Privacy Policy
This Privacy Policy explains how Syzygia ("we", "us") handles personal data on syzygia.io and the Syzygia platform (Hub, Marketplace and related applications — the "Services"). It is our notice under Articles 13 and 14 of the EU and UK GDPR. Section 2 explains when we decide about your data and when our customer does.
Contents: 1. Who we are · 2. Our role · 3. What we process, why, and on what legal basis · 4. Google user data · 5. AI agents, voice calls, agent email and WhatsApp · 6. Recipients · 7. International transfers · 8. Retention · 9. Your rights · 10. Security and breaches · 11. Cookies · 12. Files you upload · 13. Children · 14. US state privacy laws · 15. Changes
1. Who we are and how to contact us
The controller (except where Section 2 says we act as a processor) is Syzygia Technologies, Inc. ("Syzygia"), a Delaware corporation, 174 Main Street, Port Washington, NY 11050, United States. Privacy contact: info@syzygia.io.
Data protection contact: we have not appointed a Data Protection Officer, as the GDPR does not require one for our processing. Our privacy lead, the Chief Product Officer, handles privacy matters at info@syzygia.io.
EU representative (Art. 27 GDPR): Not appointed. Syzygia has no establishment in the EU and does not yet offer the Services to people in the EU; we will appoint a representative before we do.
2. Our role: controller or processor
- Controller. For website visitors, people who contact us, beta applicants, platform accounts, sign-in and security logs, acceptance records, billing and product feedback.
- Processor. For content customers put into the platform (chats and call transcripts, files, business data, agent memory, emails and WhatsApp messages handled by agents, data from connected services), on behalf of the customer, which is the controller (Art. 28 GDPR). If your data is in a customer's workspace, contact that organization first; if you contact us, we will pass your request on and help them answer it.
Our commitments as a processor are in our Data Processing Addendum (DPA), part of our Terms of Service.
3. What we process, why, and on what legal basis
Processing where Syzygia is the controller ("Art. 6(1)" refers to the GDPR):
| Activity and personal data | Purpose | Legal basis |
|---|---|---|
| Visiting syzygia.io: IP address, device data, pages requested | Deliver and secure the website, prevent abuse | Legitimate interests (Art. 6(1)(f)) |
| Website analytics (only if you accept): cookie identifiers, pages viewed, approximate location, device type | Understand and improve the website | Consent (Art. 6(1)(a)); withdraw any time in "Cookie settings" |
| Demo / contact form: name, work email, company, optional details and message | Reply to you and arrange the demo | Steps before a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Beta screening form: name, email, occupation, answers, score, availability | Select and organize beta testers | Steps before entering the beta (Art. 6(1)(b)) |
| Privacy requests: name, email, request details, correspondence | Handle and document your request | Legal obligation (Art. 6(1)(c)) |
| Platform accounts: name, email, organization, role, password hash or sign-in identity, preferences | Provide your account and the Services | Contract (Art. 6(1)(b)) or, if your employer holds it, legitimate interests (Art. 6(1)(f)) |
| Sign-in, security and audit logs: email, IP address, user agent, activity | Protect accounts and the platform, investigate incidents | Legitimate interests (Art. 6(1)(f)); security obligations (Art. 6(1)(c), Art. 32) |
| Service emails: address and content | Operate the Services | Contract (Art. 6(1)(b)) |
| Acceptance of the Terms, this policy and the DPA: version, time, IP address, user agent | Prove what was accepted, by whom and when | Legal obligation (Art. 6(1)(c), Art. 5(2)); legitimate interests (Art. 6(1)(f)) |
| Usage, Syzygia Credits and billing: executions and credits used, purchases, billing contact, invoices (card details go only to our payment processor) | Charge, invoice, keep accounts | Contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c)) |
| Product feedback: feedback, bug reports, email | Fix problems and improve the Services | Legitimate interests (Art. 6(1)(f)) |
| Legal claims and compliance: any of the above, as needed | Comply with law, defend claims, enforce our Terms | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Giving us your details is voluntary, but without them we cannot answer your request or open an account.
