Privacy Policy

1. Who we are

Syniray is provided by Syniray, Inc., a Delaware corporation whose address is 447 Sutter St, Ste 506 - 1201, San Francisco, CA 94108, United States (“Syniray”, “we”, “us”).

Syniray, Inc. decides why and how the personal data described in this Policy is processed. Because we offer the Service to people in the European Economic Area (EEA) and the United Kingdom, the EU General Data Protection Regulation (GDPR) applies to the processing of the personal data of people in the EEA, and the UK GDPR to that of people in the United Kingdom; Syniray, Inc. is the controller of that data. Syniray has not appointed a data protection officer.

For any question about this Policy or about your personal data, write to [email protected]. For help with your account, your plan or a payment, write to [email protected].

2. Scope of this Policy

This Policy applies to the personal data we process when you visit syniray.ai, use the Syniray application (the Chat and its tools, Syniray Academy, Syniray Code, Syniray Reverse, the Syniray Connector, the Library and Projects), buy a plan or credits at checkout.syniray.ai, open a shared link or write to us. Together, these are the “Service”.

It applies to visitors, to people who open a shared link and to account holders on the Free, Pro and Max plans.

It does not apply to:

• Syniray Enterprise and the Syniray API offered to organisations;
• websites and services of third parties, including the sites cited in answers and sources;
• the processing that AI, payment and sign-in providers carry out for their own purposes under their own policies, although this Policy describes what we send to them.

3. The personal data we process

Account and sign-in

When you create an account we receive your e-mail address and your name. If you register with an e-mail address and a password, we store the password only as a one-way hash. If you sign in with Google, we receive your name, e-mail address, profile picture and Google account identifier. If you use Sign in with Apple where it is offered, we receive the name and e-mail address Apple shares with us, which may be a relay address created by Apple.

Onboarding

Before an account can be used, onboarding asks for a username, your country, your date of birth, your gender (male or female), a mobile phone number, which is verified with a code sent by SMS, and your job role. These details are needed to finish onboarding: without them the account cannot be used. You can also tell us the name Syniray should use for you, which is optional. You can add a profile picture by entering the address of an image in Settings › Profile.

Your content

• the messages, questions and instructions you send, and the answers, work plans, sources and files generated for you;
• the files and images you attach or upload, the documents you add to Syniray Academy, the files you upload to Syniray Reverse for analysis and the files of your Syniray Code projects;
• the text produced from your voice input;
• what you create with Deep Research, Fact Check, document generation and the Agent;
• your feedback on answers (good or bad).

Your content may include personal data about you or about other people. We do not ask for sensitive information, such as data about your health, religion or political opinions. If you include it, it is processed like the rest of your content: stored as described in this Policy and sent to the AI provider that answers you. Please include it only if you are comfortable with that, and include information about other people only if you are entitled to share it.

Personalisation

Chat memories, custom instructions, your Academy profile and Academic memory, and the instructions of your Syniray Code projects (section 7).

Payments and credits

Your plan, the state and history of your subscription, the prices paid, the currency, your credit balances and a record of the credits used per feature and model (section 9).

Technical and usage data

• for each sign-in: the IP address, a description of the browser and device, and an approximate city and country estimated from the IP address;
• server logs, which record the IP address, the date and time, the address requested, the browser's description and errors, some of which include the e-mail address of the account concerned;
• usage records: the feature and model each request used, the number of tokens processed and the credits charged;
• the preferences kept in your browser (section 16).

Communications

The messages you send to our e-mail addresses, including support requests, and the e-mails we send you about your account and your purchases.

Data we receive from others

• Google or Apple, when you sign in with them;
• Stripe, about your payments, including the information it uses to calculate tax, such as your country;
• Google Firebase, which checks in your browser the code sent by SMS to your phone; our servers then record that your number was verified;
• ip-api.com, an approximate location for an IP address;
• search results and web pages, which may contain information about other people.

