Privacy Policy

1. Who we are

SyncPay ("we", "us", "our") operates the SyncPay platform at syncpay.au, including the Stripe App, Square integration, and merchant portal. Our registered office is in Australia.

2. What data we collect

• Merchant account data: Business name, ABN, business address, business contact phone, business contact email, and statement descriptor — provided during onboarding or via the SyncPay panel in the Stripe Dashboard (Receipt details → Edit). These details are snapshotted onto every SPTC receipt at the time of creation and displayed publicly on the consumer lookup page (see section 4a).
• Payment metadata: Transaction amounts, SPTC codes, timestamps, payment intent IDs, and statement descriptors. We do NOT store full card numbers, CVVs, or bank account details.
• Square card and fraud fields (added 14 June 2026): When payments are processed via the Square integration, we additionally collect the following from Square's payment API:
  • Last 4 digits of the card number (card_last4)
  • Card BIN — the first 6 digits, which identifies the issuing bank (not the full card number)
  • Card brand (e.g. Visa, Mastercard) and card type
  • Card entry method (e.g. contactless, chip, keyed)
  • Authorization code, AVS status, and CVV status — result codes only, not the CVV value itself
  • Fraud risk level (Normal, Moderate, or High) from Square's risk evaluation
  • Device ID and employee/team member ID for in-person payments only
  • Anonymous customer ID — a one-way HMAC of the card fingerprint and merchant ID, containing no personally identifiable information
• Customer emails: Only when the merchant provides a customer email for receipt delivery.
• Authentication data: Email address and hashed password for merchant portal login (managed by Supabase Auth).
• Usage data: Credit consumption, API call counts, and billing period tracking.
• Stripe account identifiers: Your connected Stripe account ID, used to identify your merchant record and to read/write PaymentIntent metadata and statement_descriptor_suffix.

3. How we use your data

• Generate SPTC codes and attach them to payment descriptors via the Stripe and Square APIs.
• Create and store itemised receipts that customers can look up by SPTC code.
• Auto-reconcile transactions with connected accounting and ERP software (e.g. Xero, NetSuite).
• Track usage for billing and plan enforcement.
• Communicate service updates and support responses.

4a. What consumers see on the public SPTC lookup

When a consumer enters a valid SPTC code at syncpay.au/lookup, the receipt page displays merchant business details that were snapshotted at the time of payment, including:

• Business (trading) name
• Australian Business Number (ABN)
• Business address
• Business contact email
• Business contact phone
• Transaction amount, date, and line items

Why: APP 3 — these details establish merchant identity and give the consumer a way to contact the business about the transaction, which is the core purpose of SyncPay. Anyone with the SPTC code can view this page; treat the code as semi-public. Merchants should use business contact details only — not personal contact information. You can update these fields in the SyncPay panel; updates apply to future receipts only — past receipts retain the snapshot at the time of creation.

4. Data sharing

We do not sell your data. We share data only with:

• Stripe / Square: To process payments and attach SPTC codes to transactions via their APIs.
• Xero / NetSuite: To reconcile transactions in your accounting or ERP system (only when you connect that account).
• Supabase: Our database and authentication infrastructure provider.
• Cloudflare: Our website hosting and CDN provider.

5. Data retention

We retain merchant and receipt data for as long as your account is active, plus 7 years for tax and compliance purposes. You can request deletion of your data at any time by contacting us.

6. Data security

All data is transmitted over HTTPS/TLS. Sensitive keys are stored encrypted at rest. We use Supabase Row Level Security (RLS) to isolate merchant data. We do not store payment card details — all card processing is handled directly by Stripe and Square.

7. Your rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (subject to legal retention obligations).
• Withdraw consent for optional data processing.

8. Cookies

We use essential cookies for authentication sessions only. We do not use tracking or advertising cookies.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or the merchant portal.

10. Contact

For privacy enquiries, contact us at hello@syncpay.au.