Legal
Privacy Policy
What we collect, why, who else can see it, how long we keep it, and how to get it deleted.
Last updated: 9 September 2026
Who this covers
This policy applies to SynapseOrch Cloud, our hosted service, and to synapseorch.com and its subdomains. “SynapseOrch”, “we” and “us” mean the operator of the service, the legal entity named on your invoice or, if you have none, the entity named in our Terms of Service. “You” means the person or organisation using it.
It does not apply to the open-source project. If you download SynapseOrch and run it on your own machine or your own servers, your data stays in your infrastructure and never reaches us. We collect nothing from a self-hosted installation: no telemetry, no phone-home, no licence check.
Two roles, and which one we are
- For your account data (who you are, how you pay, how you use the service) we are the controller: we decide why and how it is processed.
- For your workspace content (the workflows, prompts, documents, run logs and anything your workflows handle, including any personal data of your own customers) we are a processor: we process it only on your instructions, to run the service for you. You are the controller of that data, and responsible for having the right to put it in.
A Data Processing Addendum covering the processor role, including the Standard Contractual Clauses for international transfers, is available on request at info@synapseorch.com.
What we collect
Information you give us
- Account details: your name, email address, password (stored only as a hash), and the name of your workspace. If you sign in with Google, we receive your email address, name and profile picture from Google instead of a password.
- Workspace content: the workflows, agents, prompts, tools, connections, memory and documents you create or upload, including anything you put in a vault. This is your material; we process it to run the product and for no other purpose.
- Credentials you store: API keys and connection secrets you add so your workflows can reach third-party systems. These are encrypted before they are written down and decrypted only to make the call you asked for.
- Billing details: your billing name, address and tax information where required. We never see or store your card number. Payments are handled entirely by our payment provider.
- Anything you send us: support emails, bug reports, feedback, and messages your agents exchange with you on a messaging channel you connected.
Information we record as you use the service
- Execution and metering records: which workflows ran, when, for how long, which models they called, and how many tokens and credits they consumed. This is what your usage page and your invoice are built from.
- Run logs: the step-by-step record of a run, including the inputs and outputs of each step, so you can debug and replay it.
- Technical logs: IP address, browser and device type, timestamps, and error traces. We use these to keep the service up and to investigate abuse.
- Audit records: significant actions inside a workspace (who invited whom, who changed a setting, who deleted what), so an administrator can see what happened. On the Business plan, the workspace’s owners and admins can export them, with the email address and IP address of whoever acted.
- Website analytics: aggregate, anonymised traffic statistics for synapseorch.com. They do not identify you and are not shared with advertisers.
Why we process it, and on what basis
| Purpose | What it covers | Legal basis |
|---|---|---|
| Providing the service | Running your workflows, storing your work, showing you your results | Performance of a contract |
| Billing | Metering usage, charging your plan, issuing invoices, preventing abuse of credits | Performance of a contract; legal obligation |
| Security and reliability | Authentication, rate limiting, fraud and abuse detection, incident investigation | Legitimate interest |
| Support | Answering your questions and diagnosing problems you report | Performance of a contract |
| Required communication | Account verification, password resets, invitations, billing and security notices: transactional email you cannot opt out of while you hold an account | Performance of a contract |
| Product updates | Occasional email about new features. Every one has an unsubscribe link. | Consent, or legitimate interest for existing customers |
| Optional integrations | Google Workspace and messaging platforms you explicitly connect | Consent |
We make no decisions about you by purely automated means that have legal or similarly significant effects. Your workflows may make automated decisions about your own data; that is your design and your responsibility.
What we do not do
- We do not sell your data, and we do not share it for cross-context behavioural advertising. Not to advertisers, not to data brokers, not to anyone.
- We do not train models on your content. Neither do the providers we route managed-model inference to, whose terms prohibit using your prompts or outputs to train their models.
- We do not read your workspace content except when you ask us to look at something specific in support, or where we are compelled by law.
- We do not run advertising and there are no third-party advertising or tracking cookies on this site.
Google user data
SynapseOrch’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who else processes your data
We use a small number of sub-processors. Each is contractually bound to protect your data and to use it only to provide their service to us.
| Provider | What it does | Where |
|---|---|---|
| Amazon Web Services | Hosting, databases, file storage, email delivery | United States (us-east-1) |
| Amazon Bedrock | Model inference for managed models | United States |
| Dodo Payments | Payment processing, invoicing and tax handling | Per their terms |
| Optional sign-in, and Google Workspace access if you connect it | United States | |
| Vercel | Hosting for this website and our documentation | Global edge network |
This page is the list. If we add or replace a sub-processor that handles workspace content, we will update it and email workspace owners at least 30 days before the change takes effect, so you can object or export your data first.
If you configure a workflow to call a third-party service, your own model provider, an API, a webhook, an MCP server or a messaging platform, then whatever that workflow sends is governed by their privacy terms, not ours. You choose those connections, and they are not our sub-processors.
Where your data lives, and international transfers
SynapseOrch Cloud runs in the United States (AWS us-east-1). If you are outside the United States, using the service involves transferring your data there. For customers in the EEA, the United Kingdom and Switzerland, that transfer is covered by the Standard Contractual Clauses (and the UK Addendum) in the Data Processing Addendum, together with the safeguards described under “How we protect it”.
How long we keep it
| Data | Kept for |
|---|---|
| Workspace content, vault documents, memory | As long as your workspace exists, or until you delete the item |
| Run logs (step inputs and outputs) | 90 days, then pruned automatically. Usage totals for the run are kept with the billing records. |
| Technical and security logs | 90 days, longer only if they are part of an incident investigation |
| Audit records | As long as your workspace exists, then deleted with it |
| Metering and billing records | As long as tax and accounting rules require, typically seven years. These are usage totals and invoices, not your content. |
| After you delete your workspace or account | Content and logs are deleted within 30 days; backups roll off within a further 30 days; billing records are kept as above. |
How we protect it
- Encrypted in transit (TLS) and at rest.
- Stored secrets are individually encrypted with managed keys, so a database copy on its own does not yield your credentials.
- Each workspace is isolated at the database level, so one customer’s queries cannot reach another’s rows.
- Access to production is limited to the people who need it and is logged.
- Vulnerabilities can be reported privately; see our security page.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will tell affected workspace owners and any required regulator without undue delay, and within 72 hours of confirming it.
Your rights
Wherever you are, you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your account and the data in it;
- export your workspace content in a portable format;
- restrict or object to a particular use, or withdraw a consent you gave.
Email info@synapseorch.com and we will respond within 30 days. Most of this you can also do yourself from your account settings. We will never treat you differently for exercising a right.
If you are in the EEA, the UK or Switzerland
You also have the right to lodge a complaint with your local data protection authority. Where we process workspace content as your processor, requests from your own users about that content should go to you, and we will help you answer them.
If you are in California
You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined in the CCPA, and we honour Global Privacy Control signals. Requests go to the same address above.
Cookies
We use cookies that are strictly necessary: one to keep you signed in, and one to protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies, and we do not respond differently to a “Do Not Track” header because there is nothing to switch off.
Children
SynapseOrch Cloud is a business product and is not directed at children. You must be 18 or older to hold an account. We do not knowingly collect data from anyone under 18; if you believe a child has given us personal data, email us and we will delete it.
Changes to this policy
If we change this policy in a way that materially affects you, we will email account holders before it takes effect and update the date at the top of this page. Earlier versions are available on request.
Contact
SynapseOrch — info@synapseorch.com. Data protection enquiries can use the same address with “Privacy” in the subject.