Pay Syncfor Shopify POS

Privacy Policy

Effective 5 October 2026

Pay Sync ("the App") is operated by AITCOM (Pty) Ltd t/a AskMario ("we", "us"), a South African company. It is installed by a merchant ("you") who takes card payments on Shopify POS using card terminals that run on a terminal provider's cloud service. This policy explains what the App stores, why, where it is kept, who it is shared with and when it is deleted.

The short version

  • Pay Sync keeps payment and reconciliation records for your shop: amounts, the references the terminal returns, a masked card number, and the Shopify order each payment belongs to.
  • It does not store customer names, email addresses, phone numbers or addresses, and it never stores a full card number, expiry date, CVV or PIN.
  • Records are kept in Frankfurt, Germany, and are deleted when Shopify sends its shop erasure request, about 48 hours after you uninstall (unless you have reinstalled by then).
  • We do not sell your data, and nothing the App stores is used for advertising or profiling.

Who is responsible for the data

For the payment and order records described below, you are the responsible party (the controller) and we are your operator (the processor) under the Protection of Personal Information Act (POPIA): we handle those records only to provide the App to you. For the details we hold about your account itself, such as your shop domain and any messages you send us, we are the responsible party.

What Pay Sync stores

For each shop that installs the App, Pay Sync stores:

  • Your shop and settings. Your shop domain and Shopify ID, the shop's currency (read from Shopify), your Shopify store locations (name and ID), the name of your terminal payment method, whether you are in Simulator or Live mode, and the connection details for your terminal provider. For billing it keeps the plan you chose in Shopify and your billing cycle dates. While the App is installed it also keeps the access token Shopify issues, so that it can read and write your orders.
  • Your terminals and tills. For each terminal: the label you give it, its terminal ID (TID) and merchant ID (MID) as printed on the slip, the site and till numbers your terminal provider uses to reach it, an optional serial number and its status. For each POS device (till): its device ID, the device name set in POS, the POS app version, its location and when it was last seen.
  • Payment records. For every sale or refund sent to a terminal, and for every payment a cashier captures from a slip or that first appears in the nightly report: the amount and currency, the time, the outcome (for example approved or declined) with the provider's response code and message, our own unique reference for the attempt, the references the terminal returns (the RRN, UTI and authorisation code and, where the provider supplies them, the STAN and batch number), the card scheme and a masked card number. Each record also holds the POS device ID, the staff member ID of the POS user (a number Shopify assigns, not a name), the Shopify order it was matched to and a short note of the cart when the payment was sent (the number of lines and the total).
  • The raw request and reply. For every call to your terminal provider we keep the request we sent and the reply we received, so that a disputed payment can be investigated. The request holds the amount, our reference and the site and till numbers (with the operator code) that address the terminal. The reply is the provider's answer as received, including the text of the printed slip: the masked card number, authorisation code, terminal and merchant IDs, and the till number and operator (cashier) code printed on it.
  • POS and order events. For every sale, return or exchange that POS reports as complete, whatever the payment method (cash included), Pay Sync keeps the event: the order ID, totals, tax and discounts, the payment methods and amounts, the location, device and staff member IDs and the line items on the sale. For orders and refunds that Shopify tells it about, Pay Sync keeps the same kind of details when the order was paid on your terminal payment method or carries a Pay Sync reference, or when the refund was paid out on that payment method. Customer-identifying fields are removed before any of this is saved (see below).
  • Nightly reports. For each till and day, what your terminal provider's report says: the number and total of sales and refunds and, for each transaction, its details as the report gives them, such as the time, amount, references, authorisation code, card type, masked card number, and terminal and merchant IDs. Card numbers in a report are masked before they are saved.
  • Exceptions, notes and activity. The exceptions Pay Sync raises for someone to review, any note you type when you resolve one, and the note on a Shopify refund when it causes an exception. An activity log records what was done (for example a setting saved or a slip captured), when, and by whom: the staff member ID for actions at the till, your shop domain for actions in the admin, or "system".
  • Technical records. A queue of background jobs, and server logs held by our hosting provider (for example webhook receipts, shop domains, order and payment reference numbers and error messages).

What Pay Sync does not store

  • Customer details. Pay Sync does not ask for or store customer names, email addresses, phone numbers or addresses. POS, order and refund events can carry customer fields, so Pay Sync removes them (the customer record and ID, names, email, phone, and billing and shipping addresses) before an event is saved. Free text that staff type into Shopify, such as an order note, is not read by Pay Sync, but if an event carries it, it is saved with the rest of that event. Please keep customer details out of notes.
  • Card details. Card details are entered on the card terminal. Pay Sync does not receive or store a full card number, expiry date, CVV or PIN. What the terminal returns, and what Pay Sync keeps, is a masked card number (the middle digits are hidden, and at most the first six and last four are shown), the card scheme, the authorisation code and reference numbers.

