Privacy Policy

Lucas Ferry Enterprises LLC (“Syfted,” “we,” “us,” or “our”) operates the Syfted website at shopsyfted.com and the Syfted mobile application (collectively, the “Platform”). This Privacy Policy explains what personal information we collect, how we use and share it, and your rights with respect to it.

By using the Platform, you agree to the collection and use of information as described in this Privacy Policy. This Policy is incorporated into and subject to our Terms of Service.

1. Information We Collect

Account and Profile Information

When you create an account, we collect your email address and, optionally, your name, username, phone number, and profile photo. During onboarding, and at any time afterwards from your profile settings, we ask about your style preferences, preferred sizes (for tops, bottoms and shoes), and shopping preferences — this information is used to personalize your experience and is stored in your profile.

We also ask for your date of birth when you create an account. We use it only to verify that you meet the minimum age described in Section 2 of our Terms of Service, and for no other purpose. If you do not meet that minimum, we do not create or keep an account, and we do not retain the date you entered.

If you provide a phone number and separately tick the SMS consent box — at signup, when editing your profile or, for a brand owner, in the contact details of your Brand Portal account — we record the date and time of that consent as evidence that you agreed, and, where our systems have it available, the IP address the consent was given from. Unticking the box, or removing your phone number, ends that consent on your account; we keep a record that you gave and withdrew it, with only the last four digits of the number, for 4 years after your account is deleted (Section 5). If a message to your number is returned by our SMS provider as undeliverable because you replied STOP, we record that separately so we do not attempt to text that number again.

Third-Party Authentication

If you sign in using a third-party provider such as Sign in with Apple, we receive limited profile information from that provider, which may include a name and an email address (which may be an Apple relay address if you choose to hide your real email). We do not receive your password from any third-party provider.

Purchase and Transaction Data

When you make a purchase, we collect details about the items ordered (including brand, product name, size, quantity, and price), your shipping address, and order status. Once a brand ships your order, we also collect the carrier’s tracking status for that parcel and the timestamps of its scans — such as when it first enters the carrier’s network and when it is delivered — which comes from the carrier itself, not from you. Where your order ships internationally, the destination country is also used to calculate import duties and to prepare customs documentation, and is shared with the carrier and the relevant customs authority for that purpose. It is also used to determine which currency prices are displayed to you in. Payment details — including your card number, expiration, and CVV — are processed directly by Shopify, which operates the checkout your order goes through, and are never stored on Syfted’s servers. We receive a payment confirmation and a reference for the order (an identifier for the payment, not any card data) so the payment can be reconciled, refunded, and audited. That reference is also shown to the brand fulfilling your items, through their Syfted Brand Portal, so they can confirm the order was genuinely paid for.

So that a rewards discount can be applied to your order and your purchases can be recognised across visits, we store a customer identifier issued by Shopify linked to your Syfted account. That identifier contains no payment card data; all sensitive payment information remains within Shopify’s systems under their privacy policy. Syfted no longer creates or holds a Stripe customer record for buyers; Stripe is used only to pay brands and to bill brand subscriptions.

For each order we also record the commission and shipping amount attributable to each brand in the order. This is internal accounting data about the transaction, not about you, and is retained with the order record.

Syfted Points and Rewards Data

If you participate in the Syfted Points program, we maintain a ledger of your points activity. This includes points earned on each order, the order they relate to, the date they become redeemable and the date they expire, any promotional or early-adopter bonus issued to you, points held during a checkout, points redeemed and the discount applied, and any reversal following a refund. We use this data to calculate your balance, apply discounts at checkout, prevent abuse of the program, and meet our accounting obligations for outstanding rewards liability. It is retained alongside your order history.

Browsing and Activity Data

We collect information about how you interact with the Platform, including:

• Products you view (recently viewed history)
• Product view events, recorded whether or not you are signed in, so that brands can see how many people looked at each of their products. Each event records the product, the time, and whether you were on the website or the mobile app. It is tagged with a random identifier that your browser or the app generates for itself and discards when you close the tab or the app — we do not store your IP address for this purpose and we do not build a device fingerprint. If you are signed in, the event is also linked to your account. Brands only ever see totals and visitor counts, never who you are.
• Shopping activity: when you open your cart, which items you add to your cart and from where (a product page, a quick add or a suggestion in your cart), when a suggestion or a brand’s free-shipping progress is shown to you and whether you tap a suggestion, and when you press Checkout and reach the checkout page, with the product, the brand and the amount involved. It is tagged with a random identifier your browser or the app keeps until you close the tab or the app, and it is linked to your account if you are signed in. We use it to see which parts of the shop help people find and buy what they want. It is stored in our own database and is not shared with brands, advertisers or any analytics service.
• Products you like or save to your wishlist, and the names of any collections you create to organise your saved items, together with which saved products you file in each one. Collections are private to you: they are never shown to other shoppers or to brands, and we do not use collection names for anything other than showing you your own saved items.
• Brands you follow
• Drops you subscribe to receive notifications for, together with which channels you chose (for example email) and the date and time you chose them. We keep the timestamp as a record of your consent to be contacted about that drop. Cancelling the subscription deletes the record.
• Sold-out products you ask us to tell you about when they are back in stock, with the time you asked and the time we told you. Only you can see these requests; brands never see who is waiting for their products. Cancelling a request deletes it.
• Cart contents (stored server-side when you are signed in, to support abandoned cart reminders)
• Search queries and filters used on the Platform

Device and Technical Information

We and our service providers may collect technical information including your device type, operating system, IP address, browser type, and general location derived from IP address. On mobile, we collect your push notification token (with your permission) to send push notifications about orders and drops.

Crash and Diagnostic Data

When the Syfted website or app encounters an error, we record a diagnostic report so we can fix it. A report contains the error message and its technical stack trace, the screen or page you were on, the app or build version, and your browser or device type. If you are signed in at the time, the report we keep in our own database is linked to your account so we can tell whether an error affected one person or everyone. Those reports are generated by Syfted’s own software and are stored in our own database. The Syfted app and website also send crash and error reports to Sentry, a crash reporting service we use to find and fix crashes, including crashes in the app that our own software cannot see (see Section 3). Reports sent to Sentry are not linked to your account and do not include your name or email address. We do not use a third-party analytics service. Reports are deleted automatically (see Section 5).

Communications

If you contact us by email or through the Platform, we retain the contents of those communications and your contact information in order to respond.

User-Generated Content

Any reviews, ratings, or other content you submit on the Platform is collected and stored by Syfted and may be displayed publicly.

In-App Notifications

We maintain records of in-app notifications sent to your account (such as order status updates and brand account notices) to support the notification inbox feature. These records are operational and are not used for marketing purposes.

Account Status and Enforcement Records

We keep records relating to the standing of your account, including whether an account has been suspended or restricted and the period any such restriction applies for. These records are used to enforce our Terms of Service and to protect the Platform and its users, and are not used for marketing purposes.

Brand Applicant Information

Submitting a brand application requires a Syfted account, and your application is linked to that account from the moment you submit it. We collect the information you provide, including your brand name, Instagram handle, your storefront’s public website address (if provided), the note you write (if any), the email address on your Syfted account, the name and domain of your connected store, store verification status, a few of your connected store’s products (titles, prices and a main photo), the date and time you confirmed that you are authorized to apply and that your application is accurate, and any other details you submit. This information is used solely to evaluate your application, communicate with you about its status, and, if approved, to set up your brand account — using the account you already signed in with, with no separate account-setup email required. If you connect your Shopify or Square store while applying, that connection grants Syfted the same real, functional access a fully connected brand would have, so that we can confirm you control the store and review basic details like your store name, plan, and product count. That access credential is held with your pending application record — on our servers only, never passed through or exposed to your browser — while your application is reviewed. If your application is approved, this same connection automatically becomes your brand’s active store integration (see “Brand Account and Integration Information” below) with no second connection step required. If your application is rejected, or if you connect a store but never finish submitting your application, the stored credential is deleted and never used. Brand application data is subject to this Privacy Policy regardless of whether your application is approved.

Connecting Your Shopify Store from Shopify

If you start connecting your Shopify store from Shopify itself (for example, by installing Syfted or opening it in your Shopify admin), we hold that store connection on our servers, never in your browser, for up to 30 minutes until it is linked to your Syfted account, so that you can sign in or create an account first. If it is not linked in that time, it expires and is deleted, and you can start again from your Shopify admin.

When you use the Syfted app inside your Shopify admin, Shopify gives Syfted a short-lived signed token that identifies your store and the staff account using the app. We use it only to confirm the request comes from your store and to obtain your store connection, and we do not store it. When you choose Connect there, a Syfted window opens with a one-time link code that tells us which store you are connecting. The code works once and expires after 15 minutes. We keep only a one-way hash of it, never the code itself, and before anything is linked we ask you to confirm which store you are connecting to which Syfted account.

If you connect through the Syfted app in your Shopify admin, Syfted also sends Shopify a short setup status for the Syfted app in your store, such as that your application is under review, that setup is complete, or that the store is disconnected, which Shopify shows in your admin. The status contains no personal information beyond that one line, and it is replaced each time your standing with Syfted changes.

For a store connected through the Syfted app in your Shopify admin, Syfted keeps a record of which of your products are published to the Syfted sales channel and of the last publishing note, if any, it sent for each. Syfted may post a short publishing note in your Shopify admin on a product published to the Syfted sales channel: that Syfted accepted it, or what to fix before Syfted can list it, such as a price below Syfted’s minimum. Shopify shows that note with the product in your admin. These notes contain no personal information. Syfted also keeps each product’s title as Shopify sends it and whether Syfted could list it, and the Syfted app in your Shopify admin shows that record, including any product Syfted could not list yet. The record contains no personal information, and it is deleted when you disconnect or uninstall Syfted.

Automated Screening of Brand Applications

When you submit a brand application with a verified Shopify store, we use an automated check that can decline an application that plainly cannot be listed on Syfted, such as a test or placeholder store or a store that does not sell clothing, footwear or accessories. It can never approve an application: a person at Syfted decides every application it does not decline, and it is never used on Shopify development stores. To do this we send the details you submitted (your brand name, the note you wrote and your Instagram handle) and your connected store’s name, domain, age, plan tier, product count and the titles of a few of its products to Anthropic, which operates the Claude AI service, for processing on our behalf. We do not send your email address, phone number, home or business address, payment details, or your store’s access credentials.

Anthropic processes this information only to return a result to Syfted, and under its commercial terms it does not use data submitted through its API to train its models. Anthropic is subject to its own Privacy Policy.

The result is stored on your application record. If the check declines your application, the decision email says so, and you can ask a person to review it by replying to that email or writing to support@shopsyfted.com. A check that fails for any reason sends your application to a person.

Product Photos Chosen for Syfted’s Marketing

Syfted uses Claude, an AI model made by Anthropic, to look at the product photos brands have already published on Syfted and suggest which could suit Syfted’s own marketing, such as the home page and Instagram. Only the photos and their web addresses are sent, and no buyer information is. The photos may show people modelling the clothes. A person at Syfted chooses every photo before it is used, and a brand’s photos are used only while the brand allows it under the Brand & Seller Agreement.

Drop Suggestions for Brands

For a brand that has agreed to drop suggestions, Syfted reads the brand’s public website and the public posts of its Instagram account, through Meta’s official API, about once a day. It sends the text of those posts and pages to Claude, an AI model made by Anthropic, to spot an upcoming drop. It keeps the short passage it relied on and, for a post, a copy of its photo, so the brand can check the suggestion before anything is listed. This is the brand’s own public business content, though a caption can name a person, such as a photographer or a model; Syfted uses it only to suggest the drop. No buyer information is involved. A brand can turn this off on its Drops page.

Ship Times for Brands’ Products

To help a brand state how long each product takes to ship, Syfted reads the title, description and tags of the products the brand lists, first with simple text patterns and then, for what those miss, with Claude, an AI model made by Anthropic. Only that product text is sent, and no buyer information is. What it finds is a suggestion the brand confirms or ignores in its Brand Portal, and buyers see only the time the brand confirms or states itself. Syfted also reads the order processing time in a connected Shopify store’s shipping settings and offers it to the brand as a starting point.

Brand Account and Integration Information

Once your Shopify or Square store is connected — whether that happened while applying and carried forward automatically on approval, or you connect it later through the Brand Portal — we collect and store your store’s API access credentials (access tokens) to enable ongoing product catalog synchronization and to adjust your stock when an item sells on Syfted. If the Syfted sales channel exists in your Shopify store, the products Syfted lists are the products published to the Syfted sales channel in your Shopify admin (Shopify may publish your existing products there when the channel is created; unpublish any you do not want listed). Unpublishing a product there takes it off Syfted. These credentials are stored securely and are used solely to operate the integration on your behalf. You may disconnect your store at any time through the Brand Portal, at which point your stored credentials will be removed. If you connected through the Syfted app in your Shopify admin, you can also do this there, with the same effect.

To make your products purchasable through Syfted’s checkout, we reproduce your product listings — titles, descriptions, images, prices, sizes, colours, and stock levels — within Syfted’s own commerce infrastructure, which is operated for Syfted by a third-party commerce platform (currently Shopify) under Syfted’s account, and keep those copies in sync with your store. That platform processes this information as a service provider to Syfted and not for its own purposes. We ask for your permission for this separately during onboarding, and record the date you gave it. You can withdraw it at any time by disconnecting your store through the Brand Portal.

