Privacy policy

What is it?This policy explains how we process personal data, in our store and in our Shopify apps, published by Syde.

Last updated: 30 October 2026

This Privacy Policy is issued by WYOMIND SAS ("Syde", "we"), 2 rue Saint-Fiacre, 54000 Nancy, France, which operates the Syde brand, formerly Wyomind. It describes two kinds of processing:

in our store, when you visit it, buy our products, use your customer account or our services: Syde is the data controller (Part 1);
in our Shopify apps, which process the data of merchants' stores on their behalf: the merchant is the data controller, and Syde its processor within the meaning of Article 28 of the GDPR (Part 2).

Our products are sold exclusively to professionals. This policy is drafted in French in its original version, which alone is authentic and prevails over any other version, including this English version.

1. Our store: Syde as data controller

The personal data we process in our store are mainly those of the contact persons of our business customers.

1.1. Where your data are processed

Your data are processed in two places:

the online store, hosted by Shopify: catalogue, cart, checkout, customer account;
Syde's own services, which manage what the store does not: licenses and their activation, downloads, invoices and support.

1.2. Data we collect

Account and billing data: first and last name, company name, VAT number, billing address, email address.
Order data: products purchased, amounts, payment status. Payment card data are processed by our payment providers (Shopify Payments, PayPal); Syde never stores card numbers, bank account numbers or IBANs.
License data: the domain on which each license is activated, and the URL of the platform admin collected when an extension is downloaded and installed.
Support data: the content of your requests, the license concerned (extension, activation key, domain) and, where you provide them to allow an intervention, access credentials to your platform back office or servers. These credentials are kept secure and used only for the intervention.
Reviews: website URL, pseudonym and content of your review, when you choose to publish one.
Newsletter: your email address, if you subscribe.
Browsing data: device type and settings, operating system, browser, IP address, pages visited — collected through cookies, subject to your consent where required (see "Cookies" below).

1.3. Purposes and legal bases

Purpose	Legal basis
Processing orders, delivering and activating licenses, providing downloads and upgrades	Performance of the contract
Invoicing and accounting	Legal obligation
Customer support	Performance of the contract
Security of the store and fraud prevention	Legitimate interest
Audience measurement (Google Analytics)	Consent
Newsletter	Consent
Reviews and associated rewards	Consent

We do not use your data for targeted advertising, and we do not sell them.

1.4. Recipients

Your data are only shared with the service providers that help us run our activity, acting on our instructions:

Shopify — hosting of the online store, checkout, customer accounts (Shopify International Limited, Ireland);
Shopify Payments and PayPal — payment processing;
Google Analytics — audience measurement, only with your consent;
Help Scout — customer support;
Scaleway — hosting of Syde's own services (licenses, downloads, invoices).

1.5. Transfers outside the European Union

Some of these providers may process data outside the European Union, notably in the United States. Such transfers rely on an adequacy decision of the European Commission or on the Commission's Standard Contractual Clauses.

1.6. Retention periods

Customer account, license and support data: for as long as our business relationship lasts, then for the limitation period applicable to commercial disputes (5 years).
Invoices and accounting documents: 10 years, as required by the French Commercial Code.
Newsletter: until you unsubscribe.
Cookies and audience measurement data: 13 months at most.

1.7. Cookies

A consent banner lets you accept or refuse non-essential cookies when you first visit the store from the European Union, the European Economic Area, Switzerland or the United Kingdom. Refusing them does not prevent you from using the store. Cookies strictly necessary to the store (cart, session, security, remembering that a pop-up was closed) do not require consent.

2. Our Shopify apps: Syde as processor

Our Shopify apps (the "Apps") are governed by our Terms of sale. When a merchant installs an App, the data of its Shopify store that the App processes (the "Client Data") remain its own: the merchant is the sole data controller, and Syde processes these data as its processor, solely on its instructions and on its behalf (Articles 11 and 12 of the Terms of sale).

2.1. Subject-matter, nature and purpose

Syde processes the Client Data solely to provide the merchant with the services of the App it has installed, and for no other purpose: it hosts, caches, copies and displays them as these services require. The merchant's instructions result from its use of the App and its settings, and from its requests to Syde support.

2.2. Duration and end of processing

The processing lasts as long as the App is installed on the merchant's store. Upon uninstallation of the App or termination of the Terms of sale, the Client Data are erased or rendered unusable no later than sixty (60) days after the termination date (Article 18.3 of the Terms of sale); it is up to the merchant to retrieve them beforehand through the App's features.

2.3. Types of data and data subjects

Each App only accesses the store data that the merchant authorizes upon installation, as listed on Shopify's authorization screen and on the App's listing on the Shopify App Store. Depending on the App, these may include:

data of the merchant's customers: identity and contact details, customer account, addresses, orders, wishlists;
data of the merchant and its staff: name and email address of the store owner and of the users of the App;
store data that contain no personal data: products, collections, prices, inventory, theme.

The data subjects are the merchant's customers, the merchant itself and its staff.

2.4. Sub-processors

The merchant authorizes Syde to use the following sub-processors, bound by the same data protection obligations:

Heroku (Salesforce) — hosting of the Apps, in its European region;
Stackhero and Heroku Postgres — databases;
Redis Cloud (Redis) — cache;
Logtail (Better Stack) — application logs;
Sysnove — hosting of the Product Feeds App.

Syde informs the merchant of any intended change to this list by updating it, with reasonable prior notice; a merchant who objects may uninstall the App. Syde stores the Client Data on servers located in Europe (Article 13 of the Terms of sale).

2.5. Security and confidentiality

Syde implements appropriate technical and organizational measures to protect the Client Data against accidental or unlawful destruction or alteration, unauthorized disclosure or access, and other forms of unlawful processing; all connections between the merchant's store and the Apps are secured (Article 13 of the Terms of sale). The persons authorized to process the Client Data at Syde are bound by confidentiality.

2.6. Assistance to the merchant

Taking into account the nature of the processing, Syde assists the merchant:

in responding to requests from data subjects exercising their rights; any request Syde receives directly is forwarded to the merchant;
in complying with its obligations relating to security, the notification of personal data breaches and, where applicable, data protection impact assessments;
by notifying it of any personal data breach without undue delay after becoming aware of it.

Syde makes available to the merchant the information necessary to demonstrate compliance with these obligations, and allows for and contributes to audits.

3. Your rights

You have the right to access, rectify and erase your data, to restrict or object to their processing, to data portability, and to withdraw your consent at any time. You may also give instructions regarding the fate of your data after your death.

To exercise these rights, write to hello@syde.shop. A request is handled in both places where your data are processed — the store and Syde's services.

If your data are processed by one of our Apps on behalf of a merchant, please address your request to that merchant, who is the data controller; Syde assists it in responding (Part 2).

You may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of the country where you live.

4. Changes

We may update this policy. The date of the last update appears at the top of the page.