Why we use it

Pay Sync uses these records to:

  • send a sale or refund amount to the right terminal and show the cashier the result;
  • match each terminal payment to its Shopify order and write the result onto the order;
  • reconcile every night against your terminal provider's report, per till per day, and raise an exception for anything a person must look at;
  • keep the raw records and the activity log needed to investigate a disputed payment;
  • support you, keep the service secure and meet our legal duties.

Matching relies on the references each side records (our payment reference, the UTI and the RRN), which is why they are kept. This is transaction record-keeping, not marketing: nothing the App stores is used to advertise to, profile or contact anyone, and we do not sell or rent it. The pages of this website set no advertising or analytics cookies.

What Pay Sync writes to Shopify

The terminal's result is written onto the Shopify order as order metafields in the App's own namespace ($app): terminal ID, RRN, UTI, authorisation code, outcome, card scheme, masked card number and amount, plus the STAN and batch number where the provider supplies them, how the payment was captured, when it was paid, the RRNs of any refunds and a list of the order's terminal transactions. They are visible in your Shopify admin and available to your own exports and reporting. After an approved sale, Pay Sync also adds hidden properties to the POS cart (its own payment reference and a copy of the RRN, authorisation code, terminal ID, batch number and amount) so that the sale can be linked to its payment. It does not create payment transactions in Shopify and does not change an order's totals or payment status.

Pay Sync asks Shopify for three access scopes: read_locations (to match each terminal to the store location it stands in), read_orders (to read the POS order a payment belongs to: its number, total and payment methods) and write_orders (to write the metafields above).

Who we share it with

We use the service providers below (our sub-processors). We share data with no one else, except where the law requires it.

  • Shopify: hosts your store, orders and POS. Pay Sync reads and writes through Shopify's APIs, receives webhooks from it, and reports your usage (how many of your terminals were active in a billing cycle) so that Shopify can bill you.
  • Fly.io (Frankfurt, Germany): runs the App's application servers.
  • Neon (AWS eu-central-1, Frankfurt, Germany): hosts the App's Postgres database.
  • Your terminal provider and card acquirer: the payment services you connect. Pay Sync sends your terminal provider's cloud service the sale or refund amount, a unique reference and the site and till numbers (with the operator code) that address the terminal. It receives the result and the printed slip, and reads the provider's report for reconciliation. No customer details and no card details are sent. You choose these services and have your own agreement with them, and their own terms govern what they do with the data.

Where it is stored

The App's servers run on Fly.io in Frankfurt, Germany, and its database is a Neon Postgres database on AWS eu-central-1 (also Frankfurt). Your records are therefore stored and processed outside South Africa.

How it is protected

  • The connection details you save for your terminal provider are encrypted at rest with AES-256-GCM. The key is held as a secret on our hosting platform, separate from the database.
  • The identifiers that address a terminal (terminal ID, merchant ID, site and till numbers) also appear in the terminal and payment records described above, and those records are not separately encrypted.
  • The App's pages and API are served over HTTPS only. Requests from POS are checked with Shopify session tokens, and webhooks from Shopify are checked by their signature.

How long we keep it, and deletion

  • While the App is installed, your records are kept so that your reconciliation history stays complete. Pay Sync does not delete records on a schedule.
  • When you uninstall, Shopify tells Pay Sync at once. Pay Sync deletes the access token it holds for your shop and marks the shop as uninstalled. Your records stay in the database for the time being, so your history is intact if you reinstall.
  • About 48 hours after you uninstall, Shopify sends a shop erasure request (shop/redact). When Pay Sync receives it, everything held for your shop is deleted from our database: settings and encrypted credentials, terminals and devices, payment records with their raw requests and replies, POS and order events, nightly reports, exceptions and the activity log. You do not need to send a request. If you have reinstalled the App by then, nothing is deleted, because your shop is a current merchant again.
  • Customer requests. Shopify may also send customer data requests and customer erasure requests (customers/data_request and customers/redact). Pay Sync receives and acknowledges them. Because it does not store customer details, there is nothing to export or erase for a customer.

Copies of deleted records in our database provider's rolling recovery history are overwritten as that history ages out.

Your rights

You may ask for a copy of, a correction to, or the deletion of the records we hold for your shop, subject to the retention described above and any legal duty to keep records. If you are a customer or cardholder and want to know what a merchant holds about you, please ask the merchant. Pay Sync does not store customer names or contact details, so its records can only be found by order number or payment reference. Requests go to the address below. You may also complain to the Information Regulator (South Africa).

Changes to this policy

When we change this policy we update the effective date at the top of this page.

Contact

AITCOM (Pty) Ltd t/a AskMario, South Africa. Questions about this policy, or a data request, go to info@askmario.co.za.