We record the date on which you accepted the terms presented to you during onboarding, and, for the Brand & Seller Agreement, the account that accepted it, which version and when, with your confirmation that you are authorized to accept it for your brand, so that we have a record of what you agreed to, who agreed and when. Where you accepted terms that have since been retired, that acceptance date is retained as a historical record and is not used for any other purpose. We also keep your choice about the Instagram marketing permission (Account → Marketing), and any product-photo choice you made under an earlier version of the Brand & Seller Agreement.

If you hold a brand account we also store information about your seller subscription: your subscription status, whether you have scheduled a cancellation, the dates your free trial and any grace period end, your next billing date, and the Stripe customer and subscription identifiers for your brand’s billing. Card details for the subscription are handled directly by Stripe and are never stored by Syfted. This data is used to bill you, to determine whether your storefront is visible to buyers, and to send the billing notices described in our Terms of Service.

Communication Preferences

We store your email communication preferences, including whether you have opted out of non-transactional marketing emails. This preference is applied across all marketing email flows. Transactional emails (such as order confirmations and shipping updates) are not affected by this preference and are always sent as part of account operations.

Consent and Acceptance Records

When you accept our Terms, give or withdraw SMS consent, or (as a brand) accept the Brand & Seller Agreement, or turn Syfted’s use of your brand in its marketing on or off, we record what was accepted, which version, and when, together with a one-way hash of your email address so the record can be matched to you if a dispute arises after your account is deleted. See Section 5 for how long we keep it. When you cancel an order, ask to cancel one, or answer a notice that a brand has moved a ship date (the Syfted Guarantee, Terms of Service Section 6), we record your choice and when you made it, with the order.

Launch Waitlist

If you join our launch waitlist at shopsyfted.com/waitlist, we store the email address you enter, when you joined, and which version of the waitlist notice you saw. You do not need an account and joining does not create one. We use that address only to tell you when Syfted launches; we do not sell it or share it with anyone other than the email provider listed in Section 3 that would send that message. To limit abuse, your IP address is used briefly to count sign-up attempts and is not stored with your email. To be removed, email support@shopsyfted.com.

Copyright Takedown Notices — Including From People Who Have No Syfted Account

If you send us a copyright takedown notice or a counter-notification through shopsyfted.com/dmca, we store everything the notice contains: your name, postal address, email address, telephone number (if you give one), and your electronic signature, together with your description of the copyrighted work, the location of the material you are reporting, and the two statements the law requires. We also record the IP address the notice was submitted from, to rate-limit the form and to have a record of where a notice came from.

We collect this because the Digital Millennium Copyright Act (17 U.S.C. §512(c)(3)) requires a notice to contain those elements before we can act on it, and because §512(c)(1)(C) requires us to act on a compliant notice expeditiously. We are not asking for it because you are a Syfted user — most people who send us a notice are not, and never become one. We do not create an account for you, and we do not add you to any marketing list.

A takedown notice is read by Syfted staff, and we may share it, including your contact details, with the brand whose listing it names, so they know why their listing was removed and can respond. If someone sends us a counter-notification about material you reported, the DMCA requires us to forward that counter-notification to you — and, as our DMCA page states, we forward a valid counter-notification to the original complainant. We may also disclose a notice where required by law or in connection with a legal claim.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account and authenticate your identity
• Process your orders, take payment, and pass your order to the brand fulfilling it
• Calculate and collect sales tax where we are required to do so as the seller — see Section 5 of our Terms of Service
• Personalize your shopping feed and the product suggestions in our emails based on style preferences and past activity
• Send transactional emails (order confirmations, shipping updates, account notices)
• Send marketing and activity-based emails (abandoned cart reminders, browse activity reminders, drop alerts for brands you follow, price-drop alerts and new-product notifications from brands you follow, re-engagement emails, and welcome series) — you may opt out at any time
• Send brand account emails to brand owners (application decisions, new order alerts, and a weekly sales digest) — some of these are transactional and cannot be opted out of
• Send push notifications for orders and drops you have subscribed to (with your permission)
• Send SMS notifications to brand account holders who provide a phone number, for operational communications such as new order alerts and application status updates
• Detect and prevent fraud, abuse, and violations of our Terms of Service
• Screen brand applications with an automated tool provided by Anthropic that can decline applications that plainly cannot be listed on Syfted; a person decides every other application — see “Automated Screening of Brand Applications” in Section 1
• Suggest which product photos already on Syfted could suit Syfted’s own marketing, with an automated tool provided by Anthropic; a person chooses every photo before it is used — see “Product Photos Chosen for Syfted’s Marketing” in Section 1
• Suggest upcoming drops to brands from their public website and Instagram posts, with an automated tool provided by Anthropic; nothing is listed until the brand adds it — see “Drop Suggestions for Brands” in Section 1
• Suggest ship times to brands from the text of their own product listings, with an automated tool provided by Anthropic; buyers see only a time the brand confirms or states itself — see “Ship Times for Brands’ Products” in Section 1
• Operate, maintain, and improve the Platform
• Comply with applicable law and respond to legal requests
• Enforce our Terms of Service and other legal rights

