This Privacy Policy describes how Syncek ("we", "us", "our") collects, uses, shares, and protects personal information in connection with the Syncek customer relationship management platform and the syncek.com website (together, the "Service"). It is issued under Regulation (EU) 2016/679 (GDPR), which reaches us under Art. 3(2) because we offer the Service to people in the European Union, and under the US state privacy laws listed in Section 10.2. By using the Service you acknowledge that your information will be handled as described here.

Current scope, as of the date above. Syncek is in closed beta and the Service is not yet generally available. The personal information we actually hold today is the contact details you give us to join the waitlist, to write to us, or to receive product updates. The sections below describe the full set of processing that applies as the Service opens to customers, so that you can read it before you decide to sign up rather than after.

1. Who we are

Our company-identification details are on the Legal Notice page. We are the controller (responsable del tratamiento) of personal information we collect about account holders and website visitors. When our customers use the Service to store information about their own customers, leads, and contacts, Syncek acts as a processor (encargado del tratamiento) on their behalf; the customer remains the controller of that information, and the relationship is governed by our Data Processing Addendum (DPA).

We have no lead supervisory authority, and that is a fact about us rather than a gap. The one-stop-shop in Art. 56 GDPR is available only to controllers with a main establishment in the EU. Syncek is established in the United States and has none, so no single authority is "ours": the competent authority is the one in your own country, and Section 10 tells you how to reach it. Any statement that a particular national regulator supervises us would be wrong.

We are not currently required to appoint a Data Protection Officer under Art. 37 GDPR. You can reach us directly at legal@syncek.com, in English or Spanish.

2. Information we collect

We collect the following categories of information:

Account information you provide when you sign up or subscribe: name, email address, password (stored hashed), workspace name, role, and company size.
Billing information needed to charge your subscription: billing name, address, VAT/fiscal identifier (NIF/NIF-IVA) where applicable, and the last four digits of the payment card together with the card brand. Full card details are collected and stored by Stripe, our payment processor; Syncek never sees or stores the full card number.
Customer Data you upload to the Service to operate your business: the contacts, companies, opportunities, notes, activities, files, and custom fields you create or import. Customer Data is your property; we process it on your instructions to provide the Service (see Section 5).
Usage and device information automatically collected as you interact with the Service: IP address, device and browser identifiers, approximate location derived from IP, pages viewed, features used, referring URLs, and timestamps. We use this information to operate and improve the Service and to detect abuse.
Communications you exchange with us: support tickets, emails, and survey responses, including any information you voluntarily include.
Cookies and similar technologies as described in our Cookie Policy.

We do not collect special categories of personal data (Art. 9 GDPR) in the ordinary operation of the Service, and we do not use your personal information to make automated decisions with legal or similarly significant effects on you (Art. 22 GDPR).

2.1 Data from connected Google accounts

When you connect a Google mailbox to Syncek you grant access through Google OAuth. We request these permissions and no others:

gmail.modify: to read your messages and show them inside the CRM next to the contact or opportunity they belong to; to keep read state, labels, and archiving in sync in both directions, so that acting in Syncek acts on your real mailbox; and to send replies and new messages from your own address. It is the narrowest permission that covers all three, and it cannot delete anything permanently.
userinfo.email and userinfo.profile: to identify which mailbox has just been connected.

What we store. The subject, the body in plain text and HTML, the participants, thread identifiers, and timestamps, plus attachment metadata: file name, type, and size. Attachment contents are requested from Google when you open them. The exception is images embedded in the body of a message: those are fetched during sync and stored inside the message, up to 2 MB per image and 5 MB per message, so that the email renders as it was sent. Access and refresh tokens are encrypted at rest and are never written in plain text.

What we use it for. Only to provide the features visible in Syncek: the inbox, the conversation timeline on each record, sending and replying, and search. Nothing else.

What we never do. We do not use Google user data for advertising of any kind, including retargeting and interest-based advertising. We do not sell it and we do not pass it to data brokers. We do not use it to train generalized artificial-intelligence or machine-learning models. Nobody on our team reads your messages unless you ask us to in order to resolve a support request, the law requires it, or it is strictly necessary for security, such as investigating an abuse report.

When you disconnect. Removing the mailbox from Syncek revokes our access, deletes the stored credentials, and triggers a background job that erases the messages synced from that account. A message a colleague also holds in their own connected mailbox stays in theirs.

Limited Use. Syncek's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including its Limited Use requirements.

3. How we use information

We use the information we collect to:

Provide, maintain, secure, and improve the Service, including customer support.
Process subscriptions, invoices, refunds, and related billing activities, and send transactional notices (invoices, renewal reminders, security alerts, service updates).
Communicate with you about your account, product changes, and (with your consent where required) product news and educational content. You can unsubscribe from marketing messages at any time.
Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service or applicable law.
Comply with legal obligations, respond to lawful requests, and enforce our rights.
Produce aggregated or de-identified analytics that do not identify any individual, for research and product development.

