Privacy Policy

This policy explains how Syncy ("we", "us") handles personal data in Syncy, an appointment reminder service for businesses of any kind.

1. Our two roles

Each business decides why and how its customers' data is used, so the business is the controller. We process that data only on the business's instructions, as its processor, under our Data Processing Agreement. If you received a reminder from a business, contact that business to see, correct or delete your data; we help the business answer.

We are the controller for the data of the business staff who use Syncy and for the website, as described below.

2. Data we process

• Customer names and mobile phone numbers, and optional email, address and notes added by business staff
• Appointment times and the event titles read from the business's Google Calendar
• Reminder records: when an SMS was sent, its status, and the customer's confirm or cancel answer

• Name, email address and role (admin or manager) at each business
• The admin app language each person picked
• An activity log of downloads, imports and deletions of customer data, and of support actions
• The email address of the Google account a business connects

Standard server logs (time, request, technical errors), kept for 30 days. No analytics or advertising cookies: see section 8.

When you sign in with Google, we receive your name and email address. When you connect a Google Calendar, Syncy uses that access only to send appointment reminders:

• It lists the calendars in your Google account, so you can choose which one Syncy uses. Syncy can open only calendars it created itself.
• It reads the events in the chosen calendar to schedule reminders, and writes the reminder status (sent, confirmed, cancelled) back to each event.
• It asks Google to notify it when that calendar changes.

We do not use Google user data for advertising, sell it, or use it to train AI models. No person reads it except to give support you asked for, for security, or where the law requires it. Syncy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Why we process it (legal bases)

• Customer data: the business's own legal basis as controller; we act on its instructions (Art. 28 GDPR).
• Staff accounts: performance of our contract with the business (Art. 6(1)(b)) and our legitimate interest in running a secure service (Art. 6(1)(f)).
• Activity log and security logs: our legitimate interest in security and accountability (Art. 6(1)(f)), and legal obligations (Art. 6(1)(c)).

Appointment reminders are service messages about a booked appointment. They are never used for marketing.

4. Sub-processors

We use these providers to run Syncy. We give businesses 30 days' notice before adding or replacing one.

We do not sell personal data or share it for advertising.

5. International transfers

Our database and servers are in the EU (Paris). Where a provider above handles data outside the EU, the transfer is covered by the safeguard listed for it.

6. How long we keep data

• Appointments, reminder records and customers: until the business deletes them, or automatically after the retention period the business sets. Syncy reads at most 90 days of past appointments from a calendar.
• Activity log of customer data downloads, imports and deletions, and of support actions: 730 days.
• Server logs: 30 days.
• Database backups: 35 days (180 days for businesses still on our previous platform, until they move).
• When a business leaves, its data is deleted; copies in backups expire within 35 days.

7. Security

• Encryption in transit (HTTPS with HSTS) and at rest; Google Calendar access tokens are encrypted again in our database
• Staff sign in with their Google accounts; Syncy stores no passwords
• Each business's data is separated from every other business's, and only admins can export or import the customer list
• Logs record identifiers and statuses, not names or phone numbers
• Daily database backups

If a breach affects a business's data, we tell the business within 24 hours of becoming aware of it.

8. Cookies and browser storage

We use only what is needed for the service to work: short-lived cookies while a business connects its Google Calendar, and the sign-in session in your browser's storage. We use no analytics or advertising cookies, so we ask for no cookie consent.

9. Your rights

You can ask for access to, correction or deletion of your data, ask us to restrict or stop processing it, receive it in a portable format, and object to processing based on legitimate interest.

• Customers of a business: contact that business. Its staff can download or delete a customer's data in Syncy.
• Business staff and website visitors: email info@syn.cy.

You can complain to the data protection authority of the EU country where you live or work, or where you think your data was misused (Art. 77 GDPR). For example:

• Commissioner for Personal Data Protection (Cyprus): https://www.dataprotection.gov.cy
• Hellenic Data Protection Authority (HDPA): https://www.dpa.gr

10. Changes

We publish every change here with a new version number. Business admins are asked to accept material changes in the app.