Privacy Policy

Syniaps ("the Service") is an artificial intelligence platform for businesses, published by Syniaps (website: www.syniaps.fr). Syniaps is the controller of the data described in this policy. For any question: [email protected].

This policy covers the Syniaps service. The agency's showcase website has its own privacy policy.

As part of the service, we process:

• Account data: name, professional email address, role in the workspace, authentication settings (strong authentication is mandatory).
• Content of your workspace: the documents you import or choose to synchronize from your cloud services, as well as the knowledge base the Service builds from these documents for your company only.
• Conversations with the AI agents: your requests and their answers, kept in your history.
• Billing data: handled by our payment provider Stripe; we do not store any card numbers.
• Technical logs: events necessary for the security and proper operation of the service (audit of sensitive actions, errors, storage usage measurements).
• Syniaps Credits data: balance, top-ups and their invoices, history of expenses (type of action, user who initiated it, mission if any, amount), company settings (automatic top-up, per-user limits, types of action always allowed). This data is used for the deduction, billing and security (detection of abnormal consumption).

You can connect third-party services to the Service via the OAuth protocol, with your explicit consent for each connection: Google Drive and Gmail, Microsoft OneDrive/SharePoint and Outlook, Dropbox. Each connection serves only the features you enable:

• Storage (Drive, OneDrive, Dropbox): synchronize the folders you select to your workspace, and send back to it the files added or updated in the Service. The Service never deletes files in your cloud.
• Email (Gmail, Outlook): read your messages to prepare the summaries you request, and send messages on your behalf only on your instruction.

The credentials and tokens you entrust to the Service (site passwords, access tokens, API keys, session cookies) are encrypted at rest on our servers, in restricted-access files, never in a database. They are never displayed back to you and are used solely to open a connection on your behalf when you ask the Service to act. You can revoke a connection at any time from the Connections page of the Service or from the security settings of the provider concerned; we then also revoke the token with the provider where the provider allows it.

Syniaps' use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. In particular:

• Google data (Drive files, Gmail messages) is used only to provide the visible features you have enabled: synchronization of the folders you choose, summaries and email actions you request;
• it is never sold and is never used for advertising purposes;
• no human reads it, except with your explicit consent, where necessary for security purposes (investigating abuse), to comply with the law, or as part of a support request you initiate;
• it is never used to create, train or improve generalized artificial intelligence models, neither by us nor by our providers: it is not transmitted to any third-party AI service that would use it to train its models.

Explicit statement (in the language of the original policy): "The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements."

The requests you send to the AI agents, as well as the documents needed to answer them, are processed by the AI model provider connected to your account. By default this is Anthropic: via its API, under its commercial terms, your data is not used to train its models; via a personal Claude Pro or Max subscription, Anthropic may use it while the account’s “Help improve Claude” setting is on, a setting we ask you to turn off before connecting. If your company enables the advanced OCR option, the transcription of scanned documents is performed by Mistral AI, via its API, under the same conditions. If you choose to connect an alternative provider (OpenAI, Google or any other provider of your choice), your requests are processed by that provider under its own terms, which the interface reminds you of when you connect and which you accept explicitly: a business account generally excludes training on your data; an individual account may, depending on the provider, allow the use of your exchanges to improve its products and models unless you turn that off in that account's settings, which we ask you to do before connecting (the interface shows you where); some providers offer no such setting, and the refusal is then requested in writing from their customer service. In all cases, no data from the Google Workspace APIs is transmitted to an AI service that would use it to create, train or improve its models.

When you use Syniaps Credits, the AI agents call on specialized partners, on your instructions: Apify, to extract data publicly available on the web (information about companies, prices, reviews, trends, content published by brands, map listings), and FullEnrich, to search for a person’s professional contact details (professional email address and phone number) based on their name, position and company. Only the information needed for the search is sent to them (for example the query and the location, or the name, position and company of the person searched for). The results are saved in your space, like your other content.

