DripSync ("we", "our", "us") is an e-commerce image management application for Shopify and WooCommerce, owned and operated by Elytron Labs (operated by Sincero Ventures LLP). This policy explains what data we access, how we use it, and how we protect it.
1. Data We Access
From Your Store
When you connect DripSync, we access your store data through platform APIs (Shopify API or WooCommerce REST API) with the permissions you grant. This includes:
- Product information (titles, descriptions, SKUs, variants, images)
- Store information (store name, platform plan)
- For WooCommerce: REST API consumer key and secret (stored securely, used only for API access)
From Google
When you connect your Google account, we request the following OAuth scopes:
drive.readonly - Read-only access to your Google Drive files (we never modify or delete files)userinfo.email - Your Google account email address, for display in the appprofile - Basic profile info (name, profile picture), for display in the app
We use this access to:
- Browse and list folders so you can select your product images folder
- Read image files for AI-powered matching and upload to Shopify
- Display your Google account email and profile picture in the app settings
We do not modify, delete, or share any files in your Google Drive.
2. How We Use Your Data
- Image matching: We analyze product data and image filenames to suggest which images belong to which products.
- Image upload: When you confirm a match, we download the image from Google Drive and upload it to your store (Shopify or WooCommerce).
- AI analysis: On higher-tier plans, we use AI services to analyze image content for better matching accuracy. Image data sent to AI services is not stored by those services beyond the duration of the request.
3. Data Storage
- Your Shopify session tokens and Google OAuth tokens are stored securely in our database.
- Google OAuth tokens (access and refresh) are encrypted at rest using AES-256-GCM.
- Product metadata and image mapping data are stored to provide the service.
- Google Drive images are downloaded and stored on our image CDN to serve them to Shopify. These copies persist for as long as the app is installed.
4. Data Sharing
We do not sell, rent, or share your data with third parties, except:
- With Shopify or WooCommerce, to manage your products and images (as directed by you)
- With Google, to authenticate and access your Drive (as authorized by you)
- With Google (Gemini API), solely to analyze images for matching accuracy
- With our payment partners (Dodo Payments, Stripe, Cashfree, Razorpay), solely to process subscription payments
4a. The Hive (opt-in)
The Hive (formerly the “Elytron Network”) is an opt-in feature that lets DripSync deliver image-strategy benchmarks and additional sweeteners by aggregating pseudonymized catalog and image-attribute data across consenting merchants. You must explicitly opt in from the in-app Settings page before any data is contributed to the Network. Opt-in is off by default for all merchants on all tiers.
What we contribute to the Network (when opted in)
- Product catalog data: titles, product types, tags, descriptions, variant attributes
- Image attributes (angle, composition, background type, image purpose, quality score) extracted by our AI vision pipeline — only for images you have approved and pushed to your store. Never for images that remain unpushed in your Drive folder.
- Product barcodes (GTIN, EAN, UPC) that our system detects in your product images via optical character recognition. Used as the canonical product-matching key in the Network graph.
- The image-to-product mapping graph (which image is hero or alternate for which product/variant).
What we never contribute to the Network
- Raw image files or image bytes
- Image embeddings (vector representations) or full Gemini analysis text
- Any file in your connected Google Drive folder that you have not approved and pushed to your store
- Customer data, orders, payment data (we do not access these at all)
- Any merchant-confidential information (margins, supplier names, internal documents)
Pseudonymization
Your store domain is hashed using SHA-256 before any data enters the Network graph. Product titles and other text fields are bucketed by category. Other merchants can never see your raw product information from the Network — only inference outputs derived from the graph (benchmarks, aggregates, canonical matches).
Withdrawing consent
You may opt out of the Hive at any time from the in-app Settings page. Once you opt out, your contribution to the Network is removed within 30 days. Aggregated benchmarks already produced that mixed your data with hundreds of other merchants will continue to exist (we cannot un-mix averages), but new aggregates compute without your data.
Legal basis
Contribution to the Hive operates under your explicit opt-in consent. For Shopify-hosted merchants, this consent satisfies the requirements of Shopify Partner Program Agreement § 9.15(b) regarding per-merchant written consent. For all merchants, consent satisfies GDPR Article 6(1)(a) (consent) and India DPDP Act 2023 consent requirements. Your consent is recorded with a timestamp and the version of this disclosure you agreed to.
5. Google API Limited Use Disclosure
DripSync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We only use Google user data to provide and improve the DripSync image-matching service you requested.
- We do not use Google user data for advertising or to serve ads.
- We do not sell or transfer Google user data to third parties, except as necessary to provide the service, comply with applicable law, or as part of a merger/acquisition with equivalent privacy protections.
- We do not use Google user data to build user profiles for purposes unrelated to DripSync.
6. Human Access to Data
Access to Google user data by DripSync employees or contractors is limited to the following circumstances:
- Employees may access account metadata (email, token status, folder selections) for debugging purposes, only when the user has initiated a support request or reported an issue.
- Employees do not browse, view, or download the contents of your Google Drive files.
- Exceptions: We may access data as required to comply with applicable law, regulation, or legal process, or to investigate security incidents.
7. Data Retention
We retain your data for as long as the app is installed or your account is active.
- Shopify: When you uninstall DripSync, Shopify notifies us within 48 hours. We then delete all stored data - including OAuth tokens, product metadata, image mappings, and cached image files - within 30 days.
- WooCommerce: You can request data deletion from within the app (Settings > Data & Privacy) or by contacting us. Upon request, your data enters a 30-day grace period during which you can cancel the deletion. After 30 days, all data is permanently deleted.
Google OAuth tokens are revoked at the time of deletion on both platforms.
8. Your Rights
You can at any time:
- Disconnect your Google Drive account from within the app
- Uninstall DripSync from your Shopify store, or request account deletion from the WooCommerce app, to delete all associated data
- Revoke Google Drive access from your Google account settings
- Contact us to request data export or deletion
9. Security
We use industry-standard security measures including HTTPS encryption, secure token storage, and access controls. OAuth tokens are stored server-side and never exposed to client-side code.