Privacy Policy
Last updated: August 7, 2026
1. Introduction
This Privacy Policy explains how Syncendio Systems Inc. ("Syncendio," "we," "us," or "our") collects, uses, discloses, and protects information when you visit our website, request a demo, start a free trial, subscribe to a paid plan, or otherwise interact with Syncendio's inventory, purchasing, sales, and assembly platform (the "Service").
By using our website or the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
What this policy does not cover. Syncendio is a tool businesses use to run their own operations. The records you keep inside your workspace — your customers, your suppliers, your contacts and their details — belong to you. We hold and process them on your instructions, under our Data Processing Agreement, not under this policy. If you are a customer, supplier or contact of a business that uses Syncendio and you want to see, correct or delete what they hold about you, please ask that business directly. They decide; we act on what they tell us.
Syncendio is sold to businesses and is not intended for personal, family or household use. We treat the information we collect through our website and our own dealings with you as relating to you in your working capacity.
If you are in Canada, see section 13, which is the law we are primarily governed by. If you are in California, see section 14. If you are in the European Economic Area or the United Kingdom, see section 15 — note that we do not currently offer Syncendio to businesses based there.
2. Information we collect
2.1 Information you provide directly
- Free trial signup: first and last name, work email address, business name, business type, and team size.
- Plan selection: the plan tier (Starter, Growth, or Pro) and billing frequency (monthly or annual) you choose.
- Partner program application: full name, email address, firm/company name, partner type, estimated client count, and any details you share about your clients.
- Support & correspondence: anything you send us directly, such as support requests or emails.
2.2 Payment information
We do not collect payment card details. The trial needs no card, and a paid subscription is arranged with you directly, so no card number is entered into or stored by the Service. We keep only what the plan itself needs — which plan you are on, how many seats, and whether it is active. If we add card payment, we will update this policy before we do.
2.3 Information collected automatically
- Device and browser information (browser type, operating system, screen size).
- Usage data (pages viewed, links clicked, time on page, referring URL).
- Approximate location derived from IP address.
- Cookies and similar technologies — see Section 4.
3. How we use information
We use the information described above to:
- Create and manage trial and paid accounts, and provision your workspace.
- Manage your subscription — the plan you are on, the seats it includes, and whether it is active.
- Review and respond to partner program applications.
- Send transactional communications, such as account verification, billing receipts, and trial-expiration notices.
- Send you messages about your account and the Service — confirmations, security notices, billing, and replies to your questions. These are not marketing and you cannot opt out of them while you have an account, because they are part of providing it.
- Monitor, secure, and improve the website and Service, including diagnosing technical issues.
- Detect, investigate, and prevent fraud, abuse, or security incidents (for example, using bot-protection on our signup forms).
- Comply with legal obligations.
6. Data retention
We keep personal information for as long as we need it to provide the Service, meet our legal obligations, resolve disputes and enforce our agreements. Beyond that, these are the periods we actually apply, and a job runs every day to enforce them:
| What | How long we keep it |
|---|---|
| A sign-up you never confirmed | Deleted as soon as the confirmation link expires. This includes the name, email address and password you entered. |
| Enquiries from our website, and contact details kept after a trial ends without becoming a subscription | 2 years from the last time we were in contact. If we speak to you again, the clock restarts. |
| Questions typed into the in-app help assistant | 1 year |
| Website visit counts | 1 year. These carry no IP address or name — just a page, a country and a one-way code that cannot be traced back to you. |
| Backups | 30 days, after which they are deleted. Information you asked us to delete may remain in a backup until the backups containing it have aged out. |
| Your workspace and everything in it | For as long as your subscription is active. A trial that does not convert is deleted about a month after it ends. See our Data Processing Agreement for what happens to a business customer's data when an account closes. |
Records we are required to keep for tax, accounting or legal reasons — invoices and payment records, for example — are kept for the period the law requires even if you ask us to delete other information.
7. Your rights and choices
Wherever you live, you can ask us for a copy of the personal information we hold about you, ask us to correct it, and ask us to delete it. You may have further rights depending on where you are — see section 13 if you are in Canada, section 14 in California, or section 15 in Europe.
