Privacy Policy

This Privacy Policy describes how Syzygia ("Syzygia", "we", "us", or "our") collects, uses, and protects information in connection with the website syzygia.io and the Syzygia platform and related applications and services (together, the "Services"). Syzygia is a platform where companies and individuals deploy and manage AI agents — virtual employees that work inside your organization's tools and data.

By using the Services, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Services.

1. Information we collect

1.1 Information you provide directly

• Contact and inquiry data. When you submit our contact form we collect your name, work email, company, role, and area of interest, so that we can respond to your request.
• Beta / early-access applications. When you submit our early-access screening form we collect your name, email, occupation, and your answers to the screening questions, so that we can place you in a trial group and manage the beta program.
• Account data. When you create an account on Syzygia we collect the information needed to set up and secure your account, such as your name, email address, and organization.
• Content you submit to the platform. Messages, documents, reports, and other content you or your organization provide to agents so they can perform their work.
• Files you upload or store. Documents, spreadsheets, images, and other files you upload to your workspace's storage so agents can work with them. You are responsible for the files you upload — see Section 6 and our Terms of Service.

1.2 Information from Google Sign-In and Google services

Syzygia offers the option to sign in with your Google account and, if you choose, to connect Google services (such as Gmail, Google Calendar, or Google Drive) so that your agents can perform tasks on your behalf. When you use these options, we receive only the data covered by the permissions (OAuth scopes) you explicitly grant on the Google consent screen, which may include:

• Basic profile information — your name, email address, and profile picture — used to create and identify your account.
• Google service data you authorize — for example calendar events, email messages, or files — used solely to provide the specific functionality you request from your agents (e.g., scheduling a meeting, drafting a reply, retrieving a document).

You can revoke Syzygia's access to your Google account at any time from your Google Account security settings.

1.3 Information collected automatically

• Usage and device data. Only if you consent via our cookie banner, we use Google Analytics on syzygia.io to understand how visitors use the site (pages viewed, approximate location, browser and device type). See our Cookie Policy.
• Log data. Standard server logs (IP address, timestamps, request metadata) used for security, rate limiting, and troubleshooting.
• Platform activity data. On the Syzygia platform, records of agent runs, tasks, and system events (who ran what, when, and with which outcome) used to operate the platform, meter usage against your plan, provide audit trails, and keep your account secure.

2. How we use information — and our legal bases

• To provide, operate, maintain, and secure the Services.
• To perform the specific tasks you ask agents to carry out on your behalf.
• To manage the beta program, including screening applications and scheduling trial groups.
• To respond to inquiries and provide customer support.
• To send service communications, such as replies to your contact requests and delivery of agent outputs to the email and WhatsApp recipients you configure.
• To meter usage, enforce plan limits, and bill subscriptions.
• To monitor performance, prevent abuse, and improve the Services.
• To comply with legal obligations.

Where the EU/UK General Data Protection Regulation (GDPR) applies, we process personal data on the following legal bases: performance of a contract (providing the Services you or your organization signed up for), consent (analytics cookies, connecting your Google account, and any optional features you enable — you may withdraw consent at any time), legitimate interests (securing and improving the Services, responding to inquiries), and legal obligation (where retention or disclosure is required by law).

We do not sell your personal information, and we do not use your data — or your organization's data — to train foundation or generalized AI models.

3. AI processing — how agents handle your data

The core of the Services is the execution of tasks by AI agents. So that you know exactly what that means for your data:

• Purpose-bound processing. Content you provide to an agent (messages, files, connected-service data) is processed only to complete the task you requested and to produce the outputs you asked for.
• Model providers as processors. To run agents we send the content required for a given task to AI model providers (e.g., Anthropic, OpenAI) under commercial API terms that prohibit them from training their models on your data.
• No training on your data. Neither we nor our model providers use your content to train, develop, or improve foundation or generalized AI models.
• Human oversight. AI outputs can contain errors. The Services are designed so that you review and remain responsible for decisions based on agent outputs; agents do not make legally significant automated decisions about you without human involvement.
• Memory. Agents may store working context (preferences, decisions, task history) inside your workspace so they can work effectively over time. This memory belongs to your workspace, is not shared across customers, and is deleted with your account.

4. How we share information

We share information only with service providers that help us operate the Services, under agreements that limit their use of your data to providing those services to us:

• Hosting and infrastructure (e.g., Vercel and our cloud storage providers) — to host the website, platform, and the files you store.
• Email delivery (e.g., Resend) — to send and receive contact-form, beta, and service emails.
• Messaging delivery — to deliver agent outputs to the WhatsApp recipients you configure, via WhatsApp Business platform providers. WhatsApp is operated by Meta and subject to its own terms and privacy policy.
• AI model providers (e.g., Anthropic, OpenAI) — to process the specific content required to complete an agent task. We use commercial API terms under which providers do not train their models on your data.
• Analytics (Google Analytics) — only with your consent, as described in our Cookie Policy.