3. How We Share Your Information

Syfted does not sell your personal information. We share your information only in the following circumstances:

With Brands You Purchase From

When you place an order, we share your shipping name, address, email address, and order details with the brand(s) fulfilling your items so they can ship your order and contact you if something goes wrong with it. We never share your payment details — no card number, expiration, CVV, or billing information is ever passed to a brand. We do attach the payment reference for the order, which identifies the payment without revealing anything about the payment method or the payer.

Those details reach a brand in two ways. Every brand sees them in their Syfted Brand Portal and in the order notification we email them. In addition, where a brand has connected a Shopify store, Syfted writes that order into it so the brand can fulfil from its normal workflow — carrying your name, shipping address, and email address, and no payment data. Shopify then creates a customer record in that brand’s store from your email address, marked as not accepting marketing; that record is created by Shopify rather than by Syfted, and it can remain in the brand’s store after the order itself is gone. A brand can turn order creation off, and some do. Syfted also reduces the stock count for the item you bought so it cannot be sold twice.

Where a brand has connected Square instead, Syfted also writes the order into their Square account so it is visible there rather than sitting unpaid — but that order carries none of your information at all: no name, no shipping address, no email, only the products, prices and total of the sale. Syfted closes it using Square’s own mechanism for a payment the seller received outside Square; no payment data of yours reaches Square either way. A brand still fulfils a Square-connected order from the Syfted Brand Portal, and Syfted still adjusts stock on both platforms. Whichever route your details take, a brand may use them only to fulfil your order and support it; the Brand & Seller Agreement (Section 19) limits a brand to that use and separately prohibits marketing to you, selling or transferring your information, and keeping it any longer than the brand’s own legal record-keeping requires. If you want your details removed from a brand’s own store as well as from Syfted, tell us and we will pass the request on — see Section 8.

If you start a return or exchange with a brand, the brand receives what you send it through its own returns process.

With Service Providers

We use third-party service providers to help operate the Platform, including:

• Stripe — payouts to brands via Stripe Connect and recurring subscription billing for brand seller plans. Stripe no longer processes buyer payments; it may still hold records of purchases made before checkout moved to Shopify, and it is where a refund of one of those orders is issued. Stripe is subject to its own Privacy Policy.
• Stripe Connect — payout infrastructure for brand owners. When brand owners set up payouts, their business and banking information is shared with Stripe under Stripe’s Connected Account Agreement. Brand owners’ payout data is governed by Stripe’s Privacy Policy.
• Shopify — when a brand has connected their Shopify store, Syfted reads their catalog and shipping rates, reduces their stock count when an item sells, and creates the corresponding order in their store so they can fulfil it. That order carries your name, shipping address and email — the minimum needed to ship your item and to contact you about a problem with it. Where a brand’s Shopify store has the Syfted sales channel, that order is attributed to the Syfted sales channel whenever Shopify accepts that attribution. Shopify creates a customer record in the brand’s store from that email address, marked as not accepting marketing. Syfted reads fulfilments only for the orders it created, to pass your tracking number back to you. If a brand’s Shopify store has the Syfted sales channel, Syfted also sends Shopify a short setup status and per-product publishing notes for that brand’s Shopify admin, which contain no personal information. Separately, Syfted runs its own Shopify store, which processes every checkout; your checkout, shipping and payment data is therefore processed by Shopify on every order, under Shopify’s Privacy Policy.
• Google — address autocomplete and verification, used only in the Brand Portal when a brand owner enters or checks the ship-from address their parcels leave from. The partial address being typed, and the completed address when the “Check address” button is used, are sent to Google Maps Platform so that suggestions can be offered and the address confirmed as one that exists and receives post. This applies to brand business addresses only — no buyer address is ever sent to Google, because buyers enter their shipping address inside Shopify Checkout, which Syfted does not process. Google is subject to its own Privacy Policy.
• EasyPost — carrier tracking status. When a brand ships an order, the carrier’s tracking number for that parcel is sent to EasyPost so that Syfted can show you where your order is and confirm to itself that the parcel entered the carrier network. Syfted sends the tracking number only — never your name, your address, your email or anything about what you bought. The carrier’s own scan events, which EasyPost returns, may include the destination city and postal region because that is what a carrier records at each scan. Syfted buys no shipping labels through EasyPost; brands ship on their own carrier accounts exactly as they did before. EasyPost is subject to its own privacy policy.
• Square — when a brand has connected their Square account, Syfted reads their catalog, reduces their stock count when an item sells, and creates a paid order in their Square account for the sale. That order is closed with a payment record made using Square’s own mechanism for a payment the seller received outside Square, so it does not sit unpaid and invisible in their account — no card is charged and no money moves through Square. No buyer information is sent there: the order carries no name, address, or email, only the products, prices and total of the sale, because a brand fulfils a Square-connected sale from the Syfted Brand Portal rather than from Square.
• Supabase — database hosting, authentication infrastructure, and file storage for images uploaded by brands (logos, banners, product photos, and size charts).
• Cloudflare: storage of an encrypted backup copy of Syfted’s database and of the images brands upload, kept for 30 days; Cloudflare does not hold the key to read it.
• GitHub: runs the nightly job that makes that backup, so a copy of the database is on GitHub’s computers for a few minutes before it is encrypted, and the job deletes it before it ends.
• Zonos — cross-border duty and tax calculation, customs documentation, and shipping labels for orders that cross an international border. Where your order does, we share your shipping name and address, your contact details, and the description, weight, value and country of origin of each item, so that the import duties and taxes can be calculated at checkout, remitted to the destination country’s tax authority, and a customs-cleared shipping label produced for the brand to print. Zonos also passes what customs requires to the carrier and the destination customs authority. Domestic orders are not shared with Zonos. Zonos is subject to its own Privacy Policy.
• Anthropic — automated screening of brand applications, suggesting product photos for Syfted’s marketing, spotting upcoming drops for brands, and suggesting ship times from brands’ product listings. For photo suggestions, only product photos already published on Syfted and their web addresses are sent; for drop suggestions, only the text of a brand’s public posts and website pages; for ship times, only the title, description and tags of a brand’s products. Where you submit a brand application with a verified store connection, the application details you typed and basic public facts about your connected store are sent to Anthropic’s Claude API so it can return a screening result. No buyer information is ever sent to Anthropic, and no email address, phone number, postal address, payment data or store access credential is sent for any user. Anthropic does not use API data to train its models. Anthropic is subject to its own Privacy Policy.
• Meta Platforms — Syfted reads the public posts of a brand’s Instagram account through Meta’s official API, for drop suggestions. Syfted sends Meta only that account’s public username. What Syfted derives from it is used only as this policy describes, never sold or shared, and deleted on the schedule in Section 5. Meta is subject to its own Privacy Policy.
• Resend — transactional and marketing email delivery.
• Vercel — web application hosting and edge delivery.
• Expo / Apple / Google — mobile push notification infrastructure.
• Sentry: crash and diagnostic reporting for the Syfted app and website. When the app or the website crashes or hits an error, a report is sent to Sentry so that Syfted can find and fix the problem. A report holds the error message and its technical stack trace, the app or build version, the device or browser type and operating system, and a short trail of what the app or page was doing just before the error, such as screens opened and network requests made. The part of a web address after a question mark is removed before a report is sent, so that trail shows which service was called and not which account or search it was about. Syfted does not send your name, email address or any other account detail to Sentry, and a report is not linked to your account. Sentry also receives a random identifier that is generated on your device for that installation of the app. Sentry is subject to its own Privacy Policy.
• Twilio — SMS notification delivery for account holders who provide a phone number, only where SMS consent was given. We send no marketing texts through Twilio or any other channel. Your phone number and SMS consent are never shared with anyone for their own marketing.
• Slack: Syfted’s internal alert channel. Alerts that Syfted’s operator receives by email, such as a failed payout or an order that could not reach a brand, are also posted there. An alert can carry a brand’s name and store web address, order, brand and account reference numbers, and amounts, never a buyer’s name, email address, postal address or phone number.

These providers may access your personal information only to perform services on our behalf and are obligated to protect it.

For Legal Reasons

We may disclose your information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Syfted, our users, or the public.

