Privacy Policy.

Information we collect

Research-interest forms

We collect your work email, role and company, industry, the problem and desired outcome you describe, the research concept you select, your required data-use consent, and your optional indication of beta interest.

Custom-agent enquiry forms

We collect your name, work email, desired outcome, current workflow and systems, and required data-use consent. Company, industry, work frequency, and desired timing are optional.

How the information is used

We use submitted information to respond to enquiries, evaluate demand for future-agent research, consider optional beta interest if relevant, and prevent abuse of the forms.

Data-use consent is required so SYNIRIA can assess and respond to a submission. Beta interest is separate and optional. Selecting it does not guarantee development, a release date, an invitation, or access.

Retention and abuse prevention

• Enquiry records are retained for 12 months from receipt.
• Rate-limit hashes used for abuse prevention expire after 24 hours.
• Our enquiry database does not store raw IP addresses, anti-bot tokens, or request headers.

Services involved

The website and enquiry service run on Hetzner infrastructure. We use self-hosted n8n automation and PostgreSQL storage to process and keep enquiries, and Sender to send acknowledgement and internal notification emails containing the submission details.

Cloudflare Turnstile checks form submissions for abuse. Google Fonts supplies the typography assets loaded by your browser. These external services receive the connection information needed to provide their services, which can include your IP address and browser information.

Our database retention periods above apply to enquiry records and abuse-prevention hashes. Email copies and service-provider records are handled under the relevant service settings and retention policies. Submitting an enquiry does not add you to a marketing mailing list.

Chat on this website

The chat on syniria.com is SYNIRIA’s own Customer Service Agent, so for it SYNIRIA is the business you are talking to and decides how your messages are used: to answer you and to follow up. It works as described for website chat in the Customer Service Agent part below (sections 1, 2, 4, and 6): replies are written by an AI model from a third-party provider, and our team may read the conversation and join it. We keep these conversations while our own workspace is active, as we would any customer’s conversation. To have your conversation deleted, email info@syniria.com and tell us roughly when you chatted and what you wrote, so we can find it.

Your information requests

To request access to, correction of, or deletion of information you submitted, email info@syniria.com. Please include enough detail for us to identify the relevant enquiry.

If this notice changes materially, SYNIRIA will update the effective date and make the revised notice available on this page.

Non-essential tracking

This release does not load non-essential analytics or advertising trackers.

1. Information we collect

From Clients (account & configuration). When you create an account and set up your agent, we collect:

• Account details: email address and a password, which we store using industry-standard one-way hashing (never in plain text).
• Business profile: business name, contact name, contact email/phone, time zone, and business type.
• Agent configuration: agent name, tone, business description, hours, FAQs, reactivation phrase, lead-capture field definitions, and your product/service catalog.
• Knowledge sources you upload: PDFs, spreadsheets, and website URLs you add for the agent to learn from.
• Contacts you add or import: the names, phone numbers, email addresses, and notes of your customers and leads.
• Connected-channel credentials: access tokens for the Facebook Pages, Instagram, and WhatsApp accounts you connect. These are encrypted at rest.
• Billing information, processed by our payment provider (see Sharing, below).

From end customers (via connected channels). When someone messages a Client’s connected channel, we process on the Client’s behalf:

• The content of messages exchanged with the Client’s agent or team: text, transcripts of voice notes, and any media the customer sends — images, video, audio files, documents, and shared locations. Media files are stored on our behalf by a third-party object-storage provider (see Sharing, below) and are automatically deleted after 90 days.
• Platform-provided identifiers (e.g. the sender’s platform-scoped ID) needed to route and reply to the conversation.
• The delivery status of each reply sent through a connected channel (sent, delivered, read or not delivered), as the channel reports it.
• Lead/booking details the customer provides in conversation (e.g. name, phone, email, and other fields the Client has configured), stored so the Client can follow up.

WhatsApp campaigns. A Client can send an approved WhatsApp message to a list of its contacts (a “campaign”). For each campaign we process, on the Client’s behalf, the phone number and name of each person it is sent to, the message, its status as reported by WhatsApp (sent, delivered, read, or failed), and any reply. When a person opts out of a Client’s campaigns, we record that phone number so that the Client’s later campaigns leave it out. The Client is responsible for having each person’s agreement to receive these messages.

From website visitors (via website chat). When a Client adds Syniria’s website chat to its website, we process on the Client’s behalf:

• the messages a visitor sends (text only) and the replies they receive, including anything they choose to share in them, for example a name, phone number, or email address to book an appointment, which may also be saved as contact, lead, or booking details so the Client can follow up;
• a random access key kept in the browser storage of the Client’s website, so the conversation can continue on a later visit (we store only a one-way hash of it, with a separate random visitor ID), and the contact entry the Client sees for the visitor;
• the address of the page where the chat started, without anything after “?” or “#”, and the times of the visitor’s messages and visits;
• for each reply, when the visitor’s chat window received it and when it showed it with the chat open;
• the website the Client’s widget was last shown on, so the Client can check it is installed.

Loading a page that shows the widget sends the visitor’s browser details and IP address to our server, even if they never write. We use the IP address to limit abuse, holding it only in our server’s memory, and pass it to Cloudflare for the check described in section 6. We do not save it in our database. When the Client’s AI agent is answering, replies are written by an AI model from a third-party provider (see section 4). The Client’s team can read the chat and join it, or answer it alone.

Files a Client’s team sends. From the dashboard, a Client’s team can send files and voice notes, such as photos and PDFs, in a conversation. We store each one in Cloudflare R2, our object-storage provider, and delete it 90 days after it is sent (see section 7). On WhatsApp, Messenger and Instagram, we share it with Meta, which delivers it to the customer. In website chat, the visitor’s browser loads it directly from Cloudflare R2.

Automatically. When you use the dashboard, we automatically collect technical information such as IP address, browser type, operating system, device information, timestamps, and security logs, to operate and protect the Service.

2. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to provide the Service:

• keeping you signed in (authentication and session cookies);
• securing the channel-connection flow (short-lived functional cookies);
• protecting against fraud and abuse, and improving security.

You can control these cookies through your browser settings, though disabling strictly necessary cookies may prevent parts of the Service from working.

Optional ad measurement, effective 6 October 2026. With your permission, we also use cookies and browser identifiers to measure Syniria’s ads. We share page visits and successful enquiries, account registrations and Free trial starts with an advertising measurement provider to understand which actions follow our ads. The provider also receives connection information, including your IP address and browser information. After a successful enquiry or registration, we may share a hashed version of the email address you submitted for matching. The browser measurement technology may also detect supported contact details entered on these pages and normalize and hash them for ad matching. Hashing does not make this information anonymous.

Syniria sends these page and conversion events only from its marketing, contact, signup and initial workspace setup pages at app.syniria.com. On other pages, including the dashboard and booking pages, we instruct the measurement technology to pause; a previously loaded script may remain in your browser. Clients’ customer conversations, catalog activity and bookings are outside the measurement scope.

Measurement starts only if you allow it. You can decline without affecting your use of the Service, or change your choice through “Ad measurement settings” on these pages. We store your choice in your browser.

Website chat. Syniria’s chat code sets no cookies. It keeps the access key described in section 1 in the browser storage of the Client’s website, only so the visitor’s conversation can continue, and does not use it for advertising or tracking. Clearing that website’s site data removes the key from the browser; the conversation itself stays with the Client. The Cloudflare check described in section 6 may use its own cookies or similar technologies, as Cloudflare’s Turnstile Privacy Addendum describes.

3. How we use information

• To operate the Service — run the AI agent, deliver replies, capture leads, and send the WhatsApp campaigns a Client chooses to send.
• To let Clients configure, monitor, and manage their agent and channels.
• To authenticate accounts and send transactional emails (verification, password reset).
• To process subscriptions and payments.
• With your permission, to measure visits and successful actions from Syniria’s ads, as described in section 2.
• To secure the Service, prevent abuse, and comply with legal obligations.

We do not sell personal information, and we do not use end-customer message content for advertising.

4. AI processing

Agent replies are generated by third-party AI model providers. To produce a reply, we share only the information reasonably necessary to generate a response — relevant conversation content and the Client’s configured business information — with these providers, and we require them to protect that information in accordance with applicable agreements. AI-generated responses may be inaccurate or incomplete; Clients are responsible for reviewing and overseeing their agent’s behavior.

Conversation content is not limited to text. Voice notes a customer sends are transcribed by a speech-recognition provider so the agent can read them, and images a customer sends may be analysed by an AI model so the agent can respond to what is in them; both happen only when the Client’s AI agent is answering that chat. In both cases the file, or a short-lived link to it, is sent to the provider only for that purpose and only at the time the reply is being produced.

5. Meta platform data

When you connect a Facebook Page, Instagram, or WhatsApp account, we receive and store an access token (encrypted) and the identifiers needed to send and receive messages on your behalf, using the permissions you grant during connection. We use this data solely to provide the messaging features you enable — never to build advertising profiles. You can disconnect a channel at any time from the dashboard, which deactivates it and deletes the stored token. Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.

6. How we share information

We share information with providers that help us operate the Service or measure our ads with your permission, with an affiliate who referred you (see below), and as required by law. These include providers for:

• messaging on connected channels;
• object storage, for content Clients upload, for media sent in conversations by end customers or by a Client’s team, and for catalogue photos and team files shown in website chat, which the visitor’s browser loads directly (Cloudflare R2);
• bot detection for website chat: when a visitor sends their first message, or a new chat has to be started, Cloudflare Turnstile checks that the visitor is a person. Cloudflare receives device and network data for that check, including the visitor’s IP address, which our server also passes to Cloudflare to confirm the result, as Cloudflare’s Turnstile Privacy Addendum describes;
• payment processing (which handles your card details directly);
• AI response generation;
• transactional email delivery;
• advertising measurement, only with your permission and for the information and pages described in section 2;
• hosting and infrastructure on which the Service runs.

We may add or replace service providers as our business evolves, and we will update this policy to reflect material changes.

Affiliates. If you subscribed with an affiliate’s promotion code, or an affiliate introduced you to us, that affiliate can see the first two letters of your business name, your plan and subscription status, the dates of the payments that earn them a commission, and the commission amounts. They cannot see your conversations, your customers or your contact details.

7. Data retention

We retain Client account and configuration data for as long as the account is active, and end-customer conversation and lead data on the Client’s behalf for as long as the Client’s account is active or until the Client deletes it. Website chat conversations, visitor records, and their contact entries are kept on the Client’s behalf on the same basis as other conversations. Records of WhatsApp campaigns — who each campaign was sent to, its delivery status, and opt-outs — are kept for as long as the Client’s account is active. When an account is closed, we delete or anonymize associated personal data within a reasonable period, except where retention is required by law. Deleted data may persist in encrypted backups for a limited time before being permanently removed through our normal backup-rotation schedule.

Media files have a shorter, fixed retention period. Images, video, audio files, and documents sent by end customers in a conversation are automatically and permanently deleted 90 days after they are received, regardless of whether the Client’s account remains active. Files and voice notes a Client’s team sends from the dashboard, including in website chat, are deleted the same way, 90 days after they are sent. Files the team sends from Meta’s own apps on a connected channel, such as the WhatsApp Business app, are deleted 90 days after they reach us. The conversation record itself is kept, so the Client can still see that a file was sent, but the file is no longer retrievable from the Service. Deleting our copy does not remove a file from WhatsApp, Messenger or Instagram, where Meta’s own terms apply to it.

8. Security

We use industry-standard measures to protect information, including encryption in transit, AES-256 encryption of connected-channel access tokens at rest, and one-way hashing of passwords. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or export your personal data, or to object to or restrict certain processing. Clients can edit or remove most of their data directly in the dashboard. End customers should direct requests to the Client they interacted with (the controller of that data); we will assist Clients in fulfilling such requests.

You can contact info@syniria.com to exercise your rights or raise a privacy concern. We may request information reasonably necessary to verify your identity or authority and locate the relevant records. We will respond within the period required by applicable law and explain any applicable exception or permitted extension. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Depending on the law that applies to you, you may also lodge a complaint with the competent data protection authority.

10. Data deletion

To request deletion of data associated with your Meta account, you can remove the Syniria app from your Facebook/Instagram settings, which may initiate our data-deletion process, or contact us at info@syniria.com. Clients can also disconnect any channel from the dashboard at any time to immediately delete its stored access token.

End-customer media. If an end customer wants media they sent to a Client’s connected channel deleted before the automatic 90-day expiry, they should ask that Client, who can request erasure of that conversation’s files from us; we will action it and confirm. Requests can also be sent directly to info@syniria.com, though we may need the Client’s involvement to identify the correct conversation. See our data deletion page for more.

11. Third-party links

The Service and dashboard may contain links to third-party websites and platforms (such as Meta, our payment provider, and documentation). We are not responsible for the privacy practices or content of those third parties, and this policy does not apply to them.

12. Business transfers

If Syniria is involved in a merger, acquisition, financing, or sale of all or part of its assets, information covered by this policy may be transferred as part of that transaction. We will continue to protect it consistent with this policy and notify you where required.

13. Account termination

You can close your account at any time by contacting us, or through the dashboard where available. When you close your account, we stop processing your data for the Service and delete or anonymize it as described under Data Retention, except where we are required to keep it. Disconnecting a channel deletes its stored access token immediately.

14. International transfers

Syniria is a company registered in the United States, and Syniria and its service providers may process and store data in various countries. Where we transfer personal data across borders, we take steps to ensure it remains protected consistent with this policy and applicable law.

15. Children's privacy

The Service is not directed to children under 13 or the minimum age required under applicable law, and we do not knowingly collect their personal information.

16. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and by email or a prominent in-Service notice explaining the change and its effective date. Where required by applicable law, we will obtain consent before applying a change to the processing of your information.

17. Contact us

Syniria — 5830 E 2nd St, Ste 7000 #37147, Casper, WY 82609, US.
Email: info@syniria.com