Store Sync Privacy Notice

Effective date: 24 August 2026

This notice explains how JD Web Services Ltd trading as The Voice Concierge processes personal data through Store Sync.

It supplements our main Privacy Policy. If this notice provides more specific information about Store Sync, this notice applies to that Store Sync processing.

1. Who operates Store Sync

Store Sync is operated by:

JD Web Services Ltd trading as The Voice Concierge
Registered in England and Wales
Company number: 11453166
Registered office: 104 High Street, Mold, Flintshire, CH7 1BH
Email: [email protected]

2. Who this notice covers

This notice may be relevant to:

Store owners and agency users who install or administer Store Sync
Authorised HighLevel users
Shoppers and customers whose order information is processed
HighLevel contacts registered for back-in-stock information
People who submit a withdrawal or cancellation request
People whose information is used by a merchant’s configured Store Sync workflow or AI agent

3. Our data-protection roles

Store Sync account and service administration

We generally act as controller for:

Store Sync account, installation and authorised-user data
Subscription, credit and usage billing
Service security, fraud prevention and rate limits
Platform audit records
Direct support and legal records

Merchant customer and store data

For WooCommerce order, shopper, contact, back-in-stock and withdrawal information, we generally act as processor for the Store Sync customer. The customer is normally the controller and decides why Store Sync is used.

That processing is governed by the Store Sync Data Processing Agreement.

We may process limited related records as controller where necessary for security, billing, legal compliance and the establishment or defence of claims.

4. Information received from HighLevel

Depending on the installation and enabled features, Store Sync may process:

HighLevel company and location identifiers
Location display name and installation status
OAuth access and refresh tokens
Plan and Marketplace subscription information
Authorised-user and launch-session information
Custom-field definitions and identifiers
Tags and tag identifiers
Pipeline, stage, workflow, custom-value and custom-object setup evidence
Contact identifiers and limited contact details needed by an enabled action
Workflow-action requests and trigger subscriptions
Marketplace billing results

Store Sync requests only the permissions needed for implemented features. It does not use the native HighLevel product catalogue for normal Store Sync catalogue operation.

5. Information received from WooCommerce

Depending on product type and configuration, Store Sync may process:

Store URL, store currency and connection status
WooCommerce API credentials
Webhook identifiers and encrypted webhook secrets
Product and variation IDs
Product names, descriptions, short descriptions and images
Product URLs, status, categories and metadata
SKUs, prices and currency
Stock quantities and stock status
Variation attributes and options
Upsell and cross-sell relationships
WooCommerce product response data needed for supported tools and diagnostics

Products and variations are stored within the Store Sync tenant for the connected HighLevel location.

6. Order and contact information

Where order features are enabled, Store Sync may process:

WooCommerce order ID and order number
Order status
Currency and total
Date paid
Product and variation IDs
Product names, quantity and line total
Billing first and last name
Billing email address
Billing telephone number
Payment method name
Coupon codes
Whether Store Sync originated the checkout
Store URL and connection identifier

This information supports order-confirmed events, order lookup, CRM matching, reconciliation, audit and support.

Store Sync does not intentionally receive or store card numbers, card security codes, bank-login credentials or payment-provider secret keys through these order functions.

7. MCP, API, workflow and agent data

Store Sync may process:

MCP tool name and request timing
Tenant and request identifiers
Sanitised tool input and output metadata
API route and usage information
Workflow-action key and input
Event type and delivery status
Internal webhook destination and signing configuration
Agent-requested product, stock, cart, order, discount or setup information
Billing and rate-limit outcome

Sensitive and personal fields are masked or omitted from Store Sync tool logs where appropriate. The connected AI or workflow platform may maintain its own conversation, workflow or request records under the customer’s configuration.

MCP credentials and connection security

Store Sync issues and manages access credentials for authorised MCP clients and AI agents. These credentials may be restricted to specific access profiles and functions, and may be rotated or revoked.

We process credential identifiers, authentication and permission outcomes, request metadata and related security events to validate access, enforce tenant and plan restrictions, investigate misuse and protect the service.

Store Sync does not intentionally include complete MCP bearer credentials or authentication secrets in routine operational and security logs.

A valid MCP credential may be used by a compatible client other than the application in which it was originally configured. Customers should only provide credentials to applications and services they authorise and trust.

8. Withdrawal and back-in-stock data

An enabled back-in-stock registration may process:

HighLevel contact ID
Product and variation identifiers
Product name and SKU
Registration status
Applied HighLevel tag

An enabled withdrawal or cancellation-request feature may process:

Requester contact details
Order or transaction reference
Request timing and status
Reason or message submitted
Workflow and communication outcome
Technical and deduplication data

The merchant determines how to respond and remains responsible for any refund, order cancellation or legal assessment.

