Last updated:
Privacy policy
Synaro creates monthly social media content for your business and publishes it once you approve it. This page explains what data we keep, why, who processes it and for how long. Synaro is a service of iSyntro Technologies. Legal entity: [LEGAL ENTITY — to be completed], registration number [REGISTRATION NUMBER — to be completed], [REGISTERED ADDRESS — to be completed]. Contact: [CONTACT EMAIL — to be completed].
What we keep
- Account: name, email, team role, interface language and time zone. Passwords are stored only as a hash. Platform administrators also have an encrypted two-factor secret.
- Business and brand: business name, questionnaire answers, colours, fonts, logo, products and the files you upload.
- Social connections: for Meta (Facebook Pages and Instagram professional accounts), TikTok and LinkedIn we store the account identifier and name, the names of the permissions you granted, when access expires, and access tokens encrypted at rest (AES-256). We also read performance data for posts you published through us (for example reach, saves and shares).
- Ads (if you use the campaigns add-on): the ad account identifier, name, currency, time zone and spending cap, the campaigns you create, and their daily delivery metrics from Meta. The ad account token is stored encrypted.
- Generated content: content plans, briefs, captions, images, videos, approval and revision history, schedules, publishing results and post links.
- Usage and billing: credits, the AI cost of each generation, your plan and subscription status, the customer and subscription identifiers at the payment processor, and invoice details (name, email and amount). Card numbers never reach us.
- Referral: if you arrived through a partner link, the partner code.
- Logs: technical logs with identifiers, timings and error codes. Tokens, message contents and URL query strings are removed before logging. An activity log in the app (who changed what, and when) is kept for security and support.
Why we use it
To run the service: planning and creating content, showing it to you for approval, publishing what you approve and running the campaigns you set up. Also for billing, account security, support and service emails. You can turn notifications off in Settings.
We do not sell data, we do not build advertising profiles from it, and we use no tracking or analytics cookies.
AI providers receive only what a generation needs: the brief, the relevant brand details and the reference files you chose.
Who processes it for us
- AI content generation: Anthropic (text, planning and quality checks), Google (Gemini for image generation, editing and image descriptions), OpenAI (images), fal (Kling video models), PhotoRoom (background removal and product scenes), Higgsfield (images and video).
- File storage: Cloudflare R2. Private files are reachable only through signed, time-limited links. Files for publishing sit in a public bucket because the social networks download them from there.
- Database: Neon (PostgreSQL).
- Email: Resend (address verification, password reset, team invitations and notifications).
- Error reporting: Sentry (technical error messages, without tokens or message content).
- Payments: Stripe. Card details stay with Stripe; we never receive them.
- Invoicing: Morning (name, email, amount and description of the charge).
- Social platforms: Meta (Facebook, Instagram and ads), TikTok and LinkedIn, only for the accounts you connect and only for the actions you approve.
How long we keep it
- Data stays as long as the workspace is active.
- Deleting a workspace (owners only, in account settings) immediately revokes the social and ad account access and signs everyone out. After a 14-day grace period, during which the owner can restore it by signing in with their password, the business content, files, connections and users are deleted.
- After deletion we keep only minimal billing and deletion records (identifiers, times, statuses and payment receipts), with no content and no contact details.
- Database backups are kept for 30 days and then deleted automatically.
- Posts that were already published stay on the social network until you delete them there.
Your rights and how to use them
- See and correct: you can view and edit your account and business details in the app.
- Delete: Settings → Account → delete the workspace. A user who is not the owner can only close their own account.
- Disconnect a network: see the Meta section below. For TikTok and LinkedIn, remove access in that network's connected-apps settings.
- Ask for a copy, or anything else: write to [CONTACT EMAIL — to be completed]. We answer once we have checked that the request comes from the account holder.
Meta: disconnecting and deleting data
The app has no button to disconnect a single connection yet. To disconnect Meta: Facebook → Settings & privacy → Settings → Business integrations → select the app → Remove. Meta tells us, and we then mark the connections as disconnected, delete the stored user token and notify the business admins.
On the same screen you can also ask the app to delete your data. We then delete the connection records and their tokens, the performance data we received from Meta and the ad account tokens. We return a confirmation code whose status you can check on the data deletion page.
Cookies
- A sign-in (session) cookie, so you stay signed in.
- Short-lived cookies (10 minutes) while you connect Meta, TikTok or LinkedIn, to secure the connection flow.
- A referral cookie, only if you arrived through a partner link, for that partner's attribution period.
- No analytics, advertising or tracking cookies.
Security
The site is served over HTTPS, social and ad access tokens are stored encrypted, and each user sees only what their role allows. No system is perfectly secure; if an incident affects your data, we will tell you.
Changes and contact
When we update this policy we change the date at the top of the page. We announce meaningful changes in the app.
Questions and requests: [CONTACT EMAIL — to be completed].