Where the data comes from (Art. 14 GDPR). Mostly from you; also from the organization that created your account, from Google, Microsoft, Apple or your organization's single sign-on provider when you use them (Section 4), from our payment processor (payment status) and, for data in a customer's workspace, from the customer.
We do not sell personal data, use it for advertising, or use your or your organization's data to train AI models.
4. Google Sign-In and Google user data
You can sign in with Google and, if you choose, connect Gmail, Google Calendar or Google Drive so your agents can do tasks for you. We receive only the data covered by the permissions (OAuth scopes) you grant: your basic profile (name, email, picture), to create your account, and the emails, calendar events or files you authorize, used only for the features you request. The part a task needs is sent to an AI model provider (Section 5), which does not retain it or train on it; it is never sent to image or video generation models.
The same applies to Microsoft accounts you connect. You can revoke access at any time in your Google Account settings.
Limited Use disclosure
Syzygia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We only use Google user data to provide and improve the user-facing features of the Services that you have requested.
- We do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
- We do not use Google user data for advertising.
- We do not allow humans to read your Google user data unless (a) you give us explicit permission, (b) it is necessary for security purposes such as investigating abuse, (c) it is required to comply with applicable law, or (d) the data has been aggregated and anonymized.
- We do not use Google user data — including Google Workspace data — to train, develop, or improve generalized or foundation artificial intelligence and/or machine-learning models.
5. AI agents, voice calls, agent email and WhatsApp
AI agents. To do a task, an agent sends the content it needs (messages, call transcripts, files, data from connected services, its working context) to AI model providers, which process it only to return a response, do not retain it and do not train on it — except image and video generation providers, which may keep prompts and reference images for up to 30 days to monitor abuse. Agents keep working memory in the customer's workspace, never shared with other customers. Agents can also search the public web (Section 6).
Voice calls. When you talk to an agent by voice, audio is converted to text and is never stored; the transcript is kept as chat messages (Section 8).
Agent email. If the customer enables it, each agent has an email address. The agent reads only email from the organization and approved senders; other email is held for an administrator, and agents never reply automatically to external senders.
WhatsApp. Agents can message numbers and groups the customer registers and verifies, and receive replies; we keep those numbers, message identifiers and contents. The channel works subject to availability, depends on third-party services, and delivery isn't guaranteed. To stop these messages, tell the organization or reply to say so.
Outputs can be wrong. AI output can contain errors. The customer decides which agent actions need a person's confirmation, and people remain responsible for decisions based on them.
Automated decisions. Syzygia takes no decisions based solely on automated processing with legal or similarly significant effects on you (Art. 22 GDPR); the beta screening score is reviewed by a person. A customer that uses agents in decisions about individuals is the controller for that use, and our DPA requires meaningful human involvement or the safeguards of Art. 22(3).
6. Who receives personal data
We share personal data only as needed to provide the Services, mainly with providers that process it on our behalf (sub-processors). The categories of recipients are:
- Cloud hosting provider (servers in the United States).
- AI model providers — process prompts and context to return a response (Section 5); they do not use them to train models.
- Payment processor.
- Email provider.
- Messaging channel providers (such as WhatsApp), chosen by the customer.
- Web search provider — the queries agents write.
- Map tile provider — your IP address and the map area, when you open a map.
- Analytics provider (Google Analytics) — only with your consent, on syzygia.io.
Services the customer connects (such as Google or Microsoft accounts, an ERP or a bank) receive data on the customer's instructions, under its own contract with them. Customers can get the current list of named sub-processors on request at info@syzygia.io (see our Sub-processors page).
We may also disclose data where required by law, to protect rights and safety, to enforce our Terms of Service, or to a successor in a merger or acquisition (with notice to you).
7. International transfers
Personal data is processed in the United States and other countries. Transfers from the EU/EEA, the UK or Switzerland are protected by an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework, with its UK Extension and the Swiss-U.S. framework, for certified recipients) or the European Commission's Standard Contractual Clauses (with the UK addendum and Swiss amendments where applicable), together with supplementary measures where needed. You can ask for a copy of these safeguards at info@syzygia.io.