4. How we use your data

We use personal data to:

• create and run your account, answer your messages, run the tools and products you use, and keep your history, files, settings and credits;
• send your content to the provider of the AI model that answers you, and to the other providers described in sections 6 and 10 when the feature you use needs them;
• process payments, subscriptions, credit purchases and taxes, and keep invoices and tax records;
• check that you meet the minimum age, verify your phone number and prevent abuse, such as the mass creation of accounts, automated sign-in attempts and other misuse of the Service;
• use your country to set the currency of paid plans, calculate taxes, choose the initial language of the interface and give the AI model your local time, and use your gender only to choose the voice of Read aloud;
• keep the Service secure and working: detect and fix errors, investigate incidents and understand, in aggregate, how features and models are used, for example the credits used per feature, and improve the Service, including with the ratings you give to answers;
• with your consent, measure how our website syniray.ai is used — the pages visited, the type of device and browser and the approximate country — with Google Analytics (section 16);
• personalise answers with the details and settings you give us (section 7);
• answer your support requests and the requests you make under this Policy;
• send you e-mails about your account, your purchases, changes to your subscription and changes to our terms and policies, including a welcome e-mail when you finish onboarding, which summarises your account and also presents our plans;
• comply with the law, respond to lawful requests from authorities, and establish, exercise or defend legal claims.

We do not sell your personal data, we do not use it for targeted advertising and we do not use it to train AI models. We do not send newsletters, and apart from the presentation of our plans in the welcome e-mail we do not send promotional e-mails.

5. Legal bases (EEA and United Kingdom)

Where the GDPR or the UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Article 6(1)(b)): to provide the Service you signed up for, including your account, the Chat and its tools, Syniray Academy, Syniray Code, the Library and Projects, the memory and personalisation you set up, the AI providers that produce the answers, payments, credits and service e-mails.
• Legitimate interests (Article 6(1)(f)): to keep the Service secure and prevent abuse and fraud (phone verification, sign-in history, limits on sign-in attempts and on new accounts, server logs), to check that users meet the minimum age, to understand in aggregate how the Service is used, fix problems and improve it, to keep records of what was agreed and paid, to comply with legal obligations under the law of other countries, such as the United States, and respond to lawful requests from authorities, to present our plans in the welcome e-mail sent when you finish onboarding, and to establish or defend legal claims. Our interest is to run a secure and reliable service and to protect our users and our business. You can object to these uses (section 13).
• Consent (Article 6(1)(a)): for Academic memory in Syniray Academy, which stays off until you accept its disclosure, and for Google Analytics on syniray.ai, which is not loaded until you accept it in the cookie panel. You can withdraw your consent at any time, as easily as you gave it; this does not affect what was done before.
• Legal obligation (Article 6(1)(c)): where a law of the European Union, of a Member State or of the United Kingdom requires us to keep or disclose data, for example tax records.

Your e-mail address and the onboarding details are necessary to create and use an account; if you do not provide them, you cannot use an account. Everything else depends on the features you choose to use.

6. AI models and their providers

Answers, summaries, images, speech and other outputs in Syniray are generated by AI models made by third-party providers, which we use through their APIs. Syniray does not train or fine-tune AI models, and we do not use your content to train them.

Which provider receives your content

Your content goes to the provider of the model that handles your request: the model you choose in the model selector or, for features that use a model chosen by Syniray (such as the Agent), the model Syniray assigns to them.

• OpenAI: GPT models;
• Anthropic: Claude models;
• Google: Gemini models;
• DeepSeek: DeepSeek models;
• Moonshot AI: Kimi models;
• Z.AI: GLM models;
• xAI: Grok models.

Syniray 2.0, the default model and the model of the Free plan, is built on open-source model technology and is run for Syniray by one of the providers listed above, which receives the content of its requests in the same way.

A Chat request includes your message, the earlier messages of the conversation, the files and images you attached and the context described in section 7. Requests in Syniray Academy and Syniray Code include the content of that session in the same way.

Providers that take part whatever model you choose

• DeepSeek receives the text of your Chat messages to decide how to handle each one (for example whether it needs a web search, an image or a file, and which model answers in Best Mode) and to write the work plan shown while the answer is prepared. It also receives Syniray Academy questions to decide whether they need a web search.
• OpenAI receives the first 250 characters of the first message of a new conversation, in the Chat, Syniray Academy and Syniray Code, to write its title.
• OpenAI, and Google when OpenAI does not return a result, receive the search query, usually your question, when an answer uses a web search (section 8).

