Privacy policy

Version 1.0.1 · Effective date: the date it is published on the SynapDash website · Controller: Advanced Technologies LTD, a company incorporated in the Republic of Mauritius · Contact (privacy, data protection officer): privacy@synapdash.com

This policy follows the Mauritius Data Protection Act 2017 (DPA 2017), our reference law. For people in the European Union or the United Kingdom, it also meets the GDPR and UK GDPR: where those laws give you more protection, they apply. Our data protection officer is reachable at the contact address above. Until an EU representative under GDPR art. 27 is appointed, people in the EU write to the same address.

1. Who this policy covers, and our two roles

SynapDash is a personal AI assistant platform: chat agents, channels (web, mobile, WhatsApp and others), automations and plugins.

• We are the controller for our relationship with you: your account, billing, support, security logs, and how we run and improve the service.
• We are a processor for the content you and the people you let in put into your SynapDash workspace (your instance): conversations, contacts, files, connected mailboxes and calendars. You (or your organisation) are the controller of that content. Our Data Processing Agreement governs it, and you decide what goes in, who can see it and when it is deleted.

2. What we collect

We do not knowingly collect special-category data. If you put such data into a conversation, it is processed as workspace content under your instructions. Integrations that handle health data (Apple Health) or children's school data (Pronote) are off by default, owner-only, and turned on only by the account holder for their own household, who gives the consent these laws require. We carry out a data protection impact assessment before offering such an integration to customers.

Children. Accounts are for adults (18 and over). Child-facing surfaces (kid chat, games) run under restricted tool policies set up by the adult account holder. The account holder must be the child's parent or guardian, or have their consent, for any child under 16 (DPA 2017 and GDPR art. 8; a lower age applies where an EU member state sets one).

3. Why we use it (purposes and legal bases)

We do not sell personal data, we do not use workspace content for advertising, and we do not train AI models on your content. AI providers receive prompts only to answer them. We use them under API or business terms that exclude training on your inputs wherever the provider offers such terms, and we only route customer traffic to providers that offer them. If you connect your own AI subscription or key, your contract with that provider governs that use.

4. AI processing

When you talk to an agent, the message, the relevant context (recent conversation, memory, tool results) and any files you share are sent to the AI provider that runs that agent (see sub-processors). Outputs can be wrong. Do not rely on them for medical, legal or financial decisions without checking. Agents act only within the tools you have enabled. Sensitive actions (smart-home devices, emails with external recipients, calendar invitations, payments) wait for your approval.

Passwords typed into a chat can be moved to an encrypted vault before they are stored or sent to an AI provider (when the feature is on). Only you can use or reveal them.

5. Who we share data with

• Sub-processors that host and run the service: see the register. We give advance notice of new ones as the DPA describes.
• Integrations you connect, under your instructions.
• Authorities, only when the law requires it. We push back on requests that are too broad, and we tell you unless the law forbids it.
• A buyer or successor, if the business changes hands, under the same commitments.

6. International transfers

We are based in Mauritius. Our servers are in the European Union (Germany and Finland), and several AI and messaging providers are in the United States. Every transfer outside Mauritius meets section 36 of the DPA 2017 (appropriate safeguards, or your consent where it is the basis). For data from the EU or the UK, transfers rely on adequacy decisions or on the Standard Contractual Clauses (UK Addendum for the UK). The sub-processor register gives each provider's region.

7. How long we keep it

8. Security

Encryption in transit (TLS) and at rest for secrets (envelope encryption, AES-256-GCM). Multi-factor authentication for owners and staff. Role-based access, with members limited to their own conversations. Tamper-evident audit log. Least-privilege staff support sessions that are time-limited and audited. Vulnerability scanning in CI. See incident response for how we handle and report incidents.

9. Your rights

Under the DPA 2017 (and the GDPR or UK GDPR where they apply), you can ask for access, correction, deletion, restriction, portability, and object to processing based on legitimate interest. You can withdraw consent at any time. Write to privacy@synapdash.com. We answer within one month. For workspace content, your instance owner is the controller, and we help them answer.

Complaints: you can contact the Data Protection Commissioner of Mauritius (Data Protection Office, dataprotection.govmu.org) or, in the EU or UK, your local supervisory authority.

10. Changes

We announce material changes by email or in the app at least 30 days in advance. The version and date are at the top of this page.

Change log