9. Usage, billing and security data

Store Sync may process:

Plan, subscription and payment status
Included credit, credit transactions and reset date
Meter, action, quantity and price
HighLevel wallet-charge status and reference
Request and idempotency identifiers
IP-derived security identifiers
Authentication success or failure
Rate-limit counters and events
System, audit, trigger and MCP logs
Security incident and tenant-isolation records

Security monitoring and IP information

Store Sync processes technical connection and security information to detect and investigate unauthorised access, credential misuse, excessive requests, attempted abuse and threats to service availability.

This information may include IP addresses, reduced network identifiers, pseudonymised IP-derived identifiers, authentication outcomes, request timestamps, MCP operations, rate-limit decisions and security alerts.

Where full IP addresses are not required, Store Sync reduces or pseudonymises them. Pseudonymised information may remain personal data where it can be linked to an identifiable individual.

Security monitoring information is accessible only for authorised operational, support and security purposes.

Where credential verification cannot be completed because of an internal infrastructure or database error, Store Sync records this separately from genuine authentication failures. These operational errors are not treated as failed sign-in attempts for security alerting or authentication-failure rate limits.

10. Information Store Sync does not require

Store Sync does not require customers to provide:

Full payment-card numbers
Card security codes
Online-banking passwords
WooCommerce administrator passwords
HighLevel user passwords
Special-category data for normal operation

Customers and end users should not place such information into product descriptions, support messages, workflow fields or AI prompts.

11. Why we process the information

Store Sync information is processed to:

Install and administer the application
Connect authorised HighLevel and WooCommerce accounts
Retrieve, store and update the WooCommerce catalogue
Retrieve and report product and stock information last synchronised from the connected WooCommerce store, including stock updates received through authorised webhooks.
Build carts and checkout links
Check and create authorised coupons
Retrieve authorised order status
Deliver configured workflow actions and events
Register back-in-stock interest
Operate withdrawal and cancellation-request functions
Supply authenticated MCP and API access
Check and repair setup assets
Apply credits and usage billing
Enforce plan access and rate limits
Prevent fraud, abuse and cross-tenant access
Investigate faults and provide support
Maintain audit, accounting and legal records

Store Sync product data is not used to operate the merchant’s store outside the functions requested or configured by the merchant.

12. Lawful bases

Where we act as controller, we may rely on:

Contract for installation, account administration, support and billing
Legitimate interests for security, fraud prevention, reliability, audit and service improvement
Legal obligation for tax, accounting, lawful requests and regulatory requirements
Legal claims where records are needed to establish, exercise or defend a claim

Where we act as processor, the merchant determines the lawful basis and provides documented instructions. Depending on the merchant’s use, its lawful basis may include contract, legitimate interests, consent or legal obligation. The merchant must make that assessment.

13. Who receives Store Sync information

Store Sync information may be made available to:

The Store Sync customer and its authorised users
HighLevel and LeadConnector for Marketplace, CRM, workflow, messaging and billing functions
The connected WooCommerce store and customer-selected WordPress hosting provider
Supabase for Store Sync database and server-side infrastructure
Lovable for Store Sync frontend application hosting and development services
Customer-authorised MCP clients, AI agents, workflows and webhook destinations
Communications providers used by an enabled workflow
Our support, security, professional-adviser and infrastructure providers
Regulators, courts, law enforcement or authorities where required by law

We do not sell Store Sync personal data.

14. AI agents and customer-controlled recipients

The merchant can connect Store Sync tools to a compatible AI agent or MCP client. When the agent calls a tool, relevant Store Sync data is returned to that authorised client.

The merchant is responsible for:

Selecting the AI or MCP provider
Configuring prompts, permissions and conversation retention
Informing end users about AI processing where required
Preventing unnecessary personal data from being sent to an agent
Reviewing provider terms, privacy notices and international transfers
Applying human review where output could materially affect a person

Store Sync product tools return information obtained from the connected WooCommerce store and held in the Store Sync catalogue. This information reflects the latest successfully processed synchronisation or applicable webhook update and may not represent the store’s exact current position.

Store Sync does not use generative AI to invent product catalogue records. However, third-party AI agents may independently interpret, summarise or describe tool results inaccurately. The merchant remains responsible for configuring and supervising its AI agents.

15. International transfers

Some service providers or customer-selected destinations may process information outside the United Kingdom.

Where we control a restricted transfer, we use a permitted safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

The merchant is responsible for transfers caused by its own selected AI agent, MCP client, workflow or webhook destination.

16. Retention

Current standard Store Sync operational periods include:

Record category	Standard retention
System logs	30 days
MCP tool logs	30 days
Trigger delivery logs	30 days
Trigger suppression logs	30 days
Rate-limit event logs	30 days
Coupon-creation claim records	30 days
Usage and billing events	90 days
Pending checkout reconciliation records	90 days
HighLevel webhook delivery records	90 days
MCP audit logs	180 days
Platform audit logs	180 days
WooCommerce order-event deduplication records	180 days

Credit transaction records, wallet charge records and withdrawal request logs are normally retained for six years from the end of the relevant billing period or final resolution of the charge or request, as applicable.

Records associated with unresolved disputes, chargebacks, reconciliation, legal claims or legal holds may be retained for longer where necessary. Once the relevant matter has been resolved, retention is reassessed in accordance with applicable legal obligations.

