1. Who we are
SynReach is the controller of personal data described in this policy, except where we process data on behalf of a customer (for example the content of their email sequences), in which case the customer is the controller and we act as their processor.
Contact: support@synitix.com. [Company legal name, registered address and, if required, EU/UK representative and Data Protection Officer details — to be added.]
2. Data about business professionals
What we process
- Name, job title, seniority, department and employer
- Business email address and business or mobile phone number
- Company details (name, domain, industry, size, location)
- Public professional profile URL, headline, location and profile photo URL
We do not knowingly process special-category data (such as health, religion or political opinions) and we do not process personal, non-work contact details for marketing to consumers.
Where it comes from
- Licensed third-party data providers who supply B2B contact data and warrant that they collected it lawfully.
- Public professional profiles viewed by our users. When a customer clicks “Reveal” in our browser extension on a profile they are viewing, the extension sends the profile’s public fields (listed above) to us to look up matching contact details. The extension does not read other pages, messages or connections and does not automate any action on the user’s account.
- Verification signals, such as whether an email address accepts mail, and bounce notifications from emails sent through SynReach.
Why, and our legal basis
We make business contact details available to customers so they can reach relevant professionals about relevant business offers. Under the GDPR and UK GDPR we rely on legitimate interests (Art. 6(1)(f)) — ours and our customers’ interest in B2B communication — balanced against your rights. We have carried out a legitimate-interests assessment [to be finalised with counsel], limit the data to professional information, and make opting out simple and global.
Notice
Where we are required to notify you that we hold your data (GDPR Art. 14), we do so within a reasonable period and at the latest at the first communication. Customers sending email through SynReach must include an unsubscribe link, which we provide automatically.
3. Data about our customers
- Account data: name, work email, password hash, workspace and team membership.
- Billing data: plan, invoices and payment status. Payments are processed by Paddle, our merchant of record; we never see full card numbers.
- Usage data: reveals, credits, searches, sequences and feature usage, used to run, secure and improve the service.
- Connected accounts: mailbox credentials (encrypted) and CRM tokens you choose to connect, used only to send email and sync records on your behalf.
- Content: contacts, lists, templates and emails you create. We process these as your processor.
Legal bases: performance of our contract with you, legitimate interests (security, product improvement, fraud prevention) and legal obligations (tax, accounting). We use AI providers only to generate drafts you request; we do not allow them to train on your data.
4. Your rights
Depending on where you live, you can ask us to:
- Confirm whether we hold data about you and give you a copy (access)
- Correct inaccurate data (rectification)
- Delete your data (erasure) — the fastest route is our opt-out form
- Stop processing your data for prospecting (objection) — opt-outs are honoured for every customer, not just one
- Restrict processing, or receive your data in a portable format
- Under the CCPA/CPRA: know, delete and correct, and opt out of “sale” or “sharing”. We do not sell personal data for money; making business contact data available to customers may be considered a “sale” under California law, and you can opt out at any time.
Email support@synitix.com. We reply within 30 days (45 days under the CCPA) and may need to verify your identity for access requests. You can also complain to your local data protection authority.
5. Opting out
Submit your work email and/or profile URL at synreach.synitix.com/opt-out. We delete the contact details we hold for you and keep a minimal record (a hashed identifier) on a suppression list so that you are not re-added from another source and no customer can reveal or email you through SynReach. Each email sent through SynReach also carries a one-click unsubscribe link for that sender.
6. Retention
- Business contact data: refreshed or deleted on a rolling basis, and not kept longer than [24 months] after it was last verified.
- Customer account data: for the life of the account, then deleted within [90 days] of closure, except billing records kept as required by law (typically 7 years).
- Suppression records: kept indefinitely, because they exist to keep you opted out.
- Email tracking events (opens, clicks): [12 months].
7. Sub-processors
We use the following service providers. [Placeholder list — to be confirmed before launch.]
| Purpose | Provider | Location |
|---|---|---|
| Cloud hosting & serverless functions | Vercel Inc. | United States |
| Database hosting | MongoDB, Inc. (Atlas) | United States / EU |
| Payments (merchant of record) | Paddle.com Market Ltd | United Kingdom |
| AI email drafting | Anthropic, PBC | United States |
| Contact data enrichment | [Licensed data providers — to be listed] | [TBC] |
| Email verification | [Provider — to be confirmed] | [TBC] |
8. International transfers & security
Some providers are in the United States. Where data leaves the EEA or UK we rely on the EU Standard Contractual Clauses, the UK Addendum, or the EU–US Data Privacy Framework where the recipient is certified.
We encrypt data in transit (TLS) and at rest, encrypt stored mailbox credentials, restrict staff access on a need-to-know basis, and log access to production systems. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.
10. Changes & contact
We’ll post changes here and update the date above; for material changes we’ll notify customers by email. Questions: support@synitix.com.