Privacy policy: Accounting Sync for Stores

Last updated: 6 November 2026

This policy explains what data the Wix app “Accounting Sync for Stores” (the app), published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we, us), processes when it is installed on a Wix site. It adds to the privacy policy for Kayabyte apps for Wix, which also applies.

What the app does

The app sends the site’s paid store orders, payments, refunds and cancellations to the Xero organisation that the site owner connects, as invoices, payments and credit notes.

Roles

The site owner is the controller for the data in their Wix site and Xero organisation. Kayabyte acts as a processor that handles the data only to run the sync the owner set up. Wix.com Ltd. hosts the site and the app’s dashboard page. Xero Limited provides the Xero organisation and its APIs. Cloudflare, Inc. hosts the app’s sync service and its storage and is a sub-processor.

Data the app reads

• From Wix: paid orders (order ID and number, dates, line items with names, quantities, prices, taxes and discounts, shipping, extra fees, totals and currency), the order’s payments and refunds (amounts, status, payment method type), the buyer’s name and email address, and the site’s time zone and plan for the app.
• From Xero, for the connected organisation: the organisation name, base currency and lock date, accounts, tax rates, currencies and tracking categories (for the settings lists), and the invoices, contacts, payments and credit notes the app created or needs to match.
• The app does not read card details, site members, contacts outside orders, or anything unrelated to orders.

Data sent to Xero

Invoices, payments and credit notes for each order, and a contact with the buyer’s name and email address (or one shared contact, if the site owner chooses that setting). Data goes only to the Xero organisation the site owner connected.

Data the app stores

• The Xero connection: the organisation ID and name, and the access and refresh tokens, encrypted (AES-GCM, one key per site) and never shown in the dashboard.
• The site owner’s settings (accounts, tax mapping, invoice options, start date).
• Per order: the order ID and number, totals, currency, sync state, a short message, and the IDs and numbers of the Xero documents created. These records are what stop an order from being sent twice.
• A log of recent sync events (time, order number, what happened), monthly order counts for the plan, and the tax rates seen on orders.
• Short-lived sign-in states (10 minutes).

Retention and deletion

Disconnecting Xero revokes and deletes the tokens at once. When the app is removed from the site, syncing stops and the Xero connection is revoked; the settings, event log and counts are deleted 30 days later, and all remaining records 90 days later (a reinstall within that time continues without sending orders twice). Documents already in Xero are never changed or deleted by removing the app. Site owners can ask for earlier deletion at support@kayabyte.dev.

Logs

The sync service writes technical log lines (the app instance ID, the request path, the outcome and error codes). Logs are kept by Cloudflare for a short time.

Plans and payments

Paid plans are sold and billed by Wix. We never receive card details.

Cookies, tracking and third parties

The app sets no cookies on the site and uses no analytics, advertising or tracking services. No data is shared with third parties other than Wix, Xero and Cloudflare, as described above.

Your rights

For questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev.

Changes

We will update this page when the app’s data use changes and show the date at the top.