Privacy Policy

Last updated: March 30, 2026. Subject to legal review — not legal advice.

This Privacy Policy explains how Synthr (“we”, “us”) processes personal data when you use our SaaS platform (CRM, listings, publishing, optional AI, and billing). AlphaSynth AI (“AlphaSynth AI”, “we”, “us”) operates Synthr and is the data controller for this service. Contact us at [email protected].

1. Scope

This policy applies to visitors of our marketing site, users of the Synthr web application, and data processed on behalf of your agency (including contacts and leads you store in the CRM).

2. Data we process

Depending on how you use Synthr, we may process:

• Account and profile data: name, email, phone, role, agency name, authentication data (e.g. session tokens managed securely).
• CRM and listing data: information your agency enters (contacts, leads, tasks, property and listing details, notes, communications metadata).
• Inquiry form data: information submitted through the public inquiry form (such as name, email address or phone number, and your message).
• Integration data: when you connect Gmail, we process email content and metadata needed for the features you enable, in line with Google permissions you grant.
• Billing data: subscription status, plan, and payment-related identifiers processed by Stripe (we typically do not store full card numbers on our servers).
• AI processing: prompts and content you submit to optional AI features may be sent to OpenAI (or another provider we disclose) to generate responses.
• Analytics data and technical data: IP address, device/browser type, logs, usage events and identifiers (including cookies/other technologies where applicable), as described in our Cookie Policy.

3. Purposes and legal bases (GDPR)

Where the GDPR applies, we rely on appropriate bases, such as:

• Contract — providing the service you signed up for.
• Legitimate interests — securing the platform, improving features, analytics (non-essential analytics only with your consent — see cookies).
• Consent — where required (e.g., non-essential cookies, certain marketing, optional AI where consent is the appropriate basis).
• Legal obligation — where we must retain or disclose information by law.

4. Sharing with processors

We use trusted subprocessors to run Synthr, including (as applicable):

• Stripe — payment processing.
• Google (Gmail API) — when you connect email.
• OpenAI — optional AI features.
• Hosting / infrastructure — our cloud and hosting providers used to operate the platform (the exact provider and region depend on our deployment).
• Object storage (S3-compatible) — used for media uploads (e.g. listing images and logos) when configured.
• Analytics — Google Analytics 4 (GA4) on the marketing site, if you consent to optional analytics.
• Error reporting (Sentry) — if enabled in your deployment.

We enter into data processing agreements where required. A current list of subprocessors can be provided on request by contacting [email protected].

5. International transfers

If data is transferred outside the European Economic Area, we use appropriate safeguards (e.g. Standard Contractual Clauses) where required, and we rely on other lawful transfer mechanisms as applicable.

6. Retention

We keep data only as long as needed for the purposes above, including legal, accounting, and security requirements. Backup retention may apply for a limited period while backups are rotated. Cookie preferences and consent choices are retained until you change them or clear your browser storage.

7. Your rights

Depending on your location, you may have rights to access, rectify, delete, restrict, or object to processing, data portability, and to withdraw consent. You may lodge a complaint with a supervisory authority. Contact us at [email protected] to exercise your rights.

8. Security

We implement technical and organizational measures appropriate to the risk (encryption in transit, access controls, monitoring). No system is 100% secure; please use strong passwords and protect your devices.

9. Children

Synthr is not directed at children. We do not knowingly collect personal data from children.

10. Changes

We may update this policy and will post the new version here with an updated date. Material changes may require additional notice where required by law.