To exercise any of these, email privacy@syncendio.com and say what you are asking for. We answer within 30 days, which is the deadline Canadian law sets us, and sooner where another law that applies to you requires it. If we need longer we will tell you within those 30 days and explain why. We may need to confirm who you are before we act, so that we do not hand somebody else's information to the wrong person.
If what you are asking about is held inside a workspace belonging to a business that uses Syncendio — because you are their customer or supplier — please ask that business directly. They decide what happens to those records; we act on their instructions. See section 1.
Marketing email. We do not currently send marketing or promotional email. Everything we send is about your account or something you asked us for. If that ever changes, we will ask before adding you, every such message will carry a one-click unsubscribe link, and opting out will never affect the service messages you need.
8. Data security
We use reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (HTTPS/TLS) and access controls on our systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. See our Security page for more detail on our practices, including how we respond to security incidents.
9. Children's privacy
The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
10. International data transfers
We may process and store information in countries other than your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for transfers of personal information out of the EU/UK/Switzerland. Business customers can find the details of these safeguards in our Data Processing Agreement.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date above. Material changes will be communicated through the Service or by email where appropriate.
12. Contact us
Questions about this Privacy Policy or your personal information can be directed to:
Syncendio Systems Inc.
6733 Mississauga Rd, Suite 700, Mississauga, Ontario L5N 6J5, Canada
Email: privacy@syncendio.com
13. Canada — PIPEDA
Syncendio is a Canadian business, and the law that governs how we handle personal information is the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"), together with any provincial privacy law that applies where you are.
Who is accountable
PIPEDA requires us to appoint someone who is accountable for how we handle personal information. That is our:
Privacy Officer
Email: privacy@syncendio.com
You can write to them about anything on this page, including a complaint. If you would like to know who currently holds that role by name, ask and we will tell you.
Asking what we hold about you
You can ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, and ask how it has been used and who it has been given to.
We will answer within 30 days. If we need longer, we will tell you within those 30 days, explain why, say how much longer we expect to take, and tell you that you may complain to the Privacy Commissioner about the delay. The law allows us one extension of up to a further 30 days.
Answering is free unless a request would cost us a significant amount to fulfil — in which case we will tell you what it will cost and what it covers before we do any work, and you can withdraw the request. We may need to confirm who you are first, and there are some things we cannot give you: information that would reveal somebody else's personal information, or that is subject to legal privilege. If we refuse, we will tell you why and what you can do about it.
If you are not happy with our answer
Please come to us first — most things are quicker to put right directly. If we cannot resolve it, you can complain to the Office of the Privacy Commissioner of Canada:
Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec, K1A 1H3
Telephone: 1-800-282-1376
www.priv.gc.ca
If you live in Alberta, British Columbia or Quebec, your province has its own privacy law and its own commissioner, and you may complain to them instead.
Where your information is held
Some of the companies we rely on to run Syncendio are outside Canada, so your information may be stored or handled outside the country and may be accessible to the courts and authorities there. Business customers can see exactly which companies, and where, in Annex 3 of our Data Processing Agreement.
14. Notice to California residents
This section applies if you live in California. It describes how we handle personal information under the California Consumer Privacy Act, as amended (the "CCPA"), and the rights you have. Where this section and the rest of the policy differ, this section applies to you.
It covers information we collect about you through our website and our own dealings with you. It does not cover records held inside a customer's workspace — see section 1.
We do not sell or share your personal information
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We run no advertising network, we have no advertising partners, and we do not use your information to target you with advertising anywhere else. There is therefore nothing to opt out of, and no "Do Not Sell or Share" link to offer. We also do not knowingly sell or share the personal information of anyone under 16.
We do not use or disclose sensitive personal information for any purpose that gives you a right to limit it under the CCPA.
Your rights
- Know and access. Ask what categories of personal information we have collected about you, where it came from, why we collected it, who we disclosed it to, and ask for a copy.
- Delete. Ask us to delete personal information we collected from you.
- Correct. Ask us to correct personal information that is inaccurate.
- No retaliation. We will not deny you service, charge you a different price, or give you a lower standard of service because you exercised a right.
These rights have limits. We may refuse a request where the law allows — for example where keeping the information is necessary to complete a transaction, to meet a legal obligation, or to protect against fraud or security incidents. If we refuse, we will tell you why.
How to make a request
Email privacy@syncendio.com and say which right you are exercising. We will acknowledge your request within 10 business days and respond within 45 calendar days. If we need longer, we will tell you within that period and may take up to a further 45 days.