Business Transfers

If Syfted is involved in a merger, acquisition, financing, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform if such a transfer occurs and your data will become subject to a different privacy policy.

4. Cookies and Tracking

Syfted uses only cookies and similar storage that the Platform needs to work, that remember a choice you made, or that count product views and shopping activity on Syfted itself (Section 1). We do not use advertising, cross-site tracking or third-party analytics cookies, and no third party collects information about your activity across other websites through Syfted’s site or app. Because nothing here is used for advertising or to follow you across other sites, Syfted does not ask for a cookie consent choice, and the notice you see on first visit is only that: a notice.

Checkout. When you check out you move to a checkout page run for Syfted by Shopify. Shopify sets its own cookies there, and if you use Shop Pay it recognises you as Shopify’s own customer, under Shopify’s privacy policy. Syfted does not use what Shopify collects at checkout for advertising.

Do Not Track and Global Privacy Control. Because Syfted does not track you across other websites, and does not sell your personal information or share it for cross-context behavioral advertising, it does not change anything in response to a Do Not Track or Global Privacy Control signal: there is nothing for the signal to switch off.

Images. On the website’s shopping pages, product and brand images are served through Syfted. The Brand Portal’s previews and the mobile app load images directly from where they are stored (Syfted’s storage or a brand’s image host), which shows your IP address to that host, and emails work the same way when you open an image in them; most email applications block or proxy remote images by default.

Mobile app. The app keeps your cart, appearance setting and recent searches in device storage (syfted-cart, syfted.theme-mode, syfted_recent_searches) and your sign-in session in your device’s encrypted secure storage (the iOS Keychain or Android EncryptedSharedPreferences). None of it leaves your device except as part of normal app operations, such as syncing your cart when you are signed in.

You can block or delete cookies in your browser settings; signing in will not work without them. If Syfted ever adds third-party analytics or advertising technology, we will update this section first and ask for your consent where the law requires it.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. Order and transaction records — including the shipping name and address on the order — are kept for at least 7 years to satisfy tax, accounting and dispute requirements, and stay after you close your account, unlinked from it. Carrier tracking status and scan records are retained alongside the order for that same period, because they are the evidence Syfted uses to defend a chargeback (Brand & Seller Agreement Section 8). Your choices under the Syfted Guarantee, with when you made them, and the refunds it issues are kept with the order for that same period, as the record of what you agreed to and what you were refunded. Syfted Points ledger entries are retained alongside the order records they relate to for as long as your account remains open, so that rewards liability and redemptions remain auditable; unlike the order records themselves, your points history is deleted outright when you close your account rather than being kept and disconnected from you. If you close your account, we will delete or anonymize your personal data within a reasonable time, except where retention is required by law; any unredeemed points are forfeited at that point, as described in our Terms of Service.

Consent and acceptance records — which version of our Terms you accepted and when (and, for a brand, which version of the Brand & Seller Agreement), and when you gave, withdrew or ended SMS consent (stored with only the last four digits of the number) — are kept for as long as your account is open and for 4 years after your account is deleted, because they are the record of what you agreed to; they are then deleted automatically.

Rate-limit counters, which can include the IP address a request came from, are deleted automatically 7 days after they were last used. Database backups kept by our database host roll off after 7 days, so deleted information can remain in one of those backups for up to 7 days. We also keep an encrypted backup copy off-site with Cloudflare, which is deleted after 30 days, so deleted information can remain in that copy for up to 30 days.

Records others keep. Shopify keeps the checkout and order record for each purchase on Syfted’s behalf; when you delete your account you can ask us to have Shopify erase your personal information there, as far as tax and accounting law allows. A brand keeps the order Syfted wrote into its store under Section 3 and the Brand & Seller Agreement (Section 19). Our email, SMS and payout providers keep their own delivery logs under their own policies.

When a brand owner closes their brand, the brand’s records are kept. Closing a brand from the Brand Portal (Account) takes its products and page off Syfted, ends its seller plan so that it does not renew, and deletes the store-access credentials we held for it (see “Brand Account and Integration Information” in Section 1). We record that the brand was closed, and when. Closing does not delete the brand’s record or the records of the sales it made: its order, payout and billing records are retained on the schedule given above for order and transaction records, because earned payouts are still paid after a closure and tax, refund and chargeback obligations outlast it, and the orders buyers placed with the brand are kept on the same terms. A closed brand is no longer listed on Syfted’s public pages. Closing a brand does not close its owner’s Syfted account; if the owner later deletes that account, the brand’s record stays but is no longer linked to a sign-in.

