Data Processing Agreement (DPA)

This data processing agreement ("DPA") is entered into between Syniaps ("the Processor"), publisher of the Syniaps service ("the Service"), and the customer holding an account ("the Customer", acting as "Controller"). It governs, in accordance with Article 28 of the General Data Protection Regulation (GDPR), the processing of the personal data that the Customer entrusts to the Service. It forms an integral part of the Terms of Use and prevails over them in all matters relating to the protection of personal data.

A PDF version of this agreement, intended for customers wishing a counter-signature, is available here: download the DPA (PDF). The online text and the PDF of the same version are identical.

The Customer determines the purposes and means of the processing of the personal data it imports, synchronizes or enters into the Service, or has the Service obtain: it is the Controller. Syniaps processes this data exclusively to provide the Service and on the Customer's documented instructions; the use of the Service's features (import, synchronization, requests to the AI agents, automations, use of Syniaps Credits) constitutes those instructions. Syniaps informs the Customer if an instruction appears to it to infringe the GDPR.

For the data of its own operation (accounts, billing, technical logs, security), Syniaps acts as controller, under the conditions described in the Privacy Policy.

• Nature and purpose: hosting, storage, indexing, analysis and restitution of the Customer's content by artificial intelligence agents, for the Customer's sole needs; synchronization with the cloud services the Customer connects; execution of the automations the Customer configures.
• Categories of data: identification and contact data (users, business contacts), content of documents and messages imported or synchronized by the Customer, history of conversations with the AI agents, and any personal data the Customer chooses to entrust to the Service.
• Data subjects: the Customer's users, its employees, customers, prospects, suppliers and more generally any person whose data appears in the content entrusted.
• Duration: for the entire term of the contract. Data is kept as long as the Customer's account is active, then handled as described in Article 10.

When the Customer uses Syniaps Credits (section 4 bis of the Terms of Use), the processing also includes obtaining, on its instructions, data publicly available on the web and professional contact details, from partners chosen by Syniaps. Publicly available data may include personal data (for example the name of the author of a public review). The contact search relies on the professional identification details the Customer provides (name, position, company, public professional profile) and returns professional contact details (professional email address and phone number) relating to its prospects, customers and business contacts. The results are saved in the Customer's space and are subject to the same rules as its other content.

Syniaps Credits also include, on the Customer's instructions: obtaining public data on French companies, including the identity of their officers, and search-ranking data; the transcription of audio recordings; reading texts aloud in a synthetic voice, creating music from prompts and voice cloning from voice recordings provided with the consent of the person concerned; the creation of images and videos from the instructions and images provided; and the sending of postal letters and text messages. Only the data the task requires is sent to the partner concerned (for example the document to post, the recording to transcribe, the text to read, the music prompt, the voice recordings to clone, or the name, postal address or mobile number of the recipients of a send); it may relate to the Customer's customers, prospects, business contacts and send recipients, and to the people whose voice or image appears in the content it provides. A send only leaves after the Customer's explicit approval, once, with the approved content. The results (transcripts, audio files, music, images, videos, proofs of sending) are saved in the Customer's space and are subject to the same rules as its other content. The digital copy of a cloned voice is kept by Eleven Labs, not in the Customer's space, until it is deleted by the person concerned or the account is deleted.

The Service is not designed to host health data within the meaning of the French regulations on the hosting of health data (HDS): the Customer undertakes not to entrust such data to it.

Syniaps warrants that the persons authorized to process the Customer's data are bound by an obligation of confidentiality. Access to the Customer's data by Syniaps staff is limited to what is strictly necessary for operations, security and support, and, for content, only takes place with the Customer's consent as part of a support request it initiates, except where required by law or by a security investigation.

Syniaps implements in particular the following technical and organizational measures:

• encryption of exchanges in transit (TLS);
• a dedicated server per customer company, hosted in France: one customer's data shares no machine with another's; within the company, each user works in an environment isolated at system level;
• strong authentication mandatory for all users;
• encryption at rest of the credentials and secrets entrusted by the Customer (site passwords, access tokens, API keys, session cookies), stored in restricted-access files on servers that are not publicly exposed, never in a database, with the decryption key kept separately from those files;
• logging of sensitive actions;
• daily encrypted backups kept off the server, in France (with OVHcloud): data is encrypted before being sent and the decryption key is never stored with the backups;
• principle of least privilege for the internal components of the Service.

All of the Customer's data and its backups are hosted in France.

