This Privacy Policy explains what personal data Syntra collects, how we use and share it, and the choices and rights you have - both when we act as a controller for our website and direct customers, and when we act as a processor for the data our customers route through the Services.
1.About this policy & scope
This Privacy Policy explains how SYNTRA LLC ("Syntra", "we", "us" or "our"), of 8 The Green, Dover, Delaware 19901, collects, uses, shares and protects personal data. It applies to our website, our platform and applications, and our AI-powered services (together, the "Services"), including the AI Agent that makes and answers calls, sends messages, takes bookings and handles enquiries on our customers' behalf.
Throughout this policy, "Customer" ("you" or "your") means the business or individual that registers for or uses the Services, and "End User" means a customer, client, patient, contact or other person who interacts with a Customer through the Services. This policy should be read together with our Terms of Service, our Cookie Policy and, where we act as a processor, our Data Processing Addendum.
2.Our role: controller vs processor
The way we handle personal data, and our responsibilities for it, depend on the context in which we process it.
- Where we are the controller - we determine the purposes and means of processing for personal data about our website visitors, our direct Customers and their account users, and people who contact us or express interest in Syntra. This policy governs that processing.
- Where we are a processor - where we process personal data contained in Customer Data on a Customer's behalf (for example, the call recordings, transcripts, messages, bookings and contact records generated when the AI Agent interacts with End Users), the Customer is the controller and decides why and how that data is processed. We act as processor under our Data Processing Addendum and process that data only on the Customer's documented instructions.
If you are an End User and want to understand how your personal data is used, please refer in the first instance to the privacy notice of the Customer you interacted with, as they are the controller of that data.
3.Information we collect
We collect the following categories of personal data, depending on how you use the Services:
- Account & profile data - the name, business name, email address, phone number, role and login credentials you provide when you create or manage an account, together with your settings and preferences.
- Billing data - the plan you select and billing details. Card and bank details are collected and processed directly by our payment processor; we receive limited information such as the last four digits, card type, billing country and transaction status, and do not store full card numbers ourselves.
- Usage, log & device data - information generated when you use the Services, such as IP address, browser and device type, operating system, pages and features accessed, referring URLs, timestamps and diagnostic or error data.
- Cookies & similar technologies - as described in our Cookie Policy, we and our partners use cookies and similar technologies to operate, secure and analyse the Services.
- Communications with us - the content of messages, support tickets, enquiries and other correspondence you send us, and records of your interactions with our team.
- Content processed through the Services - content you or your End Users provide to, or generate through, the Services, including call recordings, transcripts, messages (across SMS, email, WhatsApp and chat), booking details, prompts, scripts, knowledge and contact records. Where this content contains personal data of End Users, we process it as a processor on the Customer's behalf as described above.
4.End User information
When a Customer configures the AI Agent to communicate with its End Users, personal data about those End Users is routed through the Services. This may include names, contact details, the content and recordings of calls and messages, booking and appointment details, enquiry details and any other information an End User shares during an interaction.
We process End User personal data as a processor, on the relevant Customer's behalf and on its instructions, in order to provide the Services. The Customer is the controller of that data and is responsible for having a lawful basis to collect it, for providing End Users with appropriate privacy notices, and for obtaining any consents required, including for the recording of calls where applicable.
5.How we use personal data
Where we act as a controller, we use personal data for the following purposes:
- Provide & operate the Services - to create and administer accounts, configure and run the AI Agent, and deliver the features you use.
- Authentication & billing - to verify identity, secure access to accounts, process payments and manage subscriptions.
- Support - to respond to your enquiries, troubleshoot issues and provide customer service.
- Security & fraud prevention - to protect the Services, detect and prevent fraud, abuse and security incidents, and enforce our terms.
- Product improvement - to understand how the Services are used, monitor performance, and develop and improve features, including through aggregated and de-identified analytics.
- Communications - to send you service, security and administrative messages, and, where permitted, updates and marketing you can opt out of at any time.