Your own API key

In Syniray Code you can connect your own API key from OpenAI, Anthropic, Google, DeepSeek or another service compatible with the OpenAI API. The requests that use that key go to the provider you chose, under your own agreement with that provider. Syniray stores the key encrypted and uses it only on our servers, to make those requests and to check that the key works.

How providers handle data

Each provider processes what it receives to generate the output, and handles it under its own terms for business and API customers, including how long it keeps the data and the purposes for which it may use it, such as preventing abuse. Syniray does not control those terms. When you attach a PDF to a message answered by a Kimi model, the file is uploaded to Moonshot AI's file service to extract its text, and it is kept there under Moonshot AI's rules.

AI output can be wrong, incomplete or out of date. Check important information before you rely on it: answers are not professional advice.

7. Memory and personalisation

Chat memory (Pro and Max)

In Settings › Memory you can save short facts about yourself, up to 50 entries. Syniray saves only what you add there; it does not extract memories from your conversations. While Use memory is on (it is on by default), your saved memories are added to every Chat request and are therefore sent to the provider of the model that answers. Turning it off stops their use without deleting them, and you can delete them one by one or all at once. Memories are used only by the Chat, not by Syniray Academy or Syniray Code. If your account moves to the Free plan, your saved memories are not deleted and, while memory is on, they continue to be used in Chat answers; to have them deleted, write to [email protected].

Custom instructions and profile details

The instructions you write in Settings › Personalization, the name Syniray should use for you, your job role, your country and your local time are added to every Chat request so that answers can follow them. To stop using your instructions, delete them and save.

Summary of recent conversations

When your Chat conversations are stored on our servers (on the Pro and Max plans, including conversations kept after a move to the Free plan), each Chat request also includes a short summary of the most recent messages across your Chat conversations, both your messages and the answers (up to 30, each shortened, with the titles of their conversations), so that the answer can take recent context into account. The summary is put together when you send a message and is not stored on its own. It does not depend on the memory switch; conversations you delete no longer appear in it.

Syniray Academy

Your academic profile (for example your level of study, institution, field and goals) and Academic memory are separate from the Chat. Academic memory stays off until you turn it on and accept its disclosure. While it is on, each tutor answer receives a short summary, of about 900 characters at most, of what is relevant to the question, such as topics you find difficult or already know, taken from your Academy records and the items you save; that summary is sent to the model's provider. The difficulties and known topics you save expire after 180 days unless you keep them; topics you mute stay muted until you remove them. In Settings › Academy you can see, export, change and delete them, and switch Academic memory off; while it is off, your academic profile is not used either. Syniray Academy never uses the Chat's memory, and the Chat never uses Academic memory.

Syniray Code

The instructions you write for a Code project, and the project's SYNIRAY.md file when you allow it to be read, are added to the requests of that project's sessions. Each Code session keeps a short history of its own earlier turns, used only within that session.

Projects

A Project groups conversations and results, and stores the description and shared context you write for it.

8. Data in each product

Library and files

The files you attach in the Chat or upload to the Library (Pro and Max), and the images and files Syniray creates for you in the Chat, are stored on our servers and listed in your Library until you delete them there or delete your account. Deleting a conversation does not delete its files. Each account can store up to 2 GB of uploaded files. Your files are available only to you, unless you share a conversation or result that contains them.

Deep Research, Fact Check, documents and the Agent

The questions, reports, checks, documents and Agent tasks you create are stored in your account until you delete them or delete your account. Files created by the Agent are stored on our servers and are available only to you, unless you share the task.

Syniray Academy (Pro and Max)

Syniray Academy stores your study sessions, the documents you add (up to 20 documents and 100 MB), your notes, courses and subjects, quizzes, practice and exam results, the record of your mistakes, your study plans and, in language learning, your language profiles and the corrections made to your messages. Most of this content is stored encrypted. Files you export from the Academy are kept for 7 days, after which they can no longer be downloaded. When a question needs the web, the Academy searches through your model's provider or through the search service described below, and our servers may open the result pages to read them, respecting the sites' robots.txt rules.