The Customer gives Syniaps general authorization to use sub-processors for specific functions of the Service. The up-to-date list appears in the "Processors and transfers" section of the Privacy Policy; as of this version, they are Anthropic (AI models, default provider), OpenAI (real-time voice conversation, including phone calls handled by Syniaps; transcription of audio recordings, for Syniaps Credits; ChatGPT models only if the Customer connects a ChatGPT account), Google (Gemini models only if the Customer connects a Google account), any other AI model provider the Customer chooses to connect, Mistral AI (optional OCR; Syniaps AI processed in Europe, when the Customer makes this choice), Staan (European Perspective SAS, France: web search for the AI agents and the voice, as the main engine, within the included daily limit and, beyond it, for Syniaps Credits, and as the only engine when the Customer chooses the Syniaps AI processed in Europe; hosting in Europe, at OVHcloud; only the text of the search is sent; Staan states that it has a fallback outside Europe, activated only if necessary, which Syniaps has asked it to disable for its account), Brave (Brave Software, Inc., United States: web search for the AI agents and the voice, as a fallback when Staan does not respond and never when the Customer chooses the Syniaps AI processed in Europe, within the included daily limit and, beyond it, for Syniaps Credits), Apify (Apify Technologies s.r.o., Czech Republic: extraction of data publicly available on the web, for Syniaps Credits), FullEnrich (FullEnrich Corp, United States: search for professional contact details, for Syniaps Credits), Pappers (Pappers SAS, France: public data on French companies, for Syniaps Credits), DataForSEO (DataForSEO OÜ, Estonia: search-ranking data, for Syniaps Credits), Merci Facteur (BOURDET SARL, France: printing and sending of postal letters, for Syniaps Credits), Brevo (Sendinblue SAS, France: sending of text messages, for Syniaps Credits), Higgsfield (Higgsfield Inc., United States: creation of images and videos, including advertising with an avatar, for Syniaps Credits; for advertising with an avatar, only the prompt and the product image are sent to it), fal.ai (Features & Labels, Inc., San Francisco, United States: creation of images and videos, standard synthetic voice and music, the last two through Google's Gemini and Lyria models, for Syniaps Credits; only the prompt, any input image and the text to be read are sent to it; for voice and music, Syniaps asks it not to store the request and to delete the file produced after one hour), Runware (Runware Ltd, Dns House, 382 Kenton Road, Harrow, Greater London HA3 8DP, United Kingdom: creation of images and videos, for Syniaps Credits; only the prompt and any input image are sent to it), OpenRouter (OpenRouter, Inc., New York, United States: creation of images and videos, for Syniaps Credits; only the prompt and any input image are sent to it; processing of requests by the Syniaps AI, when the Customer uses it, without these requests being used to train models and only by the model hosts selected by Syniaps, bound to zero data retention, which may be established outside the European Union; when the Customer has switched off the included web search, OpenRouter may also entrust a web search to Exa (United States), which only receives the text of the search), Eleven Labs (Eleven Labs Inc., 169 Madison Avenue #2484, New York, NY 10016, United States: synthetic voice, music and voice cloning, for Syniaps Credits; only the texts to read, the music prompts and, for a cloning, the voice recordings of the person concerned are sent to it), Kie.ai (NEXUSAI SERVICES LLC, 118 Krameria St, Denver, CO 80220, United States: creation of music and songs through the Suno model, for Syniaps Credits, only when this service is enabled for the Customer's workspace; only the prompt, the title and the lyrics are sent to it, and the files created remain there for 14 days), Upload-Post (TONVI TECH SL, Spain: publication on the social networks connected by the Customer; some AI features of this service go through Google in the United States), IPRoyal (IPRoyal Services FZE LLC, United Arab Emirates: residential IP addresses for some site connections; encrypted exchanges remain encrypted, only the address of the sites visited is visible to it), Stripe (payment), Resend (transactional emails), Cloudflare (delivery and network access control), OVHcloud (hosting of encrypted backups and telephone lines for the calls handled by Syniaps, in France) and the hosting provider of the Service's servers (in France). An alternative AI model provider (OpenAI, Google or any other provider of its choice) only intervenes on the Customer's explicit decision, who connects it themselves after being informed and consenting in the interface: it is then a sub-processor chosen by the Customer, whose processing terms apply, and the Customer undertakes, for an individual Google account, to turn off the use of its exchanges for the improvement of Google's products and models. The Syniaps Credits partners only intervene when the Customer uses a capability that relies on them; when the Customer connects its own account with one of them to the Service, that account is used first and is governed by the terms the Customer has accepted with that partner. Syniaps imposes on each sub-processor it chooses obligations equivalent to those of this agreement and remains fully liable to the Customer for their performance. By way of exception, at the date of this version, no sub-processing agreement has been signed with Kie.ai: only its public terms apply. The Customer therefore does not include any personal data in a music request entrusted to this service.

