This Privacy Policy explains what personal data Syntra collects, how we use and share it, and the choices and rights you have - both when we act as a controller for our website and direct customers, and when we act as a processor for the data our customers route through the Services.
1.About this policy & scope
This Privacy Policy explains how Syntra AI Ltd, a company registered in England and Wales (company number 17223665) with its registered office at 66 Paul Street, London EC2A 4NA, United Kingdom, and its affiliate SYNTRA LLC, a Delaware limited liability company of 8 The Green, Dover, Delaware 19901, United States (together "Syntra", "we", "us" or "our"), collect, use, share and protect personal data. It applies to our website, our platform and applications, and our AI-powered services (together, the "Services"), including the AI Agent that makes and answers calls, sends messages, takes bookings and handles enquiries on our customers' behalf.
Throughout this policy, "Customer" ("you" or "your") means the business or individual that registers for or uses the Services, and "End User" means a customer, client, patient, contact or other person who interacts with a Customer through the Services. This policy should be read together with our Terms of Service, our Cookie Policy and, where we act as a processor, our Data Processing Addendum.
2.Our role: controller vs processor
The way we handle personal data, and our responsibilities for it, depend on the context in which we process it. Syntra AI Ltd operates the Services and is the controller of the personal data described in this policy. Where you contract with SYNTRA LLC under our Terms, or it collects your payments, SYNTRA LLC is also a controller of your account and billing data.
- Where we are the controller - we determine the purposes and means of processing for personal data about our website visitors, our direct Customers and their account users, and people who contact us or express interest in Syntra. This policy governs that processing.
- Where we are a processor - where we process personal data contained in Customer Data on a Customer's behalf (for example, the call recordings, transcripts, messages, bookings and contact records generated when the AI Agent interacts with End Users), the Customer is the controller and decides why and how that data is processed. We act as processor under our Data Processing Addendum and process that data only on the Customer's documented instructions.
If you are an End User and want to understand how your personal data is used, please refer in the first instance to the privacy notice of the Customer you interacted with, as they are the controller of that data.
3.Information we collect
We collect the following categories of personal data, depending on how you use the Services:
- Account & profile data - the name, business name, email address, phone number, role and login credentials you provide when you create or manage an account, together with your settings and preferences.
- Billing data - the plan you select and billing details. Card and bank details are collected and processed directly by our payment processor; we receive limited information such as the last four digits, card type, billing country and transaction status, and do not store full card numbers ourselves.
- Usage, log & device data - information generated when you use the Services, such as IP address, browser and device type, operating system, pages and features accessed, referring URLs, timestamps and diagnostic or error data.
- Cookies & similar technologies - as described in our Cookie Policy, we and our partners use cookies and similar technologies to operate, secure and analyse the Services.
- Communications with us - the content of messages, support tickets, enquiries and other correspondence you send us, and records of your interactions with our team.
- Content processed through the Services - content you or your End Users provide to, or generate through, the Services, including call recordings, transcripts, messages (across SMS, email, WhatsApp and chat), booking details, prompts, scripts, knowledge and contact records. Where this content contains personal data of End Users, we process it as a processor on the Customer's behalf as described above.
4.End User information
When a Customer configures the AI Agent to communicate with its End Users, personal data about those End Users is routed through the Services. This may include names, contact details, the content and recordings of calls and messages, booking and appointment details, enquiry details and any other information an End User shares during an interaction.
We process End User personal data as a processor, on the relevant Customer's behalf and on its instructions, in order to provide the Services. The Customer is the controller of that data and is responsible for having a lawful basis to collect it, for providing End Users with appropriate privacy notices, and for obtaining any consents required, including for the recording of calls where applicable.
6.Connected Google services
Besides social accounts, a Customer can connect its own Google account to the Services. Each connection is made by the Customer signing in with Google and approving the access requested, and covers only the Customer's own data:
- Google Calendar - we list the Customer's calendars so it can choose which to sync, read the busy times on them so customers are never booked over existing events, and create, update and delete the events for the bookings made through Syntra. Event details are those the Customer chooses to include (such as the customer's name and the service).
- Google Meet - for online appointments we create a Google Meet link with the booking's calendar event and adjust that meeting's settings so the Customer's own staff can host it.
