Privacy policy: Inventory Sync for Square

Last updated: 29 October 2026

This policy explains what data the Wix app “Inventory Sync for Square” (the app), published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we, us), processes when it is installed on a Wix site. It adds to the privacy policy for Kayabyte apps for Wix, which also applies.

What the app does

The app keeps stock (and, when the site owner turns it on, prices) in sync between the site’s Wix Stores catalog and the site owner’s Square account, and can create products on either side when the owner asks it to.

Roles

The site owner is the controller for the data in their Wix site and Square account. Kayabyte acts as a processor that handles the data only to run the sync the owner set up. Wix.com Ltd. hosts the site and the app’s dashboard page. Block, Inc. (Square) provides the Square account and its APIs. Cloudflare, Inc. hosts the app’s sync service and its storage and is a sub-processor.

Data the app reads

• From Wix: products and variants (names, SKUs, prices, option names), stock counts at the store’s default location, the site’s currency and catalog version, and the site’s plan for the app.
• From Square, for the connected account: the business name, locations (name, currency, country), catalog items and variations (names, SKUs, prices, stock tracking settings, image links when importing) and stock counts.
• The app does not read orders, customers, contacts, members, payments or any shopper data on either side.

Data the app stores

• The Square connection: the merchant ID, business name, chosen location, and the access and refresh tokens, encrypted (AES-GCM) and never shown in the dashboard.
• Links between Wix variants and Square variations, with their names, SKUs and last seen stock counts.
• The last read of both catalogs (variant names, SKUs, prices) for the lists in the dashboard.
• An activity log of the latest 300 sync events (time, item name, what changed).
• Short-lived records to prevent handling the same notification twice (3 days) and sign-in states (10 minutes).

Retention and deletion

Disconnecting Square deletes the tokens at once and revokes them with Square. When the app is removed from the site, syncing stops and the tokens are revoked; everything stored for the site is deleted 30 days later (a reinstall within those 30 days keeps the links). Site owners can ask for earlier deletion at support@kayabyte.dev.

Logs

The sync service writes technical log lines (the app instance ID, the request path, the outcome and error codes). Logs contain no customer data and are kept by Cloudflare for a short time.

Plans and payments

Paid plans are sold and billed by Wix. We never receive card details.

Cookies, tracking and third parties

The app sets no cookies on the site and uses no analytics, advertising or tracking services. No data is shared with third parties other than Wix, Square and Cloudflare, as described above.

Your rights

For questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev.

Changes

We will update this page if the app’s data handling changes. The date at the top shows the latest version.