Syniaps informs the Customer of any addition or replacement of a sub-processor (update of the list and, for substantial changes, email to the administrators). The Customer may object on legitimate grounds within 30 days of being informed; failing agreement on an alternative solution, it may terminate the Service under the conditions of the Terms of Use.

The Customer's data and its backups are hosted in France. Some sub-processors may process data outside the European Union (notably in the United States, for processing by the AI model and phone calls, payment, the sending of emails, the extraction of data from the web, the search for professional contact details, web search or the creation of images and videos; for the routing of some text messages to telephone operators and for synthetic voice, music creation and voice cloning (voice recordings); and, for any other AI provider the Customer connects, in the country where it is established); these transfers are governed by the mechanisms provided for in Chapter V of the GDPR: an adequacy decision (including the "Data Privacy Framework") or the European Commission's standard contractual clauses. The United Kingdom, where Runware processes data for the creation of images and videos, benefits from an adequacy decision of the European Commission. For an alternative AI model provider it connects itself, the Customer ensures, as data controller, that it has an appropriate transfer mechanism (article 6 above). The United Arab Emirates, where IPRoyal is established, do not benefit from an adequacy decision: only connection data transits there, the content of encrypted exchanges remaining inaccessible to it. For Kie.ai, none of these mechanisms is in place at the date of this version (article 6 above).

Taking into account the nature of the processing, Syniaps assists the Customer, through appropriate technical and organizational measures, in responding to requests to exercise the rights of data subjects (access, rectification, erasure, portability, objection, restriction). Syniaps forwards to the Customer without delay any request that a data subject may address to it directly concerning the Customer's data. Syniaps also assists the Customer, insofar as reasonable, with its obligations under Articles 32 to 36 of the GDPR (security, breach notification, impact assessments).

Syniaps notifies the Customer of any personal data breach affecting its data without undue delay after becoming aware of it, at the email address of the workspace administrators. The notification describes, to the extent of the information available, the nature of the breach, the categories and approximate volume of data and data subjects concerned, the likely consequences and the measures taken or proposed.

At the end of the contract (termination, non-conversion of the trial or end of the subscription for non-payment), access to the Service is cut off at the end of the current period, then all of the Customer's data is deleted from the Service within 7 days. An encrypted copy is kept for six months to allow a return to the Service, then erased. A Customer wishing to have its data returned requests it before the end of the contract, within the scope and under the terms (request period, billed service) set out in section 5 bis of the Terms of Use; while a request is pending, deletion is postponed until the archive has been delivered and its download link has expired. Synchronized documents in any case remain present in the Customer's cloud services, as the end of the contract deletes nothing there. The Customer may request early deletion at any time. Syniaps may keep beyond that only the data whose retention is required by law (billing in particular), for the applicable statutory period. The copies held in encrypted backups expire on their own by rotation within a maximum of six months after this deletion; they are not used for any other purpose.

Syniaps makes available to the Customer the information necessary to demonstrate compliance with this agreement, first and foremost this documentation and the Privacy Policy. The Customer may, at most once per 12-month period and subject to 30 days' written notice, conduct or have conducted an audit limited to the scope of this agreement, during business hours, without access to other customers' data and without disrupting the Service; each party bears its own costs.

This agreement is accepted online when applying to sign up for the Service (checkbox accepting the Terms of Use and the DPA); the date and version accepted are recorded and constitute evidence between the parties. Customers who wish may request a counter-signature of the PDF version at [email protected].

