AccountSync (“AccountSync”, “we”, “us”, or “our”) is a Shopify application that automatically syncs your store's orders, payments, payouts and inventory into your Xero accounting organisation. This Privacy Policy explains what data we access, how we use and store it, who we share it with, and the rights you have over it.
AccountSync is operated by That Web Agency, based in Australia. By installing or using AccountSync, you agree to the practices described in this policy.
This policy is written primarily for merchants who install AccountSync on their Shopify store. It also describes how we handle the limited store and transaction data that necessarily passes through the app when we create accounting records on your behalf.
AccountSync requests read-only access to your Shopify store. We never create, edit, or delete data in your Shopify store. We use the following Shopify access scopes:
| Scope | Why we need it |
|---|---|
read_orders, read_all_orders | Read order, line item, tax, discount and refund details to create matching invoices and credit notes in Xero, including backfilling historical orders. |
read_products, read_inventory | Read product, variant, cost and stock information for optional cost-of-goods-sold and inventory syncing. |
read_locations | Identify store locations associated with inventory and orders. |
read_shopify_payments_payouts | Read Shopify Payments payouts and balance transactions to reconcile bank deposits and processing fees in Xero. |
read_shopify_payments_disputes | Read chargeback and dispute information to reflect it in your accounting. |
read_shopify_payments_accounts | Read the Shopify Payments account details needed to map payouts correctly. |
AccountSync is designed to use the minimum personal data necessary. We read order financial data — such as order totals, line items, taxes, discounts, refunds, payments and payouts — to create matching accounting records. We do not request, use, or store protected customer fields such as customer name, email address, phone number or postal address. Invoices created in your Xero organisation are posted against a single generic contact (for example, “Shopify Sales”) rather than an individual customer, so customer identities are not transmitted to Xero by AccountSync.
Order financial data (for example, an order total or order ID) may be classified as personal data because it can be linked back to a unique person. We persist only your configuration and the cross-reference identifiers (for example, “Shopify order X corresponds to Xero invoice Y”) required to keep your books in sync and to avoid duplicate records. AccountSync does not store customer personal information in its own database.
| Data | Purpose |
|---|---|
| Your Shopify store domain and installation/session tokens | Authenticate the app and operate the embedded experience. |
| Your Xero OAuth tokens (encrypted at rest) | Authorise AccountSync to write accounting records to your chosen Xero organisation. |
| Your sync configuration and account mappings | Remember how you want orders, taxes, payments and inventory mapped to your Xero accounts. |
| Sync logs and Shopify↔Xero record identifiers | Track sync activity, prevent duplicate postings, and help diagnose issues. |
| Your subscription plan and monthly usage counts | Apply your plan's entitlements and order limits. |
We do not sell your data, and we do not use your store or customer data for advertising or marketing profiling.
AccountSync is hosted in Australia. Application servers run on Fly.io in the
Sydney (syd) region, and our database is hosted on Supabase in the
ap-southeast-2 (Sydney) region. Xero OAuth tokens are encrypted at rest using
AES-256-GCM. All data in transit is protected with TLS.
We share data only with the service providers necessary to operate AccountSync, and only to the extent required to deliver the service:
| Provider | Role |
|---|---|
| Shopify | The platform you install AccountSync from; source of order and store data. |
| Xero | The destination accounting system where AccountSync writes your records, at your direction. |
| Fly.io | Application hosting (Sydney region). |
| Supabase | Database and session storage (Sydney region). |
We may also disclose data where required by law, to comply with legal process, or to protect our rights, users, or the public.
Records that AccountSync has already written into your Xero organisation are owned and controlled by you within Xero and are not removed by uninstalling AccountSync.
AccountSync implements Shopify's mandatory privacy webhooks:
customers/data_request — Because AccountSync does not store customer personal information, there is no customer data for us to return.customers/redact — We hold no customer personal information to erase.shop/redact — We permanently delete all data associated with the store.We protect your data with industry-standard measures, including encryption of credentials at rest, TLS in transit, restricted server-side access to the database, and least-privilege, read-only access to your Shopify store. No method of transmission or storage is completely secure, but we work to protect your information and to limit what we collect to what is strictly necessary.
Depending on your location (including under the Australian Privacy Act and, where applicable, the GDPR), you may have the right to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. As the merchant, you are the data controller for your customers' information; AccountSync acts as a data processor on your behalf.
AccountSync is a business tool and is not directed to children. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated to merchants. Continued use of AccountSync after an update constitutes acceptance of the revised policy.