Proving who you are. Before we act on a request to know, delete or correct, we need to be satisfied that you are who you say you are. Usually this means replying from the email address we already hold for you, or signing in to your account. For a request covering more sensitive information we may ask for more. If we cannot verify you, we will tell you rather than act on a request that might expose somebody else's information.
Someone acting for you. An authorised agent may make a request on your behalf if they give us written permission signed by you, or a valid power of attorney. We may still contact you directly to confirm.
What we collect, and who receives it
In the last twelve months we have collected the categories below. The purposes are set out in section 3 and the recipients in section 5.
| CCPA category | What that means here | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Your name, work email address, company name, phone number, and the account you sign in with | Our hosting, email and payment providers, and professional advisers |
| Commercial information | The plan you are on, your billing history, and records of your dealings with us | Our payment provider and our hosting provider |
| Internet or network activity | Pages visited on our website, sign-in times, and the IP address a request came from | Our hosting provider and the service that protects our forms from automated abuse |
| Geolocation data | An approximate country or region, worked out from your browser's time zone | Our hosting provider |
| Inferences | None. We do not build profiles of you or draw conclusions about your preferences | — |
We may also disclose any of the above to law enforcement or a government authority where the law requires it, and to a buyer or successor if our business is sold, as described in section 5.
How long we keep it is described in section 6. In short, we keep information for as long as it serves the purpose we collected it for, and then for any period the law requires.
15. Notice to European users
This section applies if you are in the European Economic Area ("EEA") or the United Kingdom. In it, "personal information" means "personal data" as the EU General Data Protection Regulation and the UK GDPR use that term.
Who is responsible
For the information covered by this policy — our website, our marketing, and your account with us — Syncendio Systems Inc. is the controller. Our contact details are in section 12.
For the records inside a customer's workspace we are a processor, not a controller. The business that holds those records is the controller and decides what happens to them. See section 1 and our Data Processing Agreement.
We do not offer Syncendio to businesses based in the European Economic Area or the United Kingdom, and sign-up is declined for them. We have therefore not appointed a representative under Article 27, which applies to organisations that offer goods or services to people in Europe. This section is here for people in Europe who visit our website or write to us.
Why we are allowed to use your information
The GDPR requires us to have a lawful basis for each use. Ours are:
| What we do | Our lawful basis |
|---|---|
| Give you the Service, keep your account working, take payment, and provide support | Performance of a contract — we cannot deliver what you signed up for without it. |
| Keep the Service secure: detecting abuse, preventing fraud, keeping records of sign-ins, and protecting our forms from automated attack | Legitimate interests — running a service that is not easily abused. We use the least information that achieves it. |
| Improve the Service and understand how it is used | Legitimate interests — making a product our customers can use well. We use counts and patterns rather than building a profile of you. |
| Keep accounting, tax and other records we are required to keep | Legal obligation. |
| Send you marketing about Syncendio, if we ever do — see section 7, we do not today | Consent, where the law requires it, which you can withdraw at any time. Withdrawing it does not affect anything we did before you did so, and you will still receive messages about your account and your service. |
Your rights
You can ask us to give you a copy of your personal information, correct it, delete it, restrict what we do with it, or send it to another provider in a portable form. You can object to processing we carry out on the basis of legitimate interests, and you can withdraw consent at any time where consent is what we rely on.
Email privacy@syncendio.com. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you within the first month if we do. We may need to confirm your identity first.
If you are not satisfied, you can complain to the data protection authority where you live or work. In the United Kingdom that is the Information Commissioner's Office. In the EEA it is the supervisory authority for your country. We would rather you came to us first so we can put it right.
Sending information outside Europe
We are based outside Europe and so are several of the providers we use, which means your personal information is transferred out of the EEA and the United Kingdom. Where we do that, we rely on the European Commission's Standard Contractual Clauses and the UK's addendum to them, together with the checks those clauses require. Business customers can see the detail in our Data Processing Agreement. Where personal information is stored is set out there as well.
Decisions made by computer
We do not make decisions about you by automated means that produce legal effects or similarly significant effects for you.
How long we keep it
See section 6. Where we have not set a period, we keep information for as long as it serves the purpose we collected it for and then delete it or make it anonymous.