Privacy Policy

Last Updated: 2026-04-01

Effective Date: April 1, 2026 Last Updated: April 1, 2026

1. Who We Are

Synesis is a financial analytics platform that helps restaurant and hospitality businesses understand their performance. We connect to your accounting, POS, and commerce platforms to surface insights, dashboards, and reports through our strategist partners.

Privacy Contact: privacy@synesisstrategy.com

2. The Data We Collect and Why

2a. Data You or Your Strategist Provides

CategoryExamplesWhy We Collect It
Account informationBusiness name, email address, roleCreate and manage your account
Billing informationContact name, billing email, payment method (processed by our payment provider)Process subscription payments
Configuration dataQB class mappings, GL account assignments, platform settingsDeliver the service as configured

2b. Data We Access via Your Authorized Platform Connections

When you connect QuickBooks, Shopify, Toast POS, Commerce7, or other supported platforms, you authorize Synesis to access specific data from those platforms on your behalf via OAuth 2.0. We access only what you authorize.

PlatformData Categories AccessedPurpose
QuickBooks OnlineChart of Accounts, Invoices, Bills, Payments, Expenses, Journal Entries, Sales Receipts, Credit Memos, Customers, Vendors, Classes, DepartmentsFinancial analytics, dashboards, reporting
ShopifyOrders, line items, transactions, refunds, payouts, productsPlatform revenue analytics
Toast POSPayment records, orders, check-level sales data (via CSV export)POS revenue analytics
Commerce7Orders, products, sales channelsCommerce analytics

Important: Synesis does not access your platform data beyond the permissions you grant. You can revoke access at any time through:

  • QuickBooks: accounts.intuit.com → Connected Apps
  • Shopify: Shopify Admin → Apps
  • Toast: Toast Admin Portal
  • Commerce7: Commerce7 Admin → Integrations

Synesis is not affiliated with, endorsed by, or sponsored by Intuit, Shopify, Toast, or Commerce7.

2c. Usage and Operational Data

CategoryExamplesWhy We Collect It
Log dataIP address, browser type, pages visited, timestampsSecurity, debugging, service improvement
Session dataAuthentication tokens, session identifiersKeep you logged in securely
Error reportsStack traces, request context (no financial data included)Diagnose and fix bugs

3. How We Use Your Data

We use your data only to:

  1. Deliver the service — sync your financial data, generate dashboards, run reports, and surface insights through your strategist
  2. Maintain and improve the service — fix bugs, optimize performance, add features
  3. Communicate with you — send service notifications, security alerts, and product updates
  4. Comply with legal obligations — respond to lawful requests, maintain required records
  5. Generate anonymized industry benchmarks (future feature) — contribute your de-identified financial metrics to anonymized peer comparisons; see Section 8 for details

We do not:

  • Sell your personal data to third parties
  • Use your QuickBooks, Shopify, Toast, or Commerce7 data to target advertising
  • Share your identifiable financial data with other Synesis clients
  • Use your data for any purpose other than delivering the services you have authorized

4. How We Share Your Data

We share data only in these limited circumstances:

Service Providers (Subprocessors)

We work with third-party service providers who process data on our behalf under data processing agreements.

Key subprocessors:

  • MongoDB Atlas (MongoDB, Inc.) — database hosting, United States
  • Amazon Web Services — application hosting via App Runner, United States
  • Intuit, Inc. — QuickBooks OAuth and API, United States
  • Shopify Inc. — Shopify API data source, United States/Canada

Legal Requirements

We may disclose your data if required by law, court order, or to protect the rights and safety of Synesis, our clients, or the public.

Business Transfers

If Synesis is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

Anonymized Aggregate Data (future)

We may publish anonymized industry benchmarks derived from client data. These publications cannot identify you or your business. See Section 8 for details.

5. Data Storage and Security

Where We Store Your Data

Your data is stored on MongoDB Atlas in the United States. Application hosting runs on AWS in the United States.