Syniray Code (Pro and Max)

• Cloud sessions run on our servers. The project's workspace files are stored there until you delete the project or your account, and the commands the agent runs execute in a restricted environment (a sandbox). Pages the agent opens with the Syniray Cloud Browser are loaded from our servers.
• Sessions on your computer run through the Syniray Connector you install. The agent works in the folders you authorise and can use only the permissions you grant; running commands is a separate permission, and a command can reach beyond those folders. What the agent reads or produces in a session, such as parts of files, the output of commands and its messages and actions, is sent to Syniray, stored with the session and, unless you use a local model, sent to the model's provider. If you allow the Syniray Browser on your computer, the live view you watch in the Syniray page, and what you type into it, pass through our servers, which keep only the latest image, temporarily.
• When you browse your computer's files in the Syniray page, the list and the file you open are fetched from your computer at that moment and are not stored by Syniray.
• For each computer you connect, we store the name you give it, its hostname and operating system, the folders and permissions you set, the connector's version, and when and from which IP address it last connected. The connector keeps its access token and a log in the .syniray folder of your home folder; Syniray stores only a hash of the token.
• With a local model, such as one running in Ollama on your computer, model requests stay on your computer; the session's messages and actions are still sent to Syniray and stored with the session, and the first 250 characters of the first message of a new session are still sent to OpenAI to write its title (section 6).
• In sessions on your computer, web searches made by the agent go through Syniray's search service (below).

Syniray Reverse (Pro and Max, beta)

Syniray Reverse analyses software that you own or are allowed to examine. You upload a file (such as an app, a program, a library, firmware or an archive) or give the address of a website and the domains you authorise, and tick the box that confirms you are authorised to examine it. Our servers run the analysis tools in a restricted environment (a sandbox); for a website, a browser on our servers visits only the domains you authorised. The file you upload, the evidence the tools collect, the code and other results they recover, your question and the report are stored on our servers, encrypted, for 30 days after you create the analysis or until you delete it, whichever comes first; the ZIP of a full analysis that you export is kept for 7 days. To write the report, excerpts of the evidence and your question are sent to the provider of the AI model you choose (section 6). If you hand findings over to Syniray Code, the files you select are copied into a Syniray Code project, where they are kept like the rest of that project.

Read aloud

When you use Read aloud, the text of the answer is sent to OpenAI to produce the speech. The voice is chosen from the gender you gave at onboarding. Syniray does not store the audio; your browser may keep it while the page is open.

Image generation (Pro and Max)

Your image prompts and, when you ask to edit an image, the reference image are sent to OpenAI or to Google, depending on the image model selected in Settings › Images. Syniray adds a visible Syniray watermark to generated images, except where adding it fails, and keeps them in your Library.

Voice input

Voice input uses your browser's own speech recognition. Your browser, and depending on the browser its maker's speech service, turns your speech into text; Syniray receives only the text.

Web search and sources

When an answer needs current information, the search query, usually your question, is sent to OpenAI, and to Google when OpenAI does not return a result. Deep Research, Fact Check and Syniray Academy may also use the search of the model's own provider. To show sources, our servers open the pages found to read their title and description, and fetch the sites' icons, from the sites themselves or, failing that, from DuckDuckGo's icon service, which receives only the name of the site. These requests are made by our servers, not by your device.

Shared links

When you share a conversation or a result, anyone with the link can read it, and open the files it contains, without an account, until you stop sharing it or delete it.

9. Payments, subscriptions and credits

Payments are processed by Stripe. When you subscribe or buy credits, the payment details you enter on the payment page (your name and e-mail address, your card or other payment method and, where needed, your postal code) go directly to Stripe through its payment form. Syniray never receives or stores your full card number.

We create a customer record at Stripe with your e-mail address, your Syniray account identifier and, for most countries, your country, which Stripe uses to calculate tax. From Stripe we receive and keep the identifiers of your customer record, subscription and invoices; your plan, billing period, price, currency and status; renewal and cancellation dates; and, for each invoice, the net amount, the tax, the total and the tax location and rate Stripe determined.

We also keep your credit balances, a record of each use of credits (feature, model, tokens and credits charged) and the credit packs you buy. You can see your plan in Settings › Plan & Credits and your use of credits in Settings › Usage.

