Privacy Policy
Synkra takes privacy seriously. This policy explains what personal data we collect, why, how long we keep it and who we share it with. It is written under the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: SYNKRA AI CONSULTING, S.L.
- Tax ID: B05668850
- Address: C/ Itàlia, 1-3, 1º 4ª, 08320 El Masnou (Barcelona), Spain
- Privacy contact email: legal@synkra.org
2. What data we collect
We only collect the data needed to run the site and, if you accept them, visit statistics:
- Contact form: your email address.
- Submission data: selected language, the page and button you wrote from, and the time of submission. To limit the number of submissions and prevent abuse, our hosting provider (Vercel) counts form requests from each IP address in 10-minute windows; we neither use nor store it. We also limit daily submissions from the same email using the enquiries we already hold.
- Our CRM: your email, language and the page and button you wrote from are also stored in our internal CRM (app.synkra.org), where we handle the reply to your enquiry.
- If you email us (at sales@synkra.org or legal@synkra.org): your address, the message and any data you include in it.
- If you message us on WhatsApp: your phone number, your profile name and the messages you send us.
- Visit statistics (only if you accept them): aggregated Vercel Web Analytics data about the pages visited: the page and the referring page, approximate location, operating system, browser and device type. It uses no cookies and cannot identify you. More detail in the Cookies Policy.
- Technical error logs: if something fails on the server (for example, when sending the form), we record which step failed and the error, without your email or IP.
- Admin panel access (authorized staff only): email and minimal session data managed by Supabase Auth.
- Browser preferences: dark/light theme and locale, stored locally on your device.
We do not collect special-category data (health, ideology, etc.), use advertising cookies or perform profiling.
3. Processing purposes
- Reply to enquiries submitted via the form, by email or on WhatsApp.
- Maintain service security and integrity.
- Manage authorized staff access to the internal admin panel.
- Detect and fix technical failures on the site.
- If you accept it, understand in aggregate how the site is used, to improve it.
4. Legal basis
- Explicit consent (Art. 6(1)(a) GDPR) and/or pre-contractual measures at the data subject's request (Art. 6(1)(b)), when submitting the form.
- Legitimate interest (Art. 6(1)(f)) to prevent fraud, maintain site security and detect technical failures.
- Consent (Art. 6(1)(a) GDPR and Art. 22.2 of the Spanish LSSI-CE) for visit statistics. You can withdraw it at any time from the Cookies Policy.
5. Data retention
- Form and email enquiries: up to 24 months from the last contact. Deleted afterwards unless a legal retention obligation or active commercial relationship applies. The copies of the enquiry in our mailbox and in our CRM are deleted on the same basis.
- Submission limit: Vercel counts the requests from each IP in 10-minute windows. We do not store the IP.
- Technical error logs: Sentry keeps them for 30 or 90 days, depending on the plan.
- Visit statistics: the identifier Vercel Web Analytics uses to count visitors is discarded after 24 hours. Visit data can be viewed for the reporting window of our Vercel plan (currently 1 month); Vercel states it may keep it longer so it isn't lost if the plan changes.
- Admin sessions: until sign-out; the access cookie expires after 400 days if it is not renewed.
6. Data processors
To provide the service we rely on technology providers that act as data processors. They only process data on our instructions and with safeguards equivalent to those of the GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Vercel, Inc. | Hosting and delivery of the site, and running the form (it receives your email and passes it to the other providers). Per-IP submission limit. Visit statistics, if you accept them. | EU (server in Stockholm, Sweden) and global delivery network / USA (SCCs) |
| Supabase, Inc. | Database of form enquiries (email, language, source and date) and admin panel access. | EU (Stockholm, Sweden) / USA (SCCs) |
| Vercel, Inc. and Supabase, Inc. (our CRM, app.synkra.org) | Hosting and database of the internal CRM where we handle your enquiry. | EU (Frankfurt, Germany) / USA (SCCs) |
| Resend, Inc. | Sends our mailbox the notice of each enquiry: your email, language, source page and button, and time. | EU (sent from Ireland) / USA (SCCs) |
| Proton AG | Mailbox where we receive form notices and the emails you send us. | Switzerland (European Commission adequacy decision) |
| Functional Software, Inc. (Sentry) | Server error tracking, without emails or IPs. | EU (Germany) |
International transfers to the USA rely on the European Commission's Standard Contractual Clauses (SCCs). Switzerland has a European Commission adequacy decision.
If you message us on WhatsApp, the messaging service is provided by WhatsApp Ireland Limited, which processes your data under its own terms and privacy policy.
7. Your rights
As a data subject you can exercise the following rights at any time by emailing legal@synkra.org with subject "Privacy":
- Access your personal data.
- Rectify inaccurate data.
- Erase (right to be forgotten).
- Object to processing.
- Restrict processing.
- Data portability.
- Withdraw consent at any time.
We respond within one month. If you believe processing does not comply with the law, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
8. Security measures
We apply appropriate technical and organizational measures: encryption in transit (HTTPS/TLS), admin access via magic-link authentication, anti-abuse rate-limiting, input sanitization and database role separation (RLS) so data is not readable client-side.
9. Changes to this policy
We may update this policy to reflect legal or service changes. Updates will be published here with a refreshed "Last updated" date. Substantial changes will be communicated where appropriate.