Syniaps Credits also make it possible, again on your instructions: to obtain public data on a French company, including the identity of its officers (Pappers), and search-ranking data on Google (DataForSEO); to keep searching the web beyond the included daily limit (Staan or Brave); to transcribe an audio recording (OpenAI); to read a text aloud in a synthetic voice (Eleven Labs, or a partner listed in the DPA for the standard voice), to create music from a prompt (Eleven Labs or that same partner) and to clone a voice from voice recordings provided with the written consent of the person concerned (Eleven Labs); to create images and videos from your instructions and the images you provide (several partners, the cheapest for each creation, listed in the DPA); and to send postal letters (Merci Facteur) or text messages (Brevo). Each partner receives only what the task requires: the search query, the document to post, the recording to transcribe, the text to read, the music prompt, the voice recordings to clone (with the written consent of the person concerned), the prompt and input image of a creation, or the name, postal address or mobile number of the recipients of a send. A letter or a text message only leaves after your explicit approval, once, with the content you approved (section 4 bis of the Terms of Use). The results (transcripts, audio files, music, images, videos, proofs of sending) are saved in your space, like your other content. The digital copy of a cloned voice is kept by Eleven Labs, not in your space, until it is deleted by the person concerned or the account is deleted.

For this data, your company is the data controller and Syniaps acts as a processor, under the terms of the DPA. On your instructions, a person’s contact details are searched for through the dedicated enrichment service or collected where they are published (websites, public profiles); the Service never collects data that people have chosen to hide. It is up to your company to inform the people whose contact details it obtains and to respect their rights, in particular their right to object to direct marketing (section 4 bis of the Terms of Use). Anyone who contacts us about this data has their request forwarded without delay to the company concerned.

If you connect your own account with one of these partners to the Service, it is used first, under the terms you have accepted with that partner.

The extension connects the user’s Chrome browser to the Syniaps application installed on their computer. At their request, it opens pages in a “Syniaps” tab group, reads their content and acts on them (clicks, typing), after an approval the user gives once in Chrome. It never reads the value of a password, a code, a card number or an IBAN. The content read is sent to the Syniaps application on the computer, then to the user’s Syniaps space, to do what they ask; it is handled like the other data in that space. When the user asks, site by site and after an approval shown on their computer, the extension copies their sign-in to that site to their Syniaps space, so that their scheduled tasks can use it; this sign-in is kept separately from the other data in the space and serves that sole purpose. The extension reads no other tab, collects no other data, and nothing is sold or transferred to third parties. The user can withdraw the approval for a site, or remove the extension entirely, at any time from Chrome.

On the syniaps.fr home page, the AI Diagnostic asks you a few questions about your business. To prepare your diagnostic, Syniaps reads your company’s public information (its website, business directories) and your public LinkedIn profile, if you have one; it reads nothing else about you. These readings go through our provider Apify (section 6). Your answers and this information are processed by Syniaps AI. If you enter your email address, it is used to send you your diagnostic. If you then sign up with the same address, your diagnostic is passed on to your Syniaps space to prepare your arrival. Without signing up, this data is kept for 12 months, then deleted, and what comes from your LinkedIn profile is deleted after 30 days; your IP address is never stored in clear. You can ask for it to be deleted at any time by writing to [email protected].

We use the following providers, each for a specific function:

• Anthropic (processing of requests by the AI model, default provider);
• OpenAI (real-time voice conversation when you use voice, including phone calls handled by Syniaps; transcription of the audio recordings you entrust to the agent, when you use Syniaps Credits; ChatGPT models only if you connect a ChatGPT account, at your choice);
• Google (Gemini models, only if you connect a Google account, at your choice);
• any other AI model provider you choose to connect (only on your decision; some are established outside the European Union);
• Mistral AI (OCR transcription, if the option is enabled; processing of requests by the Syniaps AI, processed in Europe, as a backup to Entrim, when the manager of your company makes this choice: the model is offered there by Mistral AI as a preview, and its terms allow it to use requests sent to a preview model to improve its models);
• Entrim (E3M d.o.o., Slovenia; processing in the European Union: requests enter in Frankfurt, at Amazon Web Services, and the AI runs in Slovenia: processing of requests by the Syniaps AI processed in Europe, when the manager of your company makes this choice; requests are neither stored nor used to train models);
• Staan (European Perspective SAS, France; processing in Europe, at OVHcloud in France: web search for the AI agents and the voice, as the main engine, within the included daily limit and, beyond it, when you use Syniaps Credits, and as the only engine when your company's manager has chosen the Syniaps AI processed in Europe; only the search query is sent; Staan states that it has a fallback outside Europe, activated only if necessary, which Syniaps has asked it to disable for its account);
• Brave (Brave Software, Inc., United States; processing in the United States, under the "Data Privacy Framework" or standard contractual clauses: web search for the AI agents and the voice, as a fallback when Staan does not respond and never when your company's manager has chosen the Syniaps AI processed in Europe, within the included daily limit and, beyond it, when you use Syniaps Credits; only the search query is sent, and Brave keeps it for at most 90 days);
• Apify (Apify Technologies s.r.o., Czech Republic; processing in the European Union and the United States: extraction of data publicly available on the web, when you use Syniaps Credits);
• FullEnrich (FullEnrich Corp, United States; processing may take place outside the European Union, notably in the United States: search for professional contact details, when you use Syniaps Credits);
• Pappers (Pappers SAS, France: public data on French companies, when you use Syniaps Credits);
• DataForSEO (DataForSEO OÜ, Estonia: Google search-ranking data, when you use Syniaps Credits);
• Merci Facteur (BOURDET SARL, France: printing and sending of postal letters, when you use Syniaps Credits);
• Brevo (Sendinblue SAS, France; the routing of some text messages to operators may pass outside the European Union, under standard contractual clauses or the "Data Privacy Framework": sending of text messages, when you use Syniaps Credits);
• Higgsfield (Higgsfield Inc., United States; processing in the United States, under the "Data Privacy Framework" or standard contractual clauses: creation of images and videos, including advertising with an avatar, when you use Syniaps Credits; for advertising with an avatar, only the prompt and the product image are sent);
• fal.ai (Features & Labels, Inc., San Francisco, United States; processing in the United States, under the "Data Privacy Framework" or standard contractual clauses: creation of images and videos, standard synthetic voice and music, the last two through Google's Gemini and Lyria models, when you use Syniaps Credits; only the prompt, any input image and the text to be read are sent; for voice and music, Syniaps asks it not to store the request and to delete the file produced after one hour);
• Runware (Runware Ltd, Dns House, 382 Kenton Road, Harrow, Greater London HA3 8DP, United Kingdom; processing in the United Kingdom, a country covered by an adequacy decision of the European Commission: creation of images and videos, when you use Syniaps Credits; only the prompt and any input image are sent);
• OpenRouter (OpenRouter, Inc., New York, United States; processing in the United States, under the "Data Privacy Framework" or standard contractual clauses: creation of images and videos, when you use Syniaps Credits; only the prompt and any input image are sent; processing of requests by the Syniaps AI, when your company uses it: Syniaps forbids it to use these requests to train models and only allows it to entrust them to the model hosts it has selected, bound to zero data retention, which may be established outside the European Union; when your company's manager has switched off the included web search, OpenRouter may also entrust a web search to Exa (United States), which only receives the text of the search);
• Eleven Labs (Eleven Labs Inc., 169 Madison Avenue #2484, New York, NY 10016, United States; processing in the United States, under the "Data Privacy Framework" or standard contractual clauses: synthetic voice, music creation and voice cloning, when you use Syniaps Credits; only the text to read, the music prompt and, for a cloning, the voice recordings of the person concerned are sent);
• Kie.ai (NEXUSAI SERVICES LLC, 118 Krameria St, Denver, CO 80220, United States; processing in the United States, with no sub-processing agreement or transfer mechanism to date: creation of music and songs through the Suno model, when you use Syniaps Credits and this service is enabled for your workspace; only the prompt, the title and the lyrics are sent, and the files created remain there for 14 days; do not include any personal data);
• Upload-Post (TONVI TECH SL, Málaga, Spain; hosting in Germany; some AI features of this service go through Google in the United States: publication on the social networks you connect and tracking of their results, when you publish from Syniaps; the content to be published and access to the connected social network accounts are transmitted to it);
• IPRoyal (IPRoyal Services FZE LLC, Ajman, United Arab Emirates: residential IP addresses through which some site connections pass, for sites that refuse the server's address; encrypted exchanges (HTTPS) remain encrypted, IPRoyal only sees the address of the sites visited);
• Stripe (payment and billing);
• Resend (sending of the service's transactional emails);
• Cloudflare (delivery, protection and network access control);
• OVHcloud (hosting of encrypted backups, on servers located in France; telephone lines for the calls handled by Syniaps, in France);
• our hosting provider, on private servers dedicated to the service, located in France.

