This Privacy Policy explains how Sinapsis AI ("we", "us", "our") collects, uses, stores, and protects personal data when you use our platform. We apply data minimization and describe the product behavior currently implemented in the Service.
1. Data We Collect
1.1 Account and Organization Data
Name, email address, username, and organization information provided during registration or account administration. If you use social login (Google or GitHub), we receive the profile information permitted by that provider. We also process organization memberships, roles, two-factor authentication settings, sessions, and notification preferences.
1.2 Workflow, Agent, and Deployment Data
Workflow and agent configurations, nodes, edges, triggers, prompts, deployment settings, schedules, API endpoint metadata, tool permissions, and execution status. Depending on your configuration, execution and agent records may include input/output metadata, messages, tool-call logs, traces, spans, errors, costs, and performance data.
1.3 Knowledge Base and File Data
Documents and files you upload to Knowledge Bases or other platform features are stored and may be parsed, chunked, embedded as vectors, and indexed to provide search and retrieval. The original content may be retained with the associated records until you delete it or the applicable retention policy removes it. You are responsible for ensuring uploaded data complies with your organization's data-handling policies.
1.4 AI Interaction, Evaluation, and Training Data
When you run a workflow, agent, evaluation, or training job, data is processed according to the model, provider, tool, and deployment configuration you select. We process the prompts, files, parameters, datasets, feedback, evaluation results, model metadata, and operational records required to provide those features.
We do not use customer data to train Sinaps-owned general models without your direction. If you explicitly use Training or Fine-Tuning features, the selected data is processed for that job and may be sent to the configured provider or infrastructure. Provider terms, retention, and logging behavior may differ by provider.
1.5 Governance and Compliance Data
The Compliance module may store organization-scoped questionnaires, framework applicability results, controls, findings, remediation information, safe evidence references, decision history, and related actor and timestamp metadata. It is designed for operational review and does not replace legal advice or certification.
1.6 Technical, Security, and Audit Data
IP address, browser and device information, request identifiers, session information, and security telemetry used for authentication, rate limiting, abuse prevention, reliability, and platform stability. Audit records may include the actor, organization, action, resource, timestamp, IP address, user agent, and request identifier.
1.7 Billing and Payment Data
Billing details are processed by Stripe or the payment service identified at checkout. We do not store full payment-card numbers on our application servers. We store subscription, plan, seat, credit, usage, invoice, and payment-event references needed to administer billing and quotas.
1.8 Product Analytics Data
When analytics consent is enabled and the relevant environment variables are configured, we collect product analytics such as page views, referrers, browser information, country, event names, route metadata, request timing, and coarse error information through Umami. Private session recording and replay may be enabled through OpenReplay in private mode, subject to consent, configuration, and the provider's processing terms. Analytics is optional and is not required to use the Service.
2. How We Use Your Data
We use your data to:
- Provide and maintain the platform, including workflows, agents, Knowledge Bases, deployments, evaluations, and training features
- Authenticate users, manage sessions, organizations, roles, and permissions
- Route AI requests and connected-service actions that your organization authorizes
- Process payments, credits, usage records, and plan quotas
- Send transactional emails such as verification, password reset, invitations, and billing notifications
- Monitor platform health, detect abuse, enforce rate limits, and investigate security events
- Generate organization-scoped observability, evaluation, cost, and performance views
- Operate governance, compliance, export, deletion, and retention workflows
- Improve the Service using aggregated or appropriately minimized product analytics
We do not sell your data, use customer data to train Sinaps-owned general models without your direction, or share data with advertisers or data brokers.
3. Cookies and Tracking
3.1 Necessary Cookies and Preferences
The Service uses cookies needed for authentication, security, consent, and basic preferences:
- Authentication cookies (
access_tokenandrefresh_token): HttpOnly, Secure where enabled, SameSite=Lax cookies used for authenticated sessions. The refresh token is scoped to the refresh endpoint. - CSRF cookie (
csrf_token, or the configured name): readable by browser code by design and used with the double-submit CSRF protection mechanism. - Cookie consent (
cookie_consent): stores your necessary, analytics, and marketing preferences for up to 365 days. - Locale preference (
sinapsis_locale): stores the selected public language preference for up to one year.
Authentication and security cookies are strictly necessary. Preference cookies can be removed through browser controls or the available cookie settings.
3.2 Analytics
When you allow analytics, the Service may load Umami from the configured analytics endpoint and start private OpenReplay session recording when that integration is configured. Umami may be self-hosted by us or operated through the configured provider; the endpoint and applicable processing terms depend on the deployment. OpenReplay is configured with private mode and Do Not Track respect, but no online service can guarantee that all provider-side processing is identical across environments.
You can reject analytics or withdraw analytics consent through the cookie settings. Withdrawal stops the product analytics runtime for subsequent activity, subject to data already processed before withdrawal.
3.3 Marketing Cookies
We do not currently use marketing or advertising cookies, sell personal data, or run advertising pixels. If that changes, we will update this Policy and request consent where required.
4. Data Storage and Security
Your data is stored in PostgreSQL and associated storage systems, including pgvector for Knowledge Base embeddings. Security measures include:
- Encryption in transit: TLS is used for browser, API, and configured service connections
- Encryption at rest: Sensitive secrets such as SSO credentials, integration credentials, and deployment credentials are encrypted before storage; API keys are hashed where the product only needs verification
- Authentication: JWT cookies, optional TOTP two-factor authentication, OAuth login, and API-key authentication
- CSRF protection: Double-submit cookies with constant-time comparisons
- Rate limiting: Redis-backed limits and plan-based quotas on sensitive and resource-intensive endpoints
- PII masking: Optional masking of supported identifiers before data is sent to external AI providers
- Tenant isolation: Organization-scoped access checks and permissions throughout the product
- Audit logging: Security and administrative activity is recorded for operational review
- SSRF protection: User-provided URLs are validated against private ranges, cloud metadata endpoints, and dangerous ports with DNS pinning where applicable
- Sandboxing: User-submitted code is executed in a bounded, network-disabled, container-isolated runtime when the sandbox is enabled
For self-hosted deployments, you control the infrastructure, storage location, backup strategy, and many security settings.
5. Third-Party Services and Transfers
We disclose data only as needed to provide the Service, enforce security, or comply with law. Categories include:
- Stripe or the configured payment processor — Payment processing, subscriptions, invoices, and usage-related billing events
- Configured email provider — Transactional email delivery, including recipient address