Privacy Policy

AI Transparency

Synecto uses artificial intelligence to process your text reflections, generate responses, and surface patterns and insights from your sessions.

You are always informed that you are interacting with an AI companion, not a human. Synecto is a personal reflection tool and is not a substitute for professional mental health care.

This disclosure is made in accordance with EU AI Act Article 50 transparency obligations.

1. Information we collect

When you use Synecto, we collect:

• Account info: email address, display name, and password (hashed).
• Reflection content: the text messages you type, saved to your account.
• Voice audio: voice reflection (live microphone conversation) is not currently offered, so no voice audio is streamed to or processed by any provider. Synecto is text-only at this time.
• Extracted insights: values, beliefs, goals, blockers, strengths, key quotes and actionable tasks derived from your sessions by AI.
• App preferences: theme, reminder schedules, language.
• Usage telemetry: minimal in-app metrics — session count, last reflection date, streak.
• Website analytics: on synecto.io we use cookieless Cloudflare Web Analytics always-on, plus Google Analytics 4 only if you opt in via the cookie banner. See section 9.

2. How we use your data

• To provide the Synecto app and personalise your experience
• To extract insights and build your evolving Inner Profile
• To send service emails (email verification, password resets, occasional product updates if you opt in)
• To detect and prevent abuse

We never sell your personal data. We never use your reflections to train AI models. Your data is processed only to make Synecto work for you.

3. Legal basis (GDPR)

We process your data on the lawful basis of contract performance (to provide the service you signed up for) and your consent (for optional features like email reminders). We do not intentionally collect special category data as defined under GDPR Article 9. If your reflections contain sensitive personal information relating to health, beliefs, or other special categories, this data is processed solely to provide the reflection service you requested, under your explicit consent.

4. Sub-processors

We use these vendors to deliver Synecto:

• Supabase (database, authentication) — hosted on AWS eu-west-1 (Ireland). No transfer outside EEA.
• OpenAI (text conversation, insight extraction) — processes your typed messages to generate responses and insights; does not use API data to train its models.
• Brevo (email delivery) — transactional emails only
• Cloudflare (CDN, DDoS protection, cookieless website analytics)
• Usercentrics (cookie-consent management on synecto.io)
• Google Analytics (provider: Google Ireland Ltd — website analytics on synecto.io, loaded only with your consent)
• Expo / EAS Hosting (web app hosting)
• Tavily (optional web-search context inside conversations)
• Google / Notion (only if you explicitly connect those integrations)

5. International transfers

Some of our sub-processors are based in the United States. Where data transfers occur, we rely on Standard Contractual Clauses and other appropriate safeguards under GDPR.

6. Data retention

We keep your data for as long as your account is active. You can delete your account and all associated data anytime from in-app Settings — this is irreversible and removes everything within 30 days.

If you joined the waitlist, we store only your email address, and only to let you know when Synecto opens. We delete waitlist emails once we launch (or sooner on request) — email hello@synecto.io anytime to be removed.

7. Your rights

Under GDPR you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Export your data in a portable format (we offer JSON export from Settings)
• Object to processing or withdraw consent
• Lodge a complaint with the Irish Data Protection Commission (dataprotection.ie)

To exercise any of these rights, email hello@synecto.io.

8. Children's privacy

Synecto is not intended for use by anyone under 18. We do not knowingly collect data from minors. If you believe we have, please contact us immediately.

9. Cookies & tracking

We do not use advertising cookies or marketing pixels. On synecto.io we show a cookie consent banner (managed by Usercentrics) because we offer optional analytics that set cookies. No non-essential cookies are set until you opt in, and you can change or withdraw your choice at any time by reopening the banner.

What we use:

• Usercentrics (consent management) — records your cookie choice so we can honour it. The consent record itself is strictly necessary and is set without prior consent, as permitted under EU ePrivacy rules.
• Cloudflare Web Analytics on synecto.io — cookieless and privacy-first. It records anonymous, aggregate visitor counts (page, country, device type) without IP addresses, fingerprinting or any identifiers, and runs without requiring consent. No data is shared with third parties.
• Google Analytics 4 on synecto.io — loaded only after you opt in via the banner. Provider: Google Ireland Ltd. It sets _ga and _ga_* cookies (around 13-month lifetime) to measure how visitors find and use the site. If you decline, Google Analytics never loads and no such cookies are set.
• Cloudflare bot-protection cookies (e.g. __cf_bm) — strictly necessary for security and DDoS protection. These are exempt from consent under EU ePrivacy rules.
• Local storage in the Synecto app — used only to keep you signed in and remember your preferences (theme, language). Cleared when you sign out.

10. Changes to this policy

We may update this policy occasionally. The "Last updated" date at the top reflects the most recent revision. Significant changes will be communicated via email.

11. Contact

Questions about your privacy? Email hello@synecto.io.