Your data and its backups are hosted in France. Some providers may process data outside the European Union (notably in the United States, for processing by the AI model and phone calls, payment, the sending of emails, the extraction of data from the web, the search for professional contact details, web search or the creation of images and videos; for the routing of some text messages and for synthetic voice, music creation and voice cloning (voice recordings); and, for any other AI provider you connect, in the country where it is established); these transfers are governed by the mechanisms provided for by the GDPR (the "Data Privacy Framework" adequacy decision or standard contractual clauses) or, for an alternative AI provider you choose to connect, fall under your responsibility as data controller, as provided in the Terms of Use. The United Arab Emirates, where IPRoyal is established, do not benefit from an adequacy decision: only connection data transits there, the content of encrypted exchanges remaining inaccessible to it. This framework does not apply to Kie.ai to date, as stated above.

Your data is kept as long as your account is active. In the event of termination, access is cut off at the end of the paid period and the company's data is deleted from the platform 7 days later, or as soon as the account holder confirms their departure. An encrypted copy is kept for six months to allow a return, then erased. The return of the company’s data must be requested before the end of the subscription, under the conditions of section 5 bis of the Terms of Use; while a request for return is pending, deletion is postponed until the data has been delivered. Files removed by cloud synchronization are kept for 30 days in an internal recycle bin before permanent deletion. Encrypted backups, hosted in France, expire on their own by rotation within a maximum of six months after this deletion; their decryption key is never stored with them and they are only restored when genuinely needed. You can request early deletion of your account at any time. The Syniaps Credits history is kept as long as the account is active; top-up invoices are kept for the legal retention period.

To prevent the same customer from benefiting from the trial period more than once, we keep for 3 years non-reversible fingerprints of their SIREN number, email address, phone number and bank card.

Your data and its backups are hosted in France. Exchanges are encrypted in transit (TLS). Each customer has its own server, dedicated to that customer alone and hosted in France: no other customer is hosted on it. Within the company, each user works in an environment isolated at system level. The secrets you entrust to us (site passwords, access tokens, API keys, session cookies) are encrypted at rest, in restricted-access files on servers that are not publicly exposed, never in a database; the decryption key is kept separately from those files. Access to the service requires strong authentication. Sensitive actions are logged.

An encrypted backup of your data is made every night and kept off the server, in France, with a French hosting provider (OVHcloud). Backups are encrypted before being sent and the decryption key is never stored with them: a backup copy, even if stolen, remains unreadable.

To speed up the setup of connections to third-party sites, Syniaps shares anonymized technical connection recipes between its instances (address of the login page and form markers); they never contain any username, password, cookie or any data that could identify a customer or a user.

For the purposes of operating the service and improving its integration catalog, the domain name of the sites you connect and the name of the third-party services you plug in are also reported, with the account identity, to our internal supervision console; never your credentials, cookies or keys, nor any secret value.

In accordance with the GDPR, you have rights of access, rectification, erasure, portability, objection and restriction over your personal data. To exercise them, write to [email protected]. You may also lodge a complaint with the CNIL (www.cnil.fr).

We may update this policy to reflect changes in the service or in regulations. The date of the last update appears at the top of the page; in the event of a substantial change, workspace administrators are notified by email.