Privacy Policy

This policy says what the Synsema Platform (https://control-1.synsema.com and *.synsema.app) collects about you, why, who sees it and for how long. The platform is operated by the operator of synsema.com, which is responsible for this processing. Write to hello@synsema.com for anything about your data.

1. What we collect§

• Account. Your email, your name, and a hash of your password (never the password). Browser sessions and the API tokens you create, stored as hashes.
• Programs. The source code and the files you deploy, their manifest of capabilities, the names of their volumes, and where they came from (a recipe, a public repository or an upload).
• Configuration. The environment variables and secrets you set for a service. They are stored in our control plane, handed to your service as its environment, and shown to nobody.
• Operation. Deploy logs, the audit of the permission checks your programs make, the status of your services and of the machines that run them.
• Billing. Your Stripe customer and subscription identifiers, the status of the subscription and the record of the plan changes and payments. Your card and your invoices are held by Stripe; we never see your card number.
• Devices. When you sign a device in from the terminal, the name it gave and the moment you approved it.
• Integrations. When you install our GitHub App, the installation identifier and the repositories it gives access to, and the deliveries GitHub sends us.
• Technical. Our servers keep logs of requests (address, path, time, user agent) for security and troubleshooting.

2. Why, and on what basis§

To provide the platform to you, which is the contract between us: run your services, keep your account, bill the plan. To keep the platform secure and fair, which is our legitimate interest: prevent abuse, investigate incidents, enforce the plan limits. To comply with the law, including tax and accounting duties. To tell you about the service: changes, incidents, invoices. We do not sell your data and we do not use it for advertising.

3. Cookies§

The platform sets one cookie, sid, which keeps you signed in for up to thirty days and is sent only over HTTPS on the public site. It is strictly necessary for the dashboard to work. We set no analytics, advertising or third-party cookies, and our pages load fonts and scripts from our own servers, so nobody else sees your visit. There is nothing to consent to, which is why there is no cookie banner. If that ever changes, this policy changes and we will ask.

4. Who sees your data§

• Stripe, which processes payments under its own privacy policy, receives your email and what is needed to bill you.
• Hosting providers. The control plane and the machines that run your services are rented from hosting providers in the European Union; your data lives on those machines.
• GitHub, when you connect a repository or install our app.
• The providers your programs call, such as an LLM provider, receive what your program sends them with your keys. We are not part of that exchange.
• Authorities, when the law obliges us.

We do not share your data with anyone else. Where a transfer outside the European Union happens, it relies on the safeguards the law provides, such as standard contractual clauses.

5. The data your programs handle§

What your service writes into its volume is yours and is processed under your instructions. We access it only to operate the platform, to help you when you ask, for security, or when the law requires it. You are responsible for having the right to process it and for telling the people it concerns.

6. How long we keep it§

Account data, while the account exists. Programs, configuration, logs and audit, while the project exists; when you delete a project, its container, code, volume, logs and audit are erased. When you ask us to delete your account, everything above is erased within thirty days, except what we must keep for tax, accounting or legal reasons, such as invoices. A project a plan cannot hold is deleted fourteen days after the plan change, as the terms describe. Backups of the control plane are kept for our own recovery and overwritten on a rolling basis. Technical logs are kept for a limited time.

7. Security§

Passwords are stored with Argon2id. Traffic uses HTTPS. Each service runs in its own container, without privileges, with only its declared volumes writable and under the capability ceiling it declared. Access to the servers is limited to the operator. No system is perfectly secure: do not put on the platform a secret you could not rotate, and tell us at hello@synsema.com if you find a vulnerability.

8. Your rights§

You can ask us to access, correct, delete or export your data, to restrict or object to a processing, and you can complain to the supervisory authority of the place where you live. Most of it you can do yourself in the dashboard; for the rest, write to hello@synsema.com from the email of your account and we will answer within the time the law sets.

9. Age§

The platform is for people of at least 18 years. We do not knowingly collect data from anyone younger; tell us if you think we have.

10. Changes to this policy§

Each version carries a date at the top. A material change is shown in the dashboard and asks for your acceptance before you continue using it. The current version is always at https://control-1.synsema.com/privacy.

11. Contact§

the operator of synsema.com, at hello@synsema.com.