Security monitoring and temporary diagnostics

Detailed IP information associated with security audits is normally retained for up to 30 days. Pseudonymised IP identifiers and reduced network information used for security monitoring may be retained for up to 180 days.

Where temporary MCP technical diagnostics are enabled, the associated diagnostic records are normally retained for up to 14 days.

IP addresses recorded for administrator sign-in attempts are retained for up to 7 days for authentication security and abuse prevention.

These periods may differ from the retention of the wider audit record, which may be retained without the original detailed IP information.

Short-lived authentication, security and deduplication records can have shorter periods.

One-time HighLevel SSO replay markers may be retained for the life of the tenant to prevent a previously used launch assertion from being accepted again.

Product, variation, connection and configuration data is generally retained while the tenant and relevant connection remain active, then handled according to the disconnection, uninstall and deletion process.

Billing, tax, contractual and legal records for which we act as controller may be retained longer under the main Privacy Policy, normally at least 6 years where required for accounting and HMRC purposes.

Data can be retained longer where reasonably necessary for an active security incident, dispute, legal claim or binding legal obligation.

17. Security

Store Sync safeguards include:

Tenant-scoped data access
Database Row Level Security
Separate store and location credentials
Encryption of stored WooCommerce credentials and HighLevel tokens
Authenticated and signed webhook handling
Short-lived signed MCP tokens
API and MCP secrets stored in protected form
Rate limits and pre-authentication abuse controls
Idempotency and replay prevention
Restricted administrator and customer access
Secret and personal-data redaction in logs
Audit and security event recording
Validation of outbound webhook destinations
Profile-bound MCP credentials with independent rotation and revocation
Credential-version validation and tenant-level emergency access restrictions
Per-operation and rolling-period spending limits
Atomic usage-billing controls and reconciliation safeguards for uncertain billing outcomes
Tenant-scoped security monitoring and pseudonymised IP-based abuse detection

Customer Store Sync sessions are launched through verified HighLevel SSO. Customer session tokens are held in browser memory and are not deliberately placed in URLs, cookies or browser storage by Store Sync.

No internet-connected system can guarantee absolute security. Merchants must protect their HighLevel, WooCommerce, MCP and API credentials.

18. Disconnection, uninstall and deletion

WooCommerce disconnection

Disconnecting a store removes the active local store connection and credentials and attempts to remove Store Sync webhooks from WooCommerce. Historical operational records remain for the periods above.

HighLevel uninstall

Uninstalling Store Sync stops new application access and Store Sync operations for the location. The tenant is marked uninstalled and qualifying historical records remain for the applicable periods.

Subscription cancellation

Cancelling billing is separate from disconnecting or uninstalling and must be completed through the relevant HighLevel Marketplace billing settings.

End of included Store Sync access

Where Store Sync is included with a Voice Concierge or managed service, the included entitlement ends when the qualifying service ends or the relevant HighLevel account is transferred away from our agency.

Ending the included entitlement may stop new synchronisation, MCP tools, workflow actions, triggers, APIs and other Store Sync processing.

Store Sync-related workflows, custom fields, tags and configuration may remain within a transferred HighLevel account. The presence of those assets does not maintain Store Sync access.

If the Customer purchases Store Sync separately following a transfer, a new or continued Store Sync installation may process information under the Customer’s new subscription and authorisation.

Store Sync data and operational records are not automatically transferred between agency entitlements, installations or subscriptions. Historical information remains subject to the retention periods in this Notice and the Customer’s deletion or return rights under the Store Sync Data Processing Agreement.

Deletion requests

A Store Sync customer can request deletion or return of processor data under the Store Sync DPA. We may retain controller records, security evidence, billing records and information required by law.

Data in protected backups may remain beyond ordinary use until the applicable backup cycle completes.

19. Individual rights

Individuals may have rights to access, correct, erase, restrict, object to or receive their personal data, and to complain to the Information Commissioner’s Office.

Where Store Sync processes information for a merchant, the individual should normally contact that merchant first. We will assist the merchant under the Store Sync DPA.

Requests about Store Sync account, billing or support data for which we are controller can be sent to [email protected].

20. Merchant responsibilities

The merchant must:

Provide an appropriate privacy notice to shoppers and contacts
Identify a lawful basis for Store Sync use
Configure access and retention appropriately
Obtain consent for marketing or electronic communications where required
Respond to individual-rights requests
Avoid uploading unnecessary or unlawful personal data
Review customer-selected AI, workflow and webhook recipients
Notify us of relevant instructions, disputes or security incidents

21. Changes

We may update this notice when Store Sync, its providers or legal requirements change. The current version will show the effective date. We will take reasonable steps to notify customers of material changes.

22. Contact and complaints

For Store Sync privacy questions or requests:

JD Web Services Ltd trading as The Voice Concierge
104 High Street, Mold, Flintshire, CH7 1BH
Email: [email protected]

Individuals may complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

Store Sync