As of October 3, 2026
Privacy policy
UM Multistore Sync keeps inventory in step across Shopify stores and stores only what it needs to do that. No customer data, no orders, no advertising, no analytics.
Controller
UBARTAS.MEDIA GmbH, Nicolaiweg 4b, 59494 Soest, Germany. Represented by Andrei Ubartas. Email: mail@ubartas.de
What the app stores
| Data | Purpose | How long |
|---|---|---|
| The shop's address (…myshopify.com) and the access token from Shopify, encrypted | So the app can read and write inventory on the shop's behalf | The token is deleted immediately on uninstall, the address together with all other data |
| Product and variant names, SKUs, the shop's locations | To match items and locations between the stores | Until deletion (see below) |
| Inventory quantities and a log of every change the app makes | For syncing, and so every number can be traced | Until deletion (see below) |
| Plan and subscription status | Billing runs through Shopify; the app only remembers which plan applies | Until deletion (see below) |
| Server logs (time, requested address) | Operations and security | Short term |
The legal basis is the performance of the contract with the merchant (Art. 6(1)(b) GDPR), and for server logs our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
What the app does not store
- No data about the shop's customers: no names, email addresses, postal addresses or phone numbers
- No orders: the app has no access to them
- No personal data of staff: the app signs in for the shop, not for a person
- No tracking cookies, no analytics tools, no ad networks
When data is deleted
When the app is uninstalled, it deletes the access token immediately. 48 hours later Shopify sends the request to delete all of the shop's data; the app then deletes it immediately and completely. When a store leaves a group, its data is removed from that group immediately.
Who receives the data
Shopify, because the app reads and writes inventory through Shopify's API. The server is located in Germany; the hosting provider processes data on our behalf under a contract according to Art. 28 GDPR. No one else.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). An informal email is enough. You can also lodge a complaint with a supervisory authority; the competent one is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. mail@ubartas.de
Legal notice
UBARTAS.MEDIA GmbH, Nicolaiweg 4b, 59494 Soest, Germany
Represented by Andrei Ubartas, managing director
Commercial register: Amtsgericht Arnsberg, HRB 14703
VAT identification number according to § 27a UStG: DE359381550
Email: mail@ubartas.de