SynectGEO · Legal
Privacy Policy
Last updated: 25 July 2026
This Privacy Policy explains how SYNECT LIMITED (“we”, “us”) collects, uses, and protects personal data when you use SynectGEO at synectgeo.io. We are the data controller for that processing and are committed to the EU General Data Protection Regulation (GDPR) and Irish data-protection law.
1. Data Controller
The controller responsible for your personal data is:
The Tara Building, 11-15 Tara Street, Dublin 2, D02 RY83, Ireland
Contact: hello@synectgroup.com
2. What Personal Data We Collect
- Account / sign-up data: name and email address (collected at Early Access sign-up).
- Usage data: the brand name, website URL, and custom prompts you submit, and the reports generated for you.
- Technical data: IP address, browser type, device identifiers, and session logs.
- Analytics data: page views and feature usage — collected via Google Analytics 4 only after you opt in through the cookie banner.
- Team member data: if you invite a teammate to your workspace, we process the email address you provide solely to send the invitation and set up their membership. Within a shared workspace, members can see each other’s email and role, and owners/admins can see members’ usage and manage their access.
- Billing & tax data (once paid billing is live): your name, billing address, VAT/tax ID, and payment metadata needed to process a purchase and issue a compliant invoice. Card details are entered directly with our payment processor (Stripe) and are never seen or stored by us.
3. Why We Collect It (Lawful Basis — GDPR Article 6)
| Processing activity | Lawful basis |
|---|---|
| Early Access sign-up (email) | Consent |
| Delivering the AI visibility report | Contract (performance of service) |
| Sending transactional emails (report ready, account updates) | Contract |
| Product analytics / usage tracking | Consent |
| Marketing emails (if any) | Consent (separate, opt-in) |
| Security monitoring, fraud detection | Legitimate interests |
| Team invitations (inviting a teammate by email) | Legitimate interests of the workspace |
| Processing payments (subscriptions, credit top-ups) | Contract (performance of service) |
| Issuing and retaining invoices / VAT records | Legal obligation (Irish tax law) |
4. How the Product Works — Data Flow
A SynectGEO workspace can have more than one member. The person who invites a teammate is responsible for having a lawful basis to share that person’s email with us. Members of the same workspace share access to that workspace’s projects and reports; owners and admins can manage members and set per-member daily usage limits.
5. Sub-Processors
We share data with the following sub-processors to operate the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| OpenAI (ChatGPT) | AI visibility queries | USA (SCCs apply) |
| Google (Gemini) | AI visibility queries | USA/EU (SCCs apply) |
| Anthropic (Claude) | AI visibility queries | USA (SCCs apply) |
| Perplexity AI | AI visibility queries | USA (SCCs apply) |
| Zyte | Website crawling for market & prompt detection (customer and competitor pages) | Ireland/EU (SCCs where applicable) |
| Serper | Search-engine results data (SERP lookups) | USA (SCCs apply) |
| DataForSEO (Dataforseo OÜ) | Google AI Overview results + cited sources for reports (public search-results data; when AI-Overview enrichment is enabled) | EU (Estonia / Germany) 🇪🇺 |
| Supabase | Database, authentication | eu-west-1, Ireland 🇮🇪 |
| Vercel / Cloudflare | Hosting, CDN | EU/USA (SCCs apply) |
| Upstash | Abuse / rate-limit protection (ephemeral request counters keyed to a pseudonymous account ID) | USA/EU (SCCs apply) |
| Brevo | Transactional email | EU |
| Google Analytics 4 | Usage analytics (only after consent) | USA (SCCs apply) |
| Stripe | Payment processing (when billing goes live) | USA/EU (SCCs apply) |
For all USA-based sub-processors, transfers rely on the EU Standard Contractual Clauses (SCCs) as the transfer mechanism under GDPR Chapter V.
6. Data Retention
- Account data: retained for the duration of your account. When you delete your account, your account and workspace data are erased immediately; any residual copies in routine, encrypted infrastructure backups are removed as those backups expire.
- Report data: retained for 12 months, after which it is deleted; you may request earlier deletion at any time.
- Analytics data: retained per the Google Analytics 4 default (up to 14 months), or shorter where configured.
- Invoices & tax records: retained for 6 years as required by Irish tax law, even after account deletion.
7. Your Rights (GDPR Articles 15–22)
You have the right to:
- Access your data (Article 15)
- Rectify inaccurate data (Article 16)
- Erasure — the “right to be forgotten” (Article 17)
- Data portability (Article 20)
- Object to processing (Article 21)
- Withdraw consent at any time (Article 7)
To exercise any right, contact hello@synectgroup.com. We respond to all rights requests within 30 days.
9. Data Breach Notification
In the event of a data breach likely to result in a risk to your rights, SYNECT LIMITED will notify the Irish Data Protection Commission within 72 hours and notify affected users without undue delay.
10. Supervisory Authority
If you believe your data-protection rights have been infringed, you may lodge a complaint with the Irish supervisory authority:
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by the “Last updated” date above. Continued use of SynectGEO after an update constitutes acceptance of the revised policy.