Privacy Policy

SynqOS Ltd ("we", "us") is the data controller for personal data you provide when using this service. Registered address: 2 Edmund Court, Sheffield, United Kingdom. Company number: 17338012.

Contact: hello@synqos.co.uk

• Account data: name, email, phone, business name, address, website.
• Authentication data: hashed password, sign-in timestamps.
• Billing data: Stripe customer & subscription IDs (card details are held by Stripe, not by us).
• Product data: agent runs, workflow runs, ROI configuration, ad ideas you generate.
• Integration tokens for connected services (Square, SumUp, Facebook, Instagram, Gmail, Google Business Profile).
• Technical data: IP address and browser info logged for security.

• Contract — to deliver the service you sign up for.
• Legitimate interest — service improvement, fraud prevention, security.
• Consent — optional marketing communications and non-essential cookies.
• Legal obligation — tax and accounting records.

We share the minimum data required with:

• Supabase (database and authentication — London, UK)
• n8n Cloud (automation workflows — Frankfurt, EU)
• Lovable and Cloudflare (app hosting and sending our emails; Lovable also relays some Gemini requests)
• Google (Gemini API for drafting and analysis; Gmail and Business Profile APIs when you connect them; Google Sheets, used by our automations to store marketing plans)
• Meta (Facebook and Instagram APIs when you connect them)
• Square and SumUp (sales data from integrations you connect)
• Stripe (our billing)
• Serper.dev (search results for SEO rankings)
• Open-Meteo (weather forecasts for your venue's location)
• postcodes.io (looks up your venue's postcode to find its location)

When you connect third-party platforms (Square, SumUp, Meta, Google), those platforms act as independent data controllers under their own privacy policies. We access only the data you explicitly authorise.

Competitor Radar data

Competitor Radar uses the notes you enter about competitors to produce your weekly briefing. It does not read Facebook pages or other social media accounts.

Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses with equivalent safeguards.

SynqOS uses Google Gemini to produce briefings, content suggestions, pricing suggestions and other outputs. When you run an agent, the venue data needed for that output (for example, revenue figures, stock levels or your competitor notes) is sent to Gemini.

When you use Customer Support tools, the content of your customers' emails (including their name and email address) is sent to Google Gemini to draft replies and spot follow-ups. Nothing is sent unless you use those tools. We use Google's paid Gemini API, under which Google does not use this content to train its models.

Our automation workflows (n8n) also send venue data to Gemini to produce briefings, including café, revenue, support, competitor and SEO briefings.

The Family & Education tool sends the text of web pages you choose (which may include school or nursery contact details) to Gemini to extract dates, events and contacts.

Re-engagement and Family & Education emails are sent from your own connected Gmail account; customer names and email addresses from your booking API pass through our automation service to do this.

Account data is retained while your account is active and for up to 30 days after deletion. Billing records are retained for 7 years to meet UK tax law. You can request earlier erasure at any time.

Successful automation runs are not stored by our automation service (n8n). Failed runs are kept in its log only for troubleshooting and are deleted automatically.

You have the right to access, rectify, erase, restrict, port and object to processing of your data.

• Download a copy: Portal → Account → "Download my data".
• Delete your account: Portal → Account → "Delete my account".
• Read the full deletion instructions (including Facebook/Instagram disconnect): Data Deletion.
• Complain to the ICO: ico.org.uk.

Data is encrypted in transit (TLS) and at rest (AES-256). Access is restricted by row-level security scoped to your account. Passwords are hashed with bcrypt and checked against known-breached password lists.

See our Cookie Policy.

Questions? Email hello@synqos.co.uk.

The Customer Re-engagement and Marketing Manager agents can send emails to your venue's customers. You are the data controller for those communications. You are responsible for ensuring you have a valid lawful basis (consent or legitimate interest) under UK GDPR and PECR before sending marketing emails to your customers via SynqOS. We act as your processor for those sends only.