Stripe also processes payment data as an independent company, under its own privacy policy and legal obligations, for example to prevent fraud.

10. Who receives your data

We share personal data only as described in this Policy:

• AI model providers (OpenAI, Anthropic, Google, DeepSeek, Moonshot AI, Z.AI and xAI): the content each request needs (sections 6 to 8);
• the provider of your own API key, when you use one in Syniray Code: the requests of the sessions that use it;
• Stripe: payments, subscriptions, invoices and tax calculation (section 9);
• Google Firebase Authentication and Google reCAPTCHA: your phone number, to send and check the SMS code, and technical data from your browser and device that reCAPTCHA uses to tell people from automated programs;
• Google and Apple: when you choose to sign in with them; the sign-in page also loads Apple's sign-in script, which gives Apple your IP address;
• Cloudflare: all traffic to and from our websites passes through Cloudflare, which protects and delivers them and therefore processes your IP address and the content of requests;
• Google Analytics: only if you accept it in the cookie panel on syniray.ai — the pages you visit there, a random identifier kept in a cookie, your browser and device type, and the approximate location Google derives from your IP address (Google does not log or store IP addresses in Google Analytics), so that we get statistics on how the website is used (section 16);
• ip-api.com: your IP address when you sign in or create an account, to estimate the city and country shown in Settings › Sessions;
• jsDelivr and cdnjs: services that deliver the code libraries our pages use; they receive your IP address and browser details when your browser loads them (section 16);
• the provider that hosts our servers, which stores and processes data on our behalf;
• anyone with a link you share;
• authorities, courts and professional advisers, when the law requires it, to establish, exercise or defend legal claims, or to protect the safety of people or of the Service;
• a buyer or successor, if Syniray is involved in a merger, acquisition or sale of assets; we will tell you before your data becomes subject to a different privacy policy.

Websites that our servers visit to fetch sources, search results or pages for the Agent, Syniray Academy and Syniray Code receive a request from Syniray, not from your device. DuckDuckGo's icon service receives only the names of the sites cited. If an answer displays an image hosted on another website, your browser loads it from that website, which receives your IP address.

We do not sell your personal data and we do not share it for advertising.

11. International transfers

Syniray, Inc. is established in the United States and has no establishment in the European Union or the United Kingdom. When you use the Service from another country, you give your personal data directly to a company outside that country.

We also send personal data to the recipients described in section 10, several of which are established outside the European Economic Area and the United Kingdom: OpenAI, Anthropic, Google, xAI, Stripe and Cloudflare in the United States, and DeepSeek, Moonshot AI and Z.AI in China. They may process data in those countries or in others where they operate. The other recipients in section 10 may also be located outside the EEA and the United Kingdom. The laws of those countries may not protect personal data in the same way as the law of your country. The European Commission has not recognised China as providing an adequate level of protection; for the United States, its adequacy decision covers only organisations certified under the EU-U.S. Data Privacy Framework.

To find out what protects the transfer of your data to a particular recipient, and to obtain a copy of the relevant safeguard where one is in place, write to [email protected].

12. How long we keep data

We keep personal data for as long as we need it for the purposes in this Policy. In practice:

• Account and profile: until you delete your account.
• Chat conversations (Pro and Max): until you delete them, clear them in Settings › History or delete your account. On the Free plan your chat history is kept only in your browser; our servers keep a temporary copy of each answer for up to one hour, so that it can be recovered if the page reloads.
• Library files, and the images and files created for you in the Chat: until you delete them in the Library or delete your account; a file created by the Agent is deleted when you delete its Agent task or your account.
• Deep Research, Fact Check, documents and Agent tasks: until you delete them or your account; the files the Agent creates are deleted with the task.
• Chat memories and custom instructions: until you delete them or your account.
• Credit balances and the record of credit use: until you delete your account.
• Syniray Academy: until you delete the content or your account. Difficulties and known topics saved in Academic memory expire after 180 days unless you keep them (muted topics stay until you remove them), the record of changes to your Academic memory is kept for 180 days, and exported files are kept for 7 days.
• Syniray Code: sessions until you delete them; projects and their workspace files until you delete the project; API keys until you delete them; connected computers until you remove them, except that a computer that has run sessions stays recorded, hidden, with the history of those sessions. All of this is deleted when you delete your account. The record of the credits each Code request used is kept for billing, also after a session, a project or your account is deleted.
• Syniray Reverse: the file you upload, the results of the analysis and its report for 30 days after you create the analysis, or until you delete them or your account if that comes first; the ZIP of a full analysis that you export for 7 days. The record of the credits an analysis used is kept for billing, also after the analysis or your account is deleted.
• Shared links: until you stop sharing or delete the item.
• Sign-in history: the last 20 sign-ins of your account.
• Sign-in sessions: until you sign out, end them in Settings › Sessions or do not use them for 30 days.
• Invoices and tax records: for as long as tax and accounting rules require; they are kept after an account is deleted.
• Support requests: the requests you make on Help Syniray (help.syniray.ai), with their messages and attachments, until you delete your account; deleting an account also deletes the requests made without an account from the same e-mail address. A request made by someone who has no account is kept until they ask us to delete it. E-mails you send to our addresses are kept in our mailboxes; they are not deleted automatically, and you can ask us to delete them.
• Backups: every day we copy our databases to encrypted backups, which we keep for 30 days. What you delete remains in the backups until they expire; we use them only to test that they can be restored and, after a failure, to restore the Service.
• Server logs: the logs of our websites, applications and databases, which record IP addresses, the pages requested and errors (some of which include the e-mail address of the account concerned), are deleted automatically 30 days after they are written. The logs of the server's operating system and of its mail server (for example, the record of e-mail deliveries) are kept for up to 90 days.
• Temporary data used while a request runs, such as the stream of an answer or a paused Deep Research run, is deleted automatically after periods that range from a few minutes to 7 days.

When you delete your account

Deleting your account in Settings › Account cancels any active subscription immediately and deletes your data from our database and from our servers: your profile, conversations, memories and instructions; Deep Research, Fact Check, document and Agent records, and the files the Agent created; Projects; the files in your Library and the files and images created for you; Syniray Academy data, documents and exported files; Syniray Code projects, their workspace files, keys and computers; Syniray Reverse analyses, with the files and results they hold; your support requests, with their attachments; and your credit balances and your record of credit use. The files are removed from our servers within minutes. Some data remains:

• invoices, tax records, records of refunds and credit notes, and records of subscription cancellations, which we keep for legal reasons;
• the accounting records of each request that used credits — the feature and the model, the tokens processed and the credits charged — kept in Syniray Code, in Syniray Reverse and in our log of requests to providers, which we keep for billing and accounting; they contain none of your messages or files, only the number of your former account;
• the customer record and payment history kept in our account at Stripe, and Stripe's own records;
• the log of the actions our staff took on support requests, which says who did what to which request but never what a message said;
• the e-mails you sent to our addresses, which stay in our mailboxes;
• backups and server logs, for the periods given above.

To have removed anything in this list that the law does not require us to keep (for example, the e-mails you sent us), write to [email protected] from your account's e-mail address and we will delete it.

Data that AI providers received to answer your requests is kept by them under their own rules (section 6).

Google Analytics keeps the measurements linked to the identifier in its cookie for 2 months, the setting we chose; the aggregate statistics built from them do not identify you.

13. Your rights and how to exercise them

Depending on where you live, you may have the right to access your personal data and obtain a copy, to correct it, to have it deleted, to restrict or object to its processing, to receive the data you gave us in a portable format, to withdraw your consent and to complain to a data protection authority. We offer these rights to every user, wherever they live, as far as we are able to.

What you can do yourself

• See and correct your name, the name Syniray uses for you, your profile picture and your job role in Settings › Profile, and your instructions in Settings › Personalization.
• Download your profile, conversations, Deep Research, Fact Check, documents and Agent tasks as a JSON file in Settings › Export (Pro and Max); download your files from the Library, the ZIP of a full analysis from Syniray Reverse and your Academic memory in Settings › Academy.
• Delete conversations and other items one by one, clear them by type in Settings › History (Pro and Max), delete memories in Settings › Memory (Pro and Max), delete files in the Library and your data in Syniray Academy, Syniray Reverse and Syniray Code, and delete your account in Settings › Account.
• See and end your sign-in sessions in Settings › Sessions.
• Withdraw consent by switching Academic memory off in Settings › Academy.
• On the Free plan your chat history is stored in your browser: you can delete conversations in the Chat, or clear your browser's data for syniray.ai.