- Google Search Console - we read the performance data of the Customer's own verified websites (clicks, impressions, search queries, pages, countries and devices) to show it in the Customer's dashboard, and submit its sitemap.
- Google Business Profile - we read the Customer's business listing, its performance figures and its reviews, and publish the review replies and posts the Customer writes or approves.
Google user data and AI. Google Calendar and Google Meet data is never sent to any AI model. When a Customer asks for it, the text of a Google review is sent to our AI model providers to draft a reply, which the Customer reviews before anything is published, and reviews may be summarised, with contact details removed, into the recurring questions shown only to that Customer. Search Console data reaches an AI assistant only when the Customer connects its own assistant (such as Claude or ChatGPT) to Syntra and asks it to read that data. We only send this data to AI providers that do not train on it: OpenAI does not use API data to train its models, and requests we route through OpenRouter are restricted to providers that neither store nor train on them. Google user data is never used, by us or by them, to develop, improve or train generalised AI or machine-learning models.
Access tokens for these connections are stored encrypted and deleted when the Customer disconnects the service in Syntra or removes Syntra from its Google account's third-party connections. Our use of this data follows the Google API Services User Data Policy, including the Limited Use requirements, as set out in Connected social media accounts above.
7.How we use personal data
Where we act as a controller, we use personal data for the following purposes:
- Provide & operate the Services - to create and administer accounts, configure and run the AI Agent, and deliver the features you use.
- Authentication & billing - to verify identity, secure access to accounts, process payments and manage subscriptions.
- Support - to respond to your enquiries, troubleshoot issues and provide customer service.
- Security & fraud prevention - to protect the Services, detect and prevent fraud, abuse and security incidents, and enforce our terms.
- Product improvement - to understand how the Services are used, monitor performance, and develop and improve features, including through aggregated and de-identified analytics.
- Communications - to send you service, security and administrative messages, and, where permitted, updates and marketing you can opt out of at any time.
Where we process End User personal data as a processor, we use it only to provide the Services to the relevant Customer and on that Customer's instructions.
8.Legal bases for processing
Where the GDPR, UK GDPR or similar laws apply, we rely on the following legal bases when we act as a controller:
- Contract - to provide the Services you have requested and to perform our agreement with you.
- Legitimate interests - to secure, operate, analyse and improve the Services, prevent fraud and abuse, and communicate with you, where our interests are not overridden by your rights.
- Consent - where we ask for it, for example for certain cookies or optional marketing communications; you may withdraw consent at any time.
- Legal obligation - to comply with laws that apply to us, such as tax, accounting and lawful requests from authorities.
9.AI & automated processing
Delivering the AI Agent involves processing content by artificial-intelligence and machine-learning models, including models provided by trusted third parties. When the AI Agent handles a call, message, enquiry or booking, the relevant content may be sent to and processed by these models to understand the interaction, generate a response and carry out the task the Customer has configured.
The Services are designed to support, not replace, human judgement, and Customers control how the AI Agent behaves and can review and oversee its activity. We do not use personal data contained in Customer Data to train models made available to other customers except in aggregated or de-identified form, or with permission. For more on how we approach responsible and safe use of AI, including human oversight, see our Responsible AI page.
11.International transfers
We and our service providers may process personal data in countries other than the one in which it was collected, including the United States. Where we transfer personal data across borders, we put appropriate safeguards in place as required by applicable law, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional technical and organisational measures where needed. You may contact us to request more information about these safeguards.
12.Data retention
We keep personal data for as long as needed to provide the Services, maintain your account, and fulfil the purposes described in this policy, and thereafter as required to comply with our legal obligations, resolve disputes and enforce our agreements. Retention periods vary depending on the type of data and the reason we hold it. Where we process Customer Data as a processor, we retain it in line with the Customer's instructions and our agreement with the Customer. Access tokens for connected social accounts are deleted as soon as the account is disconnected, and we act on deletion requests as set out on our Data Deletion page. When personal data is no longer needed, we delete it or anonymise it so it can no longer be associated with an individual.
13.Security
We use technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration and destruction, including encryption in transit, access controls and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work continually to protect your data. You can read more about our approach on our Security page.