Where we process End User personal data as a processor, we use it only to provide the Services to the relevant Customer and on that Customer's instructions.
6.Legal bases for processing
Where the GDPR, UK GDPR or similar laws apply, we rely on the following legal bases when we act as a controller:
- Contract - to provide the Services you have requested and to perform our agreement with you.
- Legitimate interests - to secure, operate, analyse and improve the Services, prevent fraud and abuse, and communicate with you, where our interests are not overridden by your rights.
- Consent - where we ask for it, for example for certain cookies or optional marketing communications; you may withdraw consent at any time.
- Legal obligation - to comply with laws that apply to us, such as tax, accounting and lawful requests from authorities.
7.AI & automated processing
Delivering the AI Agent involves processing content by artificial-intelligence and machine-learning models, including models provided by trusted third parties. When the AI Agent handles a call, message, enquiry or booking, the relevant content may be sent to and processed by these models to understand the interaction, generate a response and carry out the task the Customer has configured.
The Services are designed to support, not replace, human judgement, and Customers control how the AI Agent behaves and can review and oversee its activity. We do not use personal data contained in Customer Data to train models made available to other customers except in aggregated or de-identified form, or with permission. For more on how we approach responsible and safe use of AI, including human oversight, see our Responsible AI page.
9.International transfers
We and our service providers may process personal data in countries other than the one in which it was collected, including the United States. Where we transfer personal data across borders, we put appropriate safeguards in place as required by applicable law, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional technical and organisational measures where needed. You may contact us to request more information about these safeguards.
10.Data retention
We keep personal data for as long as needed to provide the Services, maintain your account, and fulfil the purposes described in this policy, and thereafter as required to comply with our legal obligations, resolve disputes and enforce our agreements. Retention periods vary depending on the type of data and the reason we hold it. Where we process Customer Data as a processor, we retain it in line with the Customer's instructions and our agreement with the Customer. When personal data is no longer needed, we delete it or anonymise it so it can no longer be associated with an individual.
11.Security
We use technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration and destruction, including encryption in transit, access controls and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work continually to protect your data. You can read more about our approach on our Security page.
12.Your rights
Depending on where you live and the applicable law, you may have some or all of the following rights over your personal data:
- Access - to obtain confirmation of, and a copy of, the personal data we hold about you.
- Correction - to have inaccurate or incomplete personal data corrected.
- Deletion - to request that we delete your personal data in certain circumstances.
- Objection - to object to certain processing, including direct marketing.
- Restriction - to ask us to restrict processing in certain circumstances.
- Portability - to receive certain personal data in a portable format, or to have it transmitted to another controller where technically feasible.
- Withdraw consent - to withdraw any consent you have given, without affecting processing carried out beforehand.
To exercise these rights where we act as controller, contact us at hello@syntra.ai. We may need to verify your identity before responding. If you are an End User, your personal data is usually processed by us on behalf of the Customer you interacted with, who is the controller; please direct your request to that Customer, and we will support them in responding. You also have the right to lodge a complaint with your local data protection authority.
14.Children
The Services are intended for business use and are not directed to children. We do not knowingly collect personal data directly from children under 16 (or under 18 where a higher age applies in your jurisdiction) through our website or account sign-up. If you believe a child has provided us with personal data in this way, please contact us at hello@syntra.ai and we will take appropriate steps to delete it. Where End User information routed through the Services relates to a minor, the relevant Customer is responsible, as controller, for the lawful basis and any consents required.
15.Third-party links & services
The Services may contain links to, or integrate with, third-party websites and services that we do not control. This policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy notices of any third-party website or service you use, including any you connect to the Services.
16.Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to the Services, our practices or applicable law. If we make material changes, we will provide reasonable notice, such as by posting the updated policy with a new "last updated" date or by notifying you through the Services. Your continued use of the Services after the changes take effect indicates your acceptance of the updated policy.
17.Contact us
If you have any questions about this Privacy Policy or how we handle personal data, please contact us:
SYNTRA LLC
8 The Green, Dover, Delaware 19901
hello@syntra.ai