4. Legal bases for processing

Under the GDPR, we process personal information on the following legal bases:

Performance of the contract (Art. 6(1)(b) GDPR): to provide the Service you subscribed to, process payments, and deliver related communications.
Legitimate interests (Art. 6(1)(f) GDPR): to operate, secure, and improve the Service, prevent fraud and abuse, and keep customers informed of material product changes. We balance these interests against your rights and freedoms and will not rely on this basis where it is overridden by them.
Legal obligation (Art. 6(1)(c) GDPR) where Union or Member State law requires us to keep records, for example invoicing obligations in the country where a customer is established. Where the obligation arises under United States law instead, Art. 6(3) means it cannot ground Art. 6(1)(c), so we rely on our legitimate interest in complying with the law of the country where we are established (Art. 6(1)(f)), balanced against your rights.
Consent (Art. 6(1)(a) GDPR, and Art. 5(3) of the ePrivacy Directive as implemented in your own member state for non-essential cookies): for optional analytics cookies and marketing email to prospects. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Customer Data: our role as processor

When you upload contacts, companies, opportunities, and other records about individuals into your Syncek workspace, those individuals are data subjects and you are the controller of their information. You are responsible for providing notice to and, where required, obtaining the consent of those individuals, for defining a lawful basis under Art. 6 GDPR, and for responding to their requests to exercise data-subject rights. If a data subject contacts us about Customer Data, we will refer them to the relevant Syncek customer.

Our processing of Customer Data is governed by our Data Processing Addendum (DPA), which satisfies Art. 28 GDPR and incorporates the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and (for transfers to UK recipients) the UK International Data Transfer Addendum (IDTA). The DPA is accepted by you as part of the Terms of Service on a click-through basis; an executed PDF copy is available on request.

6. How we share information

We do not sell personal information and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

Sub-processors that operate the Service on our behalf: cloud hosting, object storage, email delivery, payment processing, and web analytics. The current list is published on our Sub-processors page. Each sub-processor is bound by contract to confidentiality and to process personal information only on documented instructions.
Other workspace members. If you are invited to a workspace, the workspace owner and administrators can see your account information, workspace activity, and the Customer Data you contribute.
Business transfers. If Syncek is involved in a merger, acquisition, financing, reorganization, insolvency, or sale of assets, information may be transferred as part of that transaction, subject to customary confidentiality commitments.
Legal and safety. When we believe in good faith that disclosure is necessary to comply with a legal obligation, respond to a valid legal request, enforce our agreements, protect the rights, property, or safety of Syncek, our users, or the public, or investigate fraud or security issues.
With your consent or at your direction.

We will notify customers of material changes to the sub-processor list at least thirty (30) days in advance, giving reasonable objection rights as set out in the DPA.

7. Where your data is stored and international transfers

Primary data residency. Customer Data and account information are stored in data-center regions within the European Union and United States. Backups are kept in the same regional scope.

International transfers. Some of our sub-processors operate outside the EU/EEA, in particular, Stripe (payment processing, United States), Resend (transactional email, United States), Cloudflare (object storage, global network), and Google LLC (Google Analytics 4, web analytics on the marketing site only, United States). Google Analytics is consent-gated: storage of advertising and analytics cookies is denied by default under Google Consent Mode v2, and we only record a cookieless, redacted measurement ping until you accept analytics in the cookie banner (legal basis: Art. 6(1)(a) GDPR, consent). Data retention is set to 14 months and Google Signals is disabled. When personal information is transferred to these recipients, we rely on the following safeguards under Chapter V GDPR:

EU-US Data Privacy Framework (DPF) adequacy for certified U.S. recipients (Commission Implementing Decision of 10 July 2023), where the recipient is self-certified;
EU Standard Contractual Clauses (SCCs, Commission Implementing Decision (EU) 2021/914) for recipients that are not DPF-certified;
UK International Data Transfer Addendum (IDTA) for onward transfers to UK recipients; and
Supplementary measures: TLS in transit, encryption at rest, strict access controls, and transfer-impact assessments where required.

If the DPF adequacy decision is annulled, suspended, or withdrawn, the Standard Contractual Clauses already incorporated into our Data Processing Addendum apply automatically to every transfer that had been relying on it, with no further action required by you or by us.

8. How long we keep information

Retention is defined by category:

Account information: for as long as your account is active and up to twelve (12) months after closure, to handle disputes and enforce our agreements.
Customer Data: until you delete it or close your account. After deletion, Customer Data is removed from production systems promptly and from routine backups within thirty (30) days.
Billing and tax records: retained for seven (7) years, which covers the record-keeping periods United States federal and state tax law impose on us. Where an EU member state requires a longer period for invoices issued to a customer in that state, we keep those records for the longer period.
Security and audit logs: typically ninety (90) days to twelve (12) months, depending on the log type.
Support communications: up to three (3) years after the last interaction.
Marketing preferences and unsubscribe records: retained for as long as needed to honor your choice.
Aggregated or anonymized data that cannot reasonably be linked to you may be retained indefinitely.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including TLS 1.2+ in transit, encryption at rest, least-privilege access controls, audit logging, automated vulnerability and dependency scanners, encryption of sensitive customer data such as API credentials and integration secrets using a key-management service, regular backups, and a formal incident-response process. For a detailed overview, see our Security page.

Breach notification. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify each competent supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of it (Art. 33 GDPR). Because we have no lead authority, that means every authority whose data subjects are affected, not one. Where the breach is likely to result in a high risk to you, we will also notify you within forty-eight (48) hours of becoming aware of it (Art. 34 GDPR), except where we apply the exemptions set out in Art. 34(3) GDPR. Both clocks start when we become aware, not when an investigation closes; a first notification may be preliminary, and we follow it with the remaining detail as we establish it.

United States. Where a breach affects residents of a US state, we notify affected individuals and, where the statute requires it, the state attorney general and the consumer reporting agencies, within the deadlines that state's breach-notification law sets. Those clocks run in parallel with the GDPR ones above, not after them. No security program is perfect; we aim to keep you informed honestly when incidents occur.

10. Your privacy rights

Subject to applicable law, you have the right to:

Access the personal information we hold about you and receive a portable copy (Arts. 15 and 20 GDPR).
Rectify information that is inaccurate or incomplete (Art. 16 GDPR).
Erase your personal information ("right to be forgotten", Art. 17 GDPR).
Restrict or object to certain processing, including direct marketing (Arts. 18 and 21 GDPR).
Withdraw consent where processing is based on consent (Art. 7(3) GDPR).
Not be subject to automated decision-making with legal or similarly significant effects (Art. 22 GDPR). Syncek does not engage in this kind of decision-making.
Lodge a complaint with the data protection authority of the EU or EEA country where you live, work, or where you think the problem happened (Art. 77 GDPR). The European Data Protection Board publishes the list at edpb.europa.eu. UK residents: the Information Commissioner's Office (ico.org.uk). Swiss residents: the Federal Data Protection and Information Commissioner (FDPIC). We have no lead authority, so none of these is a second-best choice: yours is the right one.

To exercise any of these rights, email legal@syncek.com. We will respond within the timeframes required by applicable law (one month under Art. 12(3) GDPR, extendable by two further months for complex requests). We may need to verify your identity before acting on a request. We do not discriminate against you for exercising your rights.

10.1 United Kingdom

Syncek does not offer the Service in the United Kingdom, so the representative requirement in Art. 27 UK GDPR is not engaged. If you are in the UK and we hold information about you, this Policy applies to it and every right in Section 10 is available to you: write to legal@syncek.com, or complain to the Information Commissioner's Office at ico.org.uk.

10.2 Additional rights for U.S. state residents (California and others)

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another U.S. state with a comprehensive privacy law, you have rights of access, correction, deletion, portability, and opt-out of targeted advertising or sale of personal information. Syncek does not sell personal information and does not share it for cross-context behavioral advertising or targeted advertising. You may designate an authorized agent to act on your behalf. California residents may request the categories and specific pieces of personal information we have collected about them in the past twelve months; the categories collected and the retention periods for each are described in Section 2 and Section 8 above. You will not receive discriminatory treatment for exercising any of these rights.

11. Children's privacy

The Service is a business tool and is not directed to children. Under Art. 8 GDPR the age of consent for information-society services is sixteen (16), which member states may lower to no less than thirteen (13); we do not knowingly collect personal information from anyone below the age that applies where they live. For users in the United States, we do not knowingly collect personal information from anyone under thirteen (13), as COPPA prohibits. If you believe a child has provided us personal information, contact us at legal@syncek.com and we will delete it.

12. Do Not Track and Global Privacy Control

We honor Global Privacy Control (GPC) signals sent by your browser as a valid request to opt out of sale or sharing under applicable U.S. state privacy laws. Because we do not sell or share personal information for cross-context behavioral advertising, a GPC signal does not change how we handle your information in practice, but we record it as a valid preference. We do not respond to legacy "Do Not Track" signals, which lack a common industry standard.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by applicable law, notify you in advance by email or through the Service. Your continued use of the Service after an update takes effect does not, by itself, mean you have consented to anything new: where we rely on your consent for a new purpose, we ask for it separately.

14. Language

This Policy is published in English and Spanish for convenience. In the event of any discrepancy, inconsistency, or conflict between the two versions, the English version prevails, except where mandatory law in the reader's own country requires otherwise.

15. Contact us

For questions about this Policy, to exercise your rights, or to request an executed copy of our DPA, contact us at legal@syncek.com.