The version number and the date appear at the top of the page. In the event of a substantial change, workspace administrators are notified by email and previous versions remain available on request. Version 1.1 of 9 August 2026 reproduces version 1.0 of 8 July 2026 identically, with the current name of the service (Syniaps). Version 1.2 of 27 August 2026 adds the alternative artificial intelligence providers the Client may choose to connect (section 6) and clarifies the resulting transfer regime (section 7). Version 1.6 of 2 October 2026 clarifies the return of data at the end of the contract and the postponement of its deletion while a request is pending (section 10). Version 1.7 of 15 October 2026 adds Syniaps Credits: the description of the corresponding processing (sections 2 and 3), the partners Apify and FullEnrich among the sub-processors (section 6) and the transfers that may result from them (section 7). Version 1.8 of 17 October 2026 extends Syniaps Credits (section 3): nine partners join the sub-processors, Pappers, DataForSEO, Bouncer, Merci Facteur, Brevo, DeepL, Gladia, Higgsfield and Google Cloud (section 6), with the transfers that may result from them (section 7), and specifies that OpenAI also transcribes audio recordings within the included share (section 6). Version 1.9 of 18 October 2026 adds Brave (web search, included within a daily limit and, beyond it, for Syniaps Credits) among the sub-processors (section 6), with the transfer that may result from it (section 7). Version 1.10 of 21 October 2026 adds fal.ai (Features & Labels, Inc.: creation of images and videos, for Syniaps Credits) among the sub-processors (section 6), with the transfer that may result from it (section 7). Version 1.11 of 21 October 2026 removes Bouncer, Merci Facteur, DeepL and Gladia from the sub-processors, along with email address verification, translation and the sending of postal letters from Syniaps Credits (sections 3 and 6), and entrusts OpenAI with the transcription of audio recordings beyond the included share, for Syniaps Credits (section 6). Version 1.12 of 21 October 2026 specifies that synthetic voice goes through Google's Gemini API (Gemini speech synthesis), with Cloud Text-to-Speech as a fallback, with the same entity, Google Cloud France SARL (section 6), and that Google keeps this data only temporarily, to detect and prevent abuse, without ever using it to improve its products, with possible temporary storage outside the European Union under the safeguards of its data processing addenda (sections 6 and 7). Version 1.13 of 22 October 2026 brings Merci Facteur (BOURDET SARL, France: printing and sending of postal letters, for Syniaps Credits) back among the sub-processors, together with the sending of postal letters in Syniaps Credits (sections 3 and 6). Version 1.14 of 23 October 2026 adds Eleven Labs (Eleven Labs Inc., United States: synthetic voice, music and voice cloning, for Syniaps Credits) among the sub-processors (section 6), with the transfer to the United States that may result (section 7: synthetic voice, music creation and voice cloning), together with music creation and voice cloning in Syniaps Credits (section 3). Version 1.15 of 24 October 2026 adds Runware (Runware Ltd, United Kingdom: creation of images and videos, for Syniaps Credits) and OpenRouter (OpenRouter, Inc., United States: creation of images and videos, for Syniaps Credits) among the sub-processors (section 6), with the transfer to the United Kingdom and the United States that may result (section 7), adds music creation at Google (section 6) and specifies that Higgsfield also serves advertising with an avatar (section 6). Version 1.16 of 31 October 2026 entrusts fal.ai with standard synthetic voice and music, through Google's Gemini and Lyria models (section 6), and removes Google Cloud (Google Cloud France SARL) from the sub-processors. Version 1.17 of 31 October 2026 adds Kie.ai (NEXUSAI SERVICES LLC) for the creation of music and songs through the Suno model, only when this service is enabled for the Customer's workspace, and specifies that no sub-processing agreement or transfer mechanism is in place with it at that date (sections 6 and 7). Version 1.18 of 2 November 2026 entrusts OpenAI with the transcription of audio recordings for Syniaps Credits only, with no included share (section 6). Version 1.19 of 3 November 2026 names the sub-processors of the Syniaps AI: OpenRouter, with model hosts bound to zero data retention, and, when the Customer chooses the AI processed in Europe, Mistral AI (section 6). Version 1.20 of 6 November 2026 adds Exa, to which OpenRouter may entrust a web search of the Syniaps AI when the Customer has switched off the included web search, and Staan, a search engine hosted in Europe, now tried before Brave and the only search engine when the Customer chooses the Syniaps AI processed in Europe; Brave becomes the fallback (section 6). Version 1.21 of 6 November 2026 adds Upload-Post (TONVI TECH SL, Spain: publication on social networks) and IPRoyal (IPRoyal Services FZE LLC, United Arab Emirates: residential IP addresses for some site connections) among the sub-processors (section 6), with the transfer to the United Arab Emirates that may result (section 7), and specifies that the phone calls handled by Syniaps go through OpenAI and OVHcloud lines.