We may also disclose information if required by law, to protect the rights, safety, or property of Syzygia or others, to enforce our Terms of Service (including investigating unlawful or infringing content), or in connection with a merger, acquisition, or asset sale (with notice to you).

5. Cookies

We keep cookies to a minimum: one strictly necessary local-storage item for your consent choice, and optional Google Analytics cookies that are set only if you accept. syzygia.io does not set any advertising or cross-site tracking cookies. Full details — including every cookie we use, how long it lasts, and how to withdraw consent — are in our dedicated Cookie Policy. You can change your choice at any time via the "Cookie settings" link in the footer of any page.

6. Files you upload and store

Syzygia plans include workspace storage so agents can work with your documents. For files you upload:

• Your files remain yours. We claim no ownership over them and access them only to provide the Services (for example, when an agent you instructed reads a document).
• Access is restricted. Files live in your workspace, protected by role-based access controls and permissioned folders that you manage.
• We do not pre-screen files. We are not obligated to review the content of your files, and we act as a hosting intermediary for them. You are solely responsible for what you upload — including having the legal right to upload it. Uploading unlawful or copyright-infringing (pirated) material is prohibited by our Terms of Service, and we may remove such material and suspend accounts when we become aware of it, including in response to valid takedown notices.
• Deletion. Files you delete are removed from your active workspace and purged from backups in the ordinary course (typically within 30–90 days), unless we must retain them to comply with law or to investigate abuse.

7. Data retention and deletion

• We retain personal information only as long as needed for the purposes described in this policy, or as required by law.
• Google user data obtained through connected services is processed to complete the task at hand and retained only as long as necessary to provide the feature you requested.
• Beta screening data is kept for the duration of the beta program and for a reasonable period afterwards, then deleted or anonymized.
• You may request access to, correction of, or deletion of your personal data at any time by emailing contact@syzygia.io. We will respond within a reasonable timeframe and in accordance with applicable law.
• Revoking Google access (via your Google Account settings) immediately stops any further collection of Google user data.

8. Security and compliance

We take the protection of your data seriously and maintain a security program with industry-standard safeguards, including:

• Encryption in transit (TLS/HTTPS) and encryption at rest for stored data.
• Role-based access controls, permissioned folders, and audit trails within the platform.
• Isolated customer environments and the principle of least privilege for agent access to connected services.
• Internal access on a need-to-know basis, with logging of administrative access.
• Vendor review of the subprocessors listed in Section 4.
• An incident-response process. If a personal-data breach affects you, we will notify you and the competent authorities where required by law (including within the timelines of the GDPR).

Our controls are designed with recognized frameworks in mind, including the SOC 1 and SOC 2 Trust Services Criteria; formal third-party examinations are on our compliance roadmap as the platform matures, and we will update this page as certifications are obtained. No method of transmission or storage is 100% secure, but we work continuously to protect your information.

9. International transfers

Our service providers may process data in countries other than your own. Where required, we rely on appropriate safeguards (such as the European Commission's standard contractual clauses) for such transfers.

10. Children's privacy

The Services are intended for business and professional use and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

11. Your rights

Depending on your jurisdiction (including under the GDPR if you are in the EU/EEA or UK), you have the right to:

• Access the personal data we hold about you and receive a copy (data portability).
• Correct inaccurate data and complete incomplete data.
• Request deletion of your data ("right to be forgotten").
• Restrict or object to processing, including processing based on legitimate interests.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (e.g., via the "Cookie settings" link or your Google Account permissions).
• Lodge a complaint with your local data protection supervisory authority.

If you are a resident of California or another US state with a comprehensive privacy law, you have equivalent rights to know, access, correct, and delete your personal information, and the right not to be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of under those laws.

To exercise any of these rights, email contact@syzygia.io. We will respond within one month, as required by the GDPR (or the timeline required by your local law).

12. Beta program

While the Services are in beta, we additionally collect your feedback, bug reports, and usage observations to improve the product. Feedback is used in anonymized or aggregated form wherever possible. Beta features may change or be discontinued; if we end the beta or your participation, you can request export or deletion of your data as described in Section 7.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. Material changes will be communicated to registered users by email or through the platform.

14. Contact us

Syzygia is the data controller for personal data processed as described in this policy. If you have questions about this Privacy Policy or our data practices, contact us at:

Syzygia
Email: contact@syzygia.io
Website: https://syzygia.io