Launch waitlist emails are kept until you ask us to remove them, or until we close the waitlist after launch, whichever comes first. A waitlist entry is not linked to any account, so closing an account does not remove it; ask us directly instead.

Crash and diagnostic reports in our own database are deleted after 30 days, automatically and regardless of whether your account is still open. If you close your account before then, any report linked to it is unlinked from you and the remainder ages out on that same schedule. Reports held by Sentry are not linked to your account and are kept by Sentry for up to 90 days, depending on our Sentry plan.

Product view events are deleted after 12 months, automatically and regardless of whether your account is still open. If you close your account, any view events linked to it are unlinked from you and kept only as an anonymous count until they age out on that same schedule.

Shopping activity events are deleted after 400 days, automatically and regardless of whether your account is still open. If you close your account, any events linked to it are unlinked from you and age out on that same schedule.

Drop suggestions keep what they quoted for 30 days after they close. Once a brand answers a suggestion, or its day passes, the passage Syfted quoted from the brand’s post or page, and any photo copy the brand did not use for a drop, are deleted 30 days later. The suggestion itself, and the brand’s answer, are kept with the brand’s account.

Copyright takedown notices and counter-notifications are kept indefinitely, and we want to be direct about why rather than imply a schedule we do not operate. A notice, what we did about it, and when, is the record that our handling of it was correct — the evidence that decides a later dispute over whether material was removed expeditiously, or removed when it should not have been. Deleting it on a timer would delete that record.

These records are not attached to any Syfted account, because the person who sends a notice usually does not have one. That means closing a Syfted account does not remove a takedown notice you sent, and the account-deletion path described in Section 8 does not reach it. If you want a notice you sent to be corrected or removed, email support@shopsyfted.com and we will handle it as a rights request under Section 8, weighed against our need to keep the record of a legal notice we acted on.

6. Children’s Privacy

The Platform is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. You must be at least 18 to open an account, and we ask for your date of birth when you sign up to check this. If you are a parent or guardian and believe your child under 13 has created an account or provided personal information on Syfted, please contact us at support@shopsyfted.com and we will promptly delete that information and terminate the account.

7. Security

We implement commercially reasonable technical and organizational measures to protect your personal information from unauthorized access, loss, or disclosure. These include encrypted data transmission (HTTPS/TLS), row-level security on our database, and access controls limiting who can view personal data.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your information. If you believe your account has been compromised, please contact us immediately at support@shopsyfted.com.

If a data breach results in unauthorized access to your personal information, we will notify affected users without unreasonable delay, consistent with applicable law, including California Civil Code §1798.82. Where the incident involves a brand’s connected store rather than Syfted’s own systems, the Brand & Seller Agreement (Section 19) separately governs notice between Syfted and that brand.

8. Your Rights and Choices

Depending on where you live, you may have certain rights regarding your personal information, including:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate or incomplete information
• Deletion — delete your account and its data yourself at any time from Profile → Account → Delete Account, or see Delete your Syfted account for how to request it if you cannot sign in (subject to legal retention requirements; if you own a brand, close it first from the Brand Portal under Account, and see Section 5 for the records that are kept). Deletion also cannot be completed while an item you paid for has not yet shipped (for up to 90 days after the order); we will tell you which condition applies and complete the deletion once it is resolved
• Opt-out of marketing — opt out of non-transactional emails at any time via the unsubscribe link in any email, the one-click unsubscribe your mail app may show for Syfted emails, the Marketing emails switch under Profile on the website or in the app, or by contacting us
• Push notifications — manage push notification permissions through your device settings at any time

To exercise any of these rights, contact us at support@shopsyfted.com. We will respond within 45 days. We may need to verify your identity before processing certain requests.

California, Nevada and Other States

Syfted is not currently required to comply with the California Consumer Privacy Act, which applies to businesses above revenue and volume thresholds Syfted does not meet, but we give every user the rights in this section anyway: to know what we hold, to correct it, to delete it, to receive a copy in a common format, and not to be treated differently for asking. Syfted does not sell your personal information or share it for cross-context behavioral advertising. Nevada residents may still send a request to opt out of any future sale of covered information to support@shopsyfted.com with the subject “Nevada opt-out”, and we will respond within 60 days.

9. International Users

The Platform is operated from the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the Platform, you consent to this transfer and processing.

10. Third-Party Links

The Platform may contain links to brand websites and other third-party services. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party services you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where the change is material, ask you to accept the updated policy with our Terms before your next purchase; we may also tell you by email or in the app.