01Purpose
This policy defines how Synthesis classifies the data it holds on behalf of connected merchants, and the handling requirements that follow from each classification. It exists so that the protection applied to a piece of data is decided by what the data is, not by which system happens to hold it.
02Classification tiers
| Tier | Definition |
|---|---|
| Restricted | Credentials and secrets. Disclosure would allow a third party to access a merchant's connected accounts. |
| Confidential | Personal data relating to an identifiable individual, processed on behalf of a merchant. |
| Internal | Commercial data of a merchant. Sensitive to that merchant, but not personal data. |
| Public | Information published deliberately, such as marketing pages and documentation. |
03What we actually hold, by tier
This section is written from the live schema rather than from intent, and is re-checked when a new data source is connected.
Restricted
- OAuth refresh tokens and access tokens for merchant-connected platforms.
- API keys and platform credentials supplied by a merchant when connecting a source.
Restricted data is held in Google Secret Manager or in an access-controlled Firestore collection. It is never written to source control, never returned by any API surface, and never included in logs or error reports.
Confidential — personal data
- Customer and buyer email addresses from connected marketplaces and storefronts.
- Shipping city and postal code from connected marketplace orders.
- Raw order payloads from connected marketplaces, which may contain a buyer name or shipping address as returned by that platform.
We do not collect or store payment card numbers, bank account details, government identifiers, or end-consumer passwords. No such field is requested from any connected platform.
Internal
- Orders, revenue, refunds and settlement amounts.
- Advertising spend, campaign structure and performance.
- Products, inventory, pricing and catalogue data.
Public
- Marketing site content, published policies and documentation.
04Handling requirements
| Requirement | Applies to |
|---|---|
| Encryption in transit | All tiers. TLS 1.2 or higher on every connection. |
| Encryption at rest | All tiers. AES-256 in Google BigQuery, Firestore and Cloud Storage. |
| Secret storage | Restricted only. Google Secret Manager; never in source control. |
| Access control | Restricted, Confidential and Internal. Role-based, enforced server-side on every request, scoped to the requesting user's organisation. |
| Tenant isolation | Confidential and Internal. Each merchant's data is held in its own dataset and access is checked per request. One merchant's data is never returned to another. |
| Excluded from telemetry | Restricted and Confidential. Error monitoring runs with personal data reporting disabled and variable capture switched off. |
| Deletion on termination | Restricted, Confidential and Internal. Within 30 days of account termination. |
05Third-party processing
Merchant data may be sent to third-party model providers in order to generate analysis for that merchant. Those providers act as service providers under confidentiality obligations and do not use the data to train their models. The current list of sub-processors is maintained in our Privacy Policy.
Restricted data is never sent to a model provider.
06Review
This policy is reviewed at least annually, and whenever a new data source is connected that introduces a field not already covered by an existing tier.