Requests by e-mail

For anything else, write to [email protected]: for example, to obtain data the export does not include, to correct your e-mail address, phone number, country, date of birth, username or gender, to delete data that account deletion does not remove, or to object to or restrict a use of your data. Please write from the e-mail address of your Syniray account so that we can confirm the request is yours; if we cannot, we may ask you for more information. Where the law allows, you can also act through a representative. We will answer within the period the law sets (under the GDPR and the UK GDPR, one month, which can be extended by two further months for complex requests). We do not charge for these requests, and exercising your rights will not lead to any less favourable treatment.

Complaints

If you disagree with how we handle your data, you can write to [email protected] and we will try to resolve it. Whether or not you have contacted us, you also have the right to complain to a data protection authority, in particular in the country where you live or work: in Portugal, the Comissão Nacional de Proteção de Dados (https://www.cnpd.pt); in the United Kingdom, the Information Commissioner's Office (https://ico.org.uk). The European Data Protection Board lists the authorities of every EU country at https://www.edpb.europa.eu.

14. Security

We use technical and organisational measures appropriate to the Service, including:

• connections between your browser and our websites use HTTPS;
• passwords are stored only as one-way hashes, and the sign-in cookie cannot be read by page scripts and is sent only over secure connections;
• repeated failed sign-ins are temporarily blocked, the number of new accounts per IP address is limited, and registrations with disposable e-mail addresses are refused;
• the application encrypts certain data before storing it: the content of Chat messages, Deep Research reports and generated documents, most Syniray Academy content, Syniray Code session records, the files, results and reports of Syniray Reverse analyses, and the API keys you connect, which are protected with a separate key;
• files are served only to their signed-in owner, or through a link the owner has shared;
• in Syniray Code, commands in Cloud sessions run in a restricted environment (a sandbox), and on your computer the agent can use only the permissions you grant to the Syniray Connector;
• our administration panel shows account, billing, usage and support information and does not display the content of your conversations.

Other data is stored without that additional application encryption, for example conversation titles, Chat memories and custom instructions, Fact Check texts, Deep Research questions and sources, Agent tasks, uploaded and generated files, Syniray Code workspace files, support requests, e-mails and sign-in history.

No system is completely secure, and we cannot guarantee the security of your data. Syniray does not currently offer two-step verification, so use a strong password that you do not use anywhere else, and end any session you do not recognise in Settings › Sessions. If a personal data breach affects your data, we will notify you and the competent authorities where the law requires it.

15. Minimum age and children

Syniray is not intended for anyone under 16. You must be at least 16 years old to create an account and to use the Service, including Syniray Academy. Onboarding asks for your date of birth and does not let you continue if you are under 16.

We do not knowingly collect personal data from anyone under 16. If we learn that an account belongs to someone under 16, we will close it and delete its personal data, except what the law requires us to keep. If you believe that a child has given us personal data, write to [email protected].

16. Cookies and similar technologies

We use cookies and similar technologies, such as the browser's local storage, in three categories:

• strictly necessary: keeping you signed in; protecting our sites and payments, including Cloudflare's security cookies and, on the payment pages, Stripe's; the SMS verification of your phone number with Google Firebase and reCAPTCHA; on the Free plan, keeping your chat history in your browser; and remembering your answer to the cookie panel;
• preferences: your language, theme and interface choices, such as the last model you used;
• analytics: Google Analytics on syniray.ai, only if you accept it in the cookie panel. Until then it is not loaded, sets no cookie and sends nothing to Google. You can withdraw your consent at any time under “Cookie preferences”; a Global Privacy Control signal is treated as a refusal.

We do not use advertising or tracking cookies. checkout.syniray.ai uses nothing that depends on your consent. The two typefaces our pages use are served by Syniray itself; our pages do not load them from Google Fonts.