How We Protect Your Data

  • Encryption in transit: All data is transmitted over TLS 1.2 or higher
  • Encryption at rest: Your QuickBooks OAuth tokens are encrypted at rest using AES-256-CBC-HMAC-SHA-512 encryption before storage
  • Tenant isolation: Your financial data is strictly scoped to your account. No other Synesis client can access your data
  • Access controls: Access to production systems is restricted to authorized personnel

We do not store full payment card numbers. Payment processing, if any, is handled by PCI-compliant third parties.

6. Data Retention

We retain your data for the following periods:

Data CategoryRetention PeriodRationale
Financial records synced from QB, Shopify, Toast, Commerce77 years from sync dateIRS/accounting record standards
Account and billing recordsDuration of contract + 7 yearsContract law and tax compliance
Security and access logs2 yearsSecurity review and incident investigation
Support communications3 years after resolutionDispute resolution
OAuth tokens (access + refresh)Deleted immediately upon disconnection or contract terminationMinimize exposure

When you terminate your Synesis subscription, we will:

  • Provide a 30-day window to export your data
  • Delete or de-identify all personal data within 90 days of contract end
  • Retain anonymized/aggregate data and legally required records

7. Your Rights

Depending on your location, you may have the following rights:

All Users

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your data (subject to retention obligations above)
  • Portability: Receive your data in a structured, machine-readable format
  • Disconnect: Revoke platform access at any time through the respective platform or through Synesis Settings

California Residents (CCPA/CPRA)

  • Right to know: Categories of personal information collected and the business purposes
  • Right to delete: Subject to exceptions for legal compliance and service delivery
  • Right to correct: Request correction of inaccurate personal information
  • Right to opt out of sale/sharing: We do not sell or share personal information as defined under CCPA
  • Right to non-discrimination: We will not discriminate against you for exercising your rights

European Economic Area / UK Residents (GDPR/UK GDPR)

  • Lawful basis: We process your personal data based on: (1) contract performance — delivering the service; (2) legitimate interests — service improvement, security; (3) legal obligation — compliance
  • Right to object: Object to processing based on legitimate interests
  • Right to restriction: Restrict processing in certain circumstances
  • Right to erasure: "Right to be forgotten" subject to legal retention obligations
  • Supervisory authority: You have the right to lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at privacy@synesisstrategy.com. We will respond within 45 days for CCPA requests and within 30 days for GDPR requests.

8. Anonymized Benchmarking and Comparable Company Data

This section describes a future feature. When active, it will be governed by our Comparable Companies Data Policy.

We may use de-identified financial metrics from participating clients to generate anonymized industry benchmarks — showing clients how their performance compares to anonymous peer businesses in similar segments.

What is included: Revenue, COGS%, gross margin%, labor cost%, and period growth rates.

What is never included: Vendor names, customer names, employee details, specific transaction records, or any data that could identify your business.

Anonymization guarantee: Benchmarks are only displayed when at least 10 businesses contribute to the cohort.

Opt out: You can opt out of contributing to benchmarks at any time through Settings > Privacy > Benchmark Participation.

Data ownership: Aggregate benchmark outputs are Synesis's intellectual property. You retain ownership of your underlying business data.

9. Cookies and Tracking

We use the following cookies:

TypePurposeCan be disabled?
Strictly NecessarySession authentication, security tokensNo — required for the service to function
AnalyticsAnonymous usage statistics to improve the productYes — contact privacy@synesisstrategy.com

We do not use advertising or marketing cookies. We do not track you across third-party websites.

10. Third-Party Links

Our service may contain links to third-party platforms (QuickBooks, Shopify, etc.). Their privacy practices are governed by their own privacy policies, which we encourage you to review. Synesis is not responsible for third-party privacy practices.

11. Children's Privacy

Synesis is a B2B service not directed at individuals under 18. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We will notify you of material changes to this privacy policy by:

  • Updating the "Last Updated" date at the top of this page
  • Sending an email notification to account administrators for material changes

13. Contact Us

For privacy questions, data subject requests, or to report a privacy concern:

Email: privacy@synesisstrategy.com

Synesis is not affiliated with, endorsed by, or sponsored by Intuit Inc., Shopify Inc., Toast Inc., or Commerce7.