8. How long we keep data
These periods apply automatically unless stated otherwise; customers can delete their content earlier at any time.
| Data | Retention |
|---|---|
| Contact form requests and related emails | 24 months after our last exchange |
| Beta screening applications | The beta program and 12 months afterwards, then deleted or anonymized |
| Privacy requests and our replies | Made in the Hub: 6 years after closing. Made through this website or by email: 6 years after closing |
| Records of acceptance of the Terms, this policy and the DPA | While the account exists; once it is closed, until 6 years after each acceptance (without IP address and user agent) |
| Platform account data | While the account is active; when a customer leaves, deleted after a grace period (30 days by default) to export its data |
| Chat messages and voice call transcripts | 180 days after the conversation was last active |
| Records of agent executions | Step-by-step records 90 days; free-text detail 365 days |
| In-app notifications | 365 days |
| Files attached to a chat | 30 days |
| Workspace files, reports, agent memory and business data | Until the customer deletes them or leaves; data of a removed agent, 30 days |
| Emails received by agents | Raw message at reception: up to 7 days. Accepted: 365 days, or earlier if the customer deletes them or 30 days after the agent is removed. Held from unknown senders: 30 days |
| Voice call audio | Not stored |
| WhatsApp message records | 180 days |
| Data exports you download from the Hub | 72 hours |
| Sign-in records, security and audit logs | 365 days; pseudonymized if the account is deleted |
| Record that a customer's data was deleted | 6 years |
| Website hosting logs | Kept by our hosting provider for no longer than 30 days |
| Analytics data (only with consent) | Cookies up to 2 years; reports 14 months |
| Invoices, payment records and billing records of agent executions (without user identity once a user is deleted) | 7 years, or longer if tax or accounting law requires it |
| Backups | Up to 35 days (monthly copies up to 365 days); earlier file versions 30 days. Deleted data disappears from backups when they expire |
We may keep data longer where the law requires it or to establish, exercise or defend legal claims, for no longer than necessary.
9. Your rights and how to exercise them
You have the right to access, rectification, erasure, restriction and portability (Arts. 15–20 GDPR), to object to processing based on legitimate interests and to direct marketing (Art. 21), to withdraw consent at any time without affecting earlier processing, and not to be subject to solely automated decisions (Art. 22).
How. In the Hub under My profile → Privacy requests, with our privacy request form, or by email to info@syzygia.io. It is free. We reply within 30 days, extendable by two months for complex requests (we tell you why within the first month), and may need to confirm your identity.
Right to complain. You can lodge a complaint with a data protection supervisory authority, in particular where you live or work (list of EU/EEA authorities), or in the UK with the Information Commissioner's Office. As Syzygia has no establishment in the EU, it has no lead supervisory authority.
10. Security and personal data breaches
We protect personal data with technical and organizational measures appropriate to the risk (Art. 32 GDPR), including encryption in transit and at rest, access control and least privilege, logical separation of customer data, backups, monitoring and logging, incident response, a vulnerability disclosure policy and confidentiality obligations for our staff. No method of transmission or storage is completely secure. More on our Trust Center.
Breaches. As controller, we notify the supervisory authority within 72 hours of a breach likely to put you at risk, and tell you without undue delay if the risk is high. As processor, we notify the customer without undue delay, as set out in the DPA.
12. Files you upload and store
Your files remain yours; we access them only to provide the Services, and you control access with roles and folder permissions. We do not pre-screen files: you are responsible for what you upload, and we may remove unlawful material and suspend accounts under our Terms of Service. Copies of deleted files expire with earlier versions and backups (Section 8).
13. Children
The Services are for business and professional use and are not directed to children under 16. We do not knowingly collect their personal data; if you believe a child has given us personal data, contact us and we will delete it.
14. California and other US states
Residents of California and other US states with a comprehensive privacy law can know, access, correct and delete their personal information without discrimination, through the channels in Section 9. We do not sell or share personal information for cross-context behavioral advertising.
15. Changes to this policy
We publish each new version here and tell registered users about material changes before they take effect. Earlier versions are available on request.