Privacy Policy

Syncs Digital Inc. ("SyncWork," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Services").

By using our Services, you consent to the data practices described in this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

2.1 Information You Provide

• Account Information: Name, email address, password, organization name, billing address
• Profile Information: Profile picture, job title, department, phone number
• Content: Documents, files, messages, and other content you upload or create
• Communications: Emails and support requests you send to us
• Payment Information: Credit card details and billing information (processed securely by Stripe)

2.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, time spent, click patterns
• Log Data: Access times, error logs, referral URLs
• Cookies: Session cookies, preference cookies, and analytics cookies

2.3 Information from Third Parties

• OAuth Providers: Profile information from Google, Microsoft, or Apple when you sign in using these services
• Integration Partners: Data from third-party services you connect to SyncWork
• Business Partners: Information from referral partners or resellers

We use the information we collect to:

• Provide, maintain, and improve our Services
• Process transactions and send related information
• Send technical notices, updates, security alerts, and support messages
• Respond to your comments, questions, and customer service requests
• Communicate about products, services, offers, and events
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and abuse
• Personalize and improve your experience
• Power AI features such as OCR, document summarization, and semantic search

We do not sell your personal information. We may share your information in the following circumstances:

4.1 With Your Consent

We share information when you give us explicit permission to do so.

4.2 With Service Providers

We work with third-party service providers who need access to your information to provide services to us, including cloud infrastructure and hosting, managed database, email delivery, and AI processing. A current list of our sub-processors — including the data they process and where it is located — is published on our Sub-processors page.

4.3 Within Your Organization

Information and content may be shared with other members of your organization as part of normal platform functionality.

4.4 For Legal Reasons

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of SyncWork, our users, or others.

4.5 Business Transfers

If SyncWork is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We implement robust security measures to protect your data:

• Encryption: All data is encrypted at rest (AES-256) and in transit (TLS 1.2+)
• Multi-Tenant Isolation: Your data is logically isolated from other organizations
• Access Controls: Role-based access controls and audit logging
• Security Audits: Ongoing security assessments, including continuous automated security review of every code change
• Infrastructure: Hosted on enterprise-grade cloud infrastructure with redundant, geographically distributed hosting

We retain your information for as long as your account is active or as needed to provide Services. When you delete your account:

• Personal information is deleted within 30 days
• Content is deleted within 30 days unless required for legal compliance
• Anonymized usage data may be retained for analytics purposes
• Backup copies are purged within 90 days

Depending on your location, you may have the following rights:

7.1 Access and Portability

You can access your personal information and export your data at any time through your account settings.

7.2 Correction

You can update or correct your personal information through your account settings or by contacting us.

7.3 Deletion

You can request deletion of your personal information by deleting your account or contacting us.

7.4 Opt-Out

You can opt out of marketing communications at any time by clicking "unsubscribe" in our emails or updating your notification preferences.

7.5 Cookie Preferences

You can manage cookie preferences through your browser settings. We use strictly necessary cookies by default; optional cookies (analytics, functional) require your consent and can be managed via our cookie preferences tool accessible from the footer of any page.

Syncs Digital Inc. is headquartered in Vancouver, British Columbia, Canada. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and British Columbia's Personal Information Protection Act (PIPA, SBC 2003, c. 63). Under these laws, you have the right to:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Withdraw Consent: Withdraw your consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada (OPC) or the BC Office of the Information and Privacy Commissioner (OIPC)

To exercise these rights, contact our Privacy Officer at privacy@syncwork.space. We will respond within 30 days as required by law.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent local laws:

9.1 Legal Bases for Processing (Art. 6 GDPR)

• Contract Performance (Art. 6(1)(b)): To provide the Services you requested (account management, service delivery, billing)
• Consent (Art. 6(1)(a)): For marketing communications, optional analytics cookies, and AI training opt-in programs. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal
• Legitimate Interests (Art. 6(1)(f)): For fraud prevention, security, product improvement, and internal analytics. We balance our interests against your rights and freedoms
• Legal Obligation (Art. 6(1)(c)): For tax, accounting, and regulatory compliance

9.2 Your GDPR Rights

• Right of Access (Art. 15): Obtain a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate personal data
• Right to Erasure (Art. 17): Request deletion of your personal data
• Right to Restriction (Art. 18): Restrict processing of your personal data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent at any time without affecting lawfulness of prior processing
• Right to Lodge a Complaint: File a complaint with your local data protection authority (supervisory authority)

9.3 Automated Decision-Making (Art. 22)

Our AI features assist with document processing, categorization, and recommendations, but do not make decisions that produce legal or similarly significant effects about you without human review. You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you.

9.4 Data Protection Officer

You can contact our Data Protection Officer at dpo@syncwork.space.

SyncWork is based in Canada. Your data is processed in the United States and in Germany (European Union), where our hosting providers operate. We implement appropriate safeguards for cross-border data transfers:

• Canada: The European Commission has recognized Canada (for PIPEDA-covered organizations) as providing adequate data protection under Art. 45 GDPR
• Standard Contractual Clauses (SCCs): For transfers to sub-processors in countries without an adequacy decision (e.g., the United States), we use EU Commission-approved Standard Contractual Clauses (Module 2: Controller-to-Processor) per Commission Implementing Decision (EU) 2021/914
• Transfer Impact Assessments: We conduct transfer impact assessments and implement supplementary measures where necessary
• PIPEDA Cross-Border Safeguards: Under PIPEDA Principle 4.1.3, we use contractual obligations to ensure a comparable level of protection for personal information transferred to third-party service providers

For details on our sub-processors and their locations, see our List of Sub-processors.

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request details about the categories and specific pieces of personal information we collect, use, disclose, and sell
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate personal information we hold about you
• Right to Limit: You may limit the use and disclosure of sensitive personal information to purposes necessary to provide the Services
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
• Do Not Sell or Share: We do not sell or share personal information as defined by the CCPA/CPRA

To exercise your rights, contact us at privacy@syncwork.space. We will verify your identity before processing your request.

We use cookies and similar technologies for the following purposes:

You can manage non-essential cookie preferences via our cookie preferences tool in the footer, or through your browser settings. For more details, see our Cookie Policy.

In the event of a data breach involving your personal information:

• PIPEDA (Canada): We will report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, as required by PIPEDA's mandatory breach reporting provisions (s. 10.1)
• GDPR (EEA): We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (Art. 33) and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34)
• CCPA/CPRA (California): We will notify affected California residents in accordance with California Civil Code § 1798.82

Our Services are not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Our Services use AI and machine learning for features like:

• Optical Character Recognition (OCR) for document processing
• Natural language processing for search and summarization
• Smart categorization and tagging of documents
• Predictive analytics and recommendations

Important: Your content is not used to train our AI models unless you explicitly opt-in to training programs. AI processing is performed securely and your data is not shared with AI providers for their own purposes.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on our website at least 30 days before the changes take effect. We encourage you to review this Privacy Policy periodically.

This Privacy Policy is governed by and construed in accordance with the laws of the Province of British Columbia and the federal laws of Canada applicable therein, without regard to conflict of law principles. This does not affect any rights you may have under mandatory data protection laws in your jurisdiction (such as the GDPR).

If you have questions about this Privacy Policy or our data practices, please contact our Data Protection Officer: