we use it. Email privacy@synqtogether.store. We'll reply within one month and may ask you to confirm who you are. Some data we must keep by law even if you ask us to delete it. If you're unhappy with our reply, you can complain to Sri Lanka's Data Protection Authority.

8. Security

Sellers' payment gateway keys are encrypted with a key only our server holds, and are never shown again after they're saved. A seller's bank details are shown only to buyers who choose bank transfer for one of their orders. Only a scrambled (hashed) form of each private order link is stored, so a database leak can't recreate those links. Access to personal data within Synq is limited to the people who need it.

9. Children

Synq is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has an account or appears in a product, tell us at safety@synqtogether.store.

10. Changes

We'll post any changes here with a new date, and email sellers about important changes before they apply.