Privacy Policy — Synaplux

1. Overview

Synaplux Technologies Private Limited ("Synaplux," "we," "us," or "our") operates the Synaplux AI platform available at synaplux.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

By accessing or using Synaplux, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use our services.

This policy applies to all users of the Synaplux platform, including visitors to our website, registered free users, paid subscribers, and enterprise clients.

2. Data We Collect

We collect the following categories of information to provide and improve our services:

Category	Examples	Purpose
Account Data	Name, email, password (hashed)	Authentication & communication
Usage Data	Features used, prompts created, session duration	Platform improvement
Content Data	Prompts, Python scripts, templates you create	Service delivery
Device Data	IP address, browser type, OS, screen resolution	Security & analytics
Payment Data	Billing address, last 4 digits (card stored by Stripe)	Subscription management
Communication Data	Support tickets, emails, chat messages	Customer support

We do not collect sensitive personal information such as government IDs, health data, biometrics, or racial/ethnic origin unless you voluntarily provide it in content you create on our platform.

3. How We Use Your Data

We use collected data for the following purposes:

Service Delivery: To authenticate you, process your prompts, run Python scripts, and provide all platform features.
Account Management: To manage your subscription, send billing receipts, and notify you of plan changes.
Platform Improvement: To analyze aggregated usage patterns and improve features, fix bugs, and develop new capabilities. We use anonymized data only for this purpose.
Customer Support: To respond to your support requests, troubleshoot issues, and provide onboarding assistance.
Security: To detect, investigate, and prevent fraudulent transactions, abuse, and other illegal activities.
Communications: To send you product updates, newsletters (with your consent), and important service announcements.
Legal Compliance: To comply with applicable laws, regulations, and legal processes.

We do not use your prompt content or Python scripts to train our AI models without your explicit, opt-in consent.

4. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

Service Providers: Trusted third parties who help us operate our platform — including Anthropic (AI inference), AWS (cloud infrastructure), Stripe (payments), and Postmark (email). These providers are contractually bound to protect your data.
Team Members: If you are on a team plan, workspace administrators can see your name, email, usage statistics, and prompts created within the shared workspace.
Legal Requirements: If required by law, court order, or governmental authority, we may disclose data after verifying the legal basis and notifying you where permitted.
Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred. We will notify you before any transfer occurs.
With Your Consent: For any other purpose, only with your explicit written consent.

5. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. You can control cookie settings through your browser preferences.

Essential Cookies: Required for authentication, session management, and basic platform functionality. Cannot be disabled.
Analytics Cookies: Used via privacy-friendly analytics (we use Plausible Analytics, which is cookie-free and GDPR compliant). No cross-site tracking.
Preference Cookies: Store your UI preferences (theme, language, layout) for a personalized experience.

We do not use advertising or retargeting cookies. We do not participate in cross-site behavioral advertising networks.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Specifically:

Account Data: Retained for the duration of your account plus 30 days after deletion.
Prompt & Script Content: Retained for the duration of your account. After deletion, removed within 30 days from active systems and 90 days from backups.
Payment Records: Retained for 7 years as required by Indian financial regulations.
Support Tickets: Retained for 3 years for quality assurance purposes.
Server Logs: Retained for 90 days for security analysis, then deleted.

7. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

Right to Access: Request a copy of all personal data we hold about you.
Right to Rectification: Correct inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data ("right to be forgotten").
Right to Portability: Export your data in a machine-readable format (JSON or CSV).
Right to Object: Object to processing based on legitimate interests.
Right to Restrict Processing: Request that we limit how we process your data.
Right to Withdraw Consent: Withdraw consent for optional data processing at any time.

To exercise any of these rights, email us at privacy@synaplux.com or use the Data Controls panel in your account Settings. We respond to all requests within 30 days.

8. Security

We implement industry-standard security measures to protect your data, including:

AES-256 encryption for data at rest; TLS 1.3 for data in transit
Sandboxed Python execution environments with no network egress by default
SOC 2 Type II audited infrastructure (AWS)
Regular penetration testing and vulnerability assessments
Multi-factor authentication options for all accounts
Role-based access control for all internal staff

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it responsibly to security@synaplux.com.

9. Children's Privacy

Synaplux is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will delete it immediately. If you believe we have inadvertently collected such data, please contact us at privacy@synaplux.com.

10. International Data Transfers

Synaplux is headquartered in India. Your data may be processed and stored in data centers located in India, the United States, and the European Union (AWS regions). For transfers to jurisdictions without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission.

If you are located in the European Economic Area (EEA), UK, or Switzerland, additional protections under GDPR / UK GDPR apply to your data processing.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email (at the address associated with your account) and by posting a prominent notice on our website at least 14 days before the changes take effect.

We encourage you to review this policy periodically. The "Last Updated" date at the top of this page indicates when this policy was most recently revised.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

Email: privacy@synaplux.com
Postal Address: Synaplux Technologies Pvt. Ltd., 14th Floor, Navi Mumbai, Maharashtra — 400703, India
Response Time: Within 5 business days for general inquiries; within 30 days for formal data subject requests.

If you are in the EEA and believe we have not addressed your concern adequately, you have the right to lodge a complaint with your local data protection authority.