The full list, with the purpose and duration of each item, is in our Cookie Policy: https://syniray.ai/hub/legal/cookie-policy/

17. Automated processing and AI transparency

Syniray uses automated processing to provide the Service: AI models generate answers, summaries, images, speech and code, and automatic steps decide how a request is handled, for example whether it needs a web search, an image or a file, which model answers in Best Mode and, in Syniray Academy, how quizzes are graded and what to study next.

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or affect you in a similarly significant way. Some changes to an account follow automatically from your plan and your payments, such as usage limits, credit charges or the move to the Free plan when Stripe reports that a subscription payment failed. They apply the rules in our Terms of Service (https://syniray.ai/hub/legal/terms-of-services/) and involve no assessment of you as a person. If you think one of them is wrong, write to [email protected].

AI transparency

When you use Syniray, you are interacting with AI systems, not with a person. Every answer is generated by an AI model; the model in use is shown in the model selector and under the answers of the Chat, Syniray Academy and Syniray Code. Images generated through Syniray normally carry a visible Syniray watermark (section 8), and Read aloud uses a synthetic voice. AI output can be inaccurate or incomplete and is not professional advice: check it before you rely on it, especially for important decisions.

18. Notices for United States residents

California

In line with the California Online Privacy Protection Act, this Policy describes the categories of personal information we collect (section 3) and the categories of third parties we share it with (section 10), how you can review and correct your information (section 13) and how we tell you about changes (section 19); its effective date is shown at the top of the page.

Do Not Track. Syniray does not track you across other websites over time and does not use advertising services. With your consent, syniray.ai uses Google Analytics to measure how the website itself is used (section 16). We treat a Global Privacy Control signal as a refusal of that analytics, so Google Analytics is not loaded unless you accept it yourself in the cookie panel; we do not respond differently to a Do Not Track signal. Third-party services our pages load (Google for sign-in, phone verification and reCAPTCHA; Apple for sign-in; Stripe on the payment pages; Cloudflare, jsDelivr and cdnjs) receive technical data such as your IP address when your browser contacts them, and handle it under their own policies; we do not control whether they combine it with what they collect elsewhere.

State privacy laws

Syniray does not sell personal information, does not share it for cross-context behavioural advertising and has no actual knowledge of selling or sharing personal information of consumers under 16. We use sensitive personal information, such as your account credentials or health information you choose to include in your content, only to provide the Service and keep it secure. We consider that, at its current size and with its current activities, Syniray does not meet the thresholds that make a company subject to the California Consumer Privacy Act; we will update this Policy if that changes. Whatever state you live in, you can exercise the rights described in section 13, and doing so will not lead to any less favourable treatment.

If a data breach affects your personal information, we will notify you as the law of your state requires.

19. Changes to this Policy

We update this Policy when the Service or the law changes, and the date of the last update is shown at the top of the page. If we make a material change, for example a new category of data, a new type of recipient or a new purpose, we will tell you before it takes effect, by e-mail to your account's address or with a notice in the Service. We will not start using data you have already given us for a materially different purpose without telling you first and, where the law requires it, asking for your consent; in particular, we will not use your content to train AI models without your consent.

This Policy is written in English and European Portuguese and translated into the other interface languages; where a translation and the English text differ, the English text prevails.

20. Affiliate program

If you join the Syniray affiliate program, we keep your application (your code, where you said you would share Syniray, your country and the date you accepted the program terms), your payment details — stored encrypted — and your tax status, to pay your commissions. Our accountant may ask you for further tax information before a payment.

When someone opens an affiliate link, we record the click with a keyed, one-way hash of the visitor's IP address, to count one click per visitor and day; the hash is erased after 30 days. Nothing is stored in the visitor's browser. If that person creates an account from the invitation, the account is linked to the affiliate, who sees only an anonymous reference (R-…), the dates, and the plan and amount of the first payment — never the person's name or e-mail address.

Commissions and payments are accounting records: they are kept after an account is deleted, like the other financial records (section 12).

21. Contact

For questions about this Policy or about your personal data, and to exercise your rights:

• Privacy: [email protected]
• Legal notices: [email protected]
• Account, plan and payments: [email protected]
• Post: Syniray, Inc., 447 Sutter St, Ste 506 - 1201, San Francisco, CA 94108, United States