14.Your rights
Depending on where you live and the applicable law, you may have some or all of the following rights over your personal data:
- Access - to obtain confirmation of, and a copy of, the personal data we hold about you.
- Correction - to have inaccurate or incomplete personal data corrected.
- Deletion - to request that we delete your personal data in certain circumstances.
- Objection - to object to certain processing, including direct marketing.
- Restriction - to ask us to restrict processing in certain circumstances.
- Portability - to receive certain personal data in a portable format, or to have it transmitted to another controller where technically feasible.
- Withdraw consent - to withdraw any consent you have given, without affecting processing carried out beforehand.
To exercise these rights where we act as controller, contact us at hello@syntra.ai. For data from connected social accounts, our Data Deletion page explains the quickest ways to remove it. We may need to verify your identity before responding. If you are an End User, your personal data is usually processed by us on behalf of the Customer you interacted with, who is the controller; please direct your request to that Customer, and we will support them in responding. You also have the right to lodge a complaint with your local data protection authority.
16.Children
The Services are intended for business use and are not directed to children. We do not knowingly collect personal data directly from children under 16 (or under 18 where a higher age applies in your jurisdiction) through our website or account sign-up. If you believe a child has provided us with personal data in this way, please contact us at hello@syntra.ai and we will take appropriate steps to delete it. Where End User information routed through the Services relates to a minor, the relevant Customer is responsible, as controller, for the lawful basis and any consents required.
17.Third-party links & services
The Services may contain links to, or integrate with, third-party websites and services that we do not control. This policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy notices of any third-party website or service you use, including any you connect to the Services.
18.Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to the Services, our practices or applicable law. If we make material changes, we will provide reasonable notice, such as by posting the updated policy with a new "last updated" date or by notifying you through the Services. Your continued use of the Services after the changes take effect indicates your acceptance of the updated policy.
19.Contact us
If you have any questions about this Privacy Policy or how we handle personal data, please contact us:
Syntra AI Ltd
Company number 17223665
66 Paul Street, London EC2A 4NA, United Kingdom
SYNTRA LLC
8 The Green, Dover, Delaware 19901, United States
5.Connected social media accounts
Customers can connect their accounts on social platforms to publish posts, manage comments, messages and reviews, and see performance from within the Services. The platforms we support are Facebook Pages, Instagram professional accounts, Threads profiles, LinkedIn (personal profiles and Company Pages), YouTube channels, Google Business Profile locations, Pinterest boards, TikTok, X and Bluesky. A Customer connects an account by signing in with that platform and choosing what to allow. When they do, we receive and process:
We use this data only to provide these features to the Customer who connected the account and on their instructions: to publish and schedule posts, show and answer comments, messages and reviews, and report results. Where the Customer asks for an AI-drafted caption or reply, the relevant text is sent to our AI model providers only to produce that draft, and is not used by them or by us to train models. We do not sell this data, use it for advertising, share it with other customers, or use it to train AI models. People who comment on or message a Customer's account are End Users of that Customer, who is the controller of their data, as described in End User information.
Our use of data received from each platform also follows that platform's developer terms and policies, including Meta's Platform Terms, the LinkedIn API Terms of Use, Pinterest's Developer Guidelines and the TikTok Developer Terms of Service, and the X Developer Agreement. A Customer can disconnect an account at any time, which deletes its access token and the conversations we hold from it straight away. For all the ways to delete this data, including removing Syntra's access from the platform's own settings, see our Data Deletion page.
Google user data (Google Calendar, Google Meet, Search Console, Google Business Profile and YouTube). Syntra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described above; we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition; we do not use it for advertising; we do not use it to develop, improve or train generalised AI or machine-learning models; and no person reads it unless the Customer asks us to (for example for support), it is needed for security or legal reasons, or it has been aggregated and anonymised.
YouTube. Syntra uses YouTube API Services to upload videos to, and read comments and statistics from, the YouTube channels Customers connect. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke Syntra's access to your Google account at any time from your Google account's third-party connections page. Data we read from YouTube is refreshed or deleted regularly, and is deleted when the channel is disconnected or access is revoked.