How we handle your data.

Synchronise AI (ABN 68 960 446 366) operates synchronise.ai, the app and the agents that work inside it. Privacy questions, requests and complaints go to gautham.srinivas163@gmail.com.

• Controller. We decide how your account, billing and usage data are handled, and the public business details we compile to find businesses for you.
• Processor. For the content of your workspace (your mailbox and connected tools, your leads, drafts, chats and files) we act on your instructions, under our Data Processing Addendum.
• You are the sender. When you choose to contact a business, the message is yours, sent from your mailbox, and you are responsible for it under the laws that apply to you.

This policy sits alongside our Terms of Service, Sub-processors list and Cookie Notice.

We do not collect card numbers, sensitive categories of information, or precise location, and we do not copy your connected systems into a separate database.

• Find businesses that fit your product, and draft, send and track your outreach.
• Answer your questions and run the agents you set up.
• Run your account, team and billing.
• Keep the service secure, prevent abuse and protect deliverability.
• Support you, fix problems and improve the product.
• Meet legal obligations, such as tax records.

Legal bases (UK and EU GDPR): performing our contract with you; legitimate interests (finding and contacting businesses about wholesale, security, and improving the service), balanced against the rights of the people concerned; consent where the law requires it; and legal obligation.

AI. Your content is sent to our AI providers only to produce the result you asked for. Under their API terms they do not train on it, and we do not train models on it either. Before text reaches our language models, email addresses and phone numbers are replaced with placeholders.

Learning from your edits.Only if an admin agrees when asked, we summarise how you edit, approve and dismiss drafts into notes that only your workspace's agents read. Nothing is shared with another workspace.

Outreach is sent from the mailbox you connect, never from ours. A person approves every email before it is sent; an approved batch may go out over the following days on the schedule you set. Automatic sending is off unless you turn it on, and then runs only within the limits you choose. Every send passes checks that protect you and the recipient: the address must accept mail, sending pauses if too many messages bounce, and anyone who has opted out is skipped.

A recipient who replies “stop” or “unsubscribe” is not emailed again from your workspace. Our own notification emails carry a link to turn them off.

Accounts connect through OAuth. Our connection broker, Composio, holds and refreshes the access tokens; we store only a reference to the connection. Disconnecting in Settings revokes it.

Gmail

Gmail consent runs through Composio's verified Google client, which asks for a broader set of permissions than we use. Google lets you grant only part of it.

• What we use: sending mail you approved, reading the replies, reading messages when you ask the assistant to, and your address and profile.
• What we never use: contacts, birthdays, phone numbers, postal addresses or language settings, granted or not.

Google user data

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features you use, is never sold, never used for advertising and never used to train AI models, and is not read by people unless you ask us to, it is needed for security, or the law requires it.

We use sub-processors for hosting, database, AI, OAuth, business data and email verification, billing, email and analytics. Each processes data only to provide its service to us. The current list, with purpose and location, is on the Sub-processors page.

We also share information when you direct us to, when the law requires it or to protect people and the service, and with a buyer of our business under this policy. We never sell personal information. To measure our own advertising we share limited information with Meta, as section 10 describes; we never share your workspace data or the businesses you contact for advertising.

Workspace data is stored in Tokyo, Japan. Every database table enforces row-level security, so a workspace can read only its own data. Data is encrypted in transit (TLS) and at rest (AES-256) by our infrastructure providers, and credentials you give us, such as API keys and bank tokens, are encrypted again by us with keys held outside the database. Staff access is limited to what running the service needs.

We do not hold our own SOC 2 report; our providers hold theirs. We notify affected customers of a personal data breach without undue delay, and within 72 hours under our Data Processing Addendum. Report a concern to gautham.srinivas163@gmail.com with the subject incident.

Message text storage. An admin can turn off storing message text in Settings, Workspace. We then keep who wrote and when and the drafts we write, but not their words: cards drop the excerpt, chats keep no record of what the assistant read, and analytics receive no text. Text already stored is deleted when the setting is turned off. The assistant still reads a message while it drafts a reply.

Deleting your account or workspace removes its live data at once; copies in backups age out on the provider's cycle.

Some sub-processors, including AI, email and analytics providers, process data outside Australia, mainly in the United States. We take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles. For transfers from the UK or EEA we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

• Necessary: the session cookie that keeps you signed in.
• Analytics: PostHog, for usage analytics and session recordings with every input and all on-screen text masked. Unless message text storage is off, PostHog also receives the questions you ask the assistant and its answers, with email addresses and phone numbers replaced, so we can improve its drafting.
• Billing: set by Stripe during checkout.
• Advertising: the Meta Pixel on our public website, never inside the app, records page views so we can measure our ads. When you sign up or pay, we tell Meta with a hashed copy of your email, your IP address and browser, and Meta's own cookies. None of this happens for visitors in the UK, the EEA or Switzerland.

You can block these cookies in your browser and manage ads in your Meta settings. Details are in the Cookie Notice.

You can ask to access, correct, export or delete your personal information, object to or restrict how we use it, or withdraw consent. Most of this works in Settings; otherwise email gautham.srinivas163@gmail.com. We may need to verify who you are, and we respond within 30 days.

If we found your business. If your details reached us from public sources and you would rather not be contacted, email us. We will delete what we hold about you and stop it being used for outreach.

If you are in a customer's workspace.Where we hold your information on a customer's behalf, we will pass your request to them and help them respond.

Complaints.Contact us first. You may also complain to the Office of the Australian Information Commissioner (OAIC), the UK Information Commissioner's Office or your EU supervisory authority. California and other US state residents have rights to know, delete and correct their information and to opt out of its being shared for advertising (email us), and we will not discriminate against you for using them.

Synchronise AI is a business product, not directed to anyone under 16, and we do not knowingly collect their information.

We post updates here with a new version and effective date, and email workspace admins before material changes take effect.

Synchronise AI · ABN 68 960 446 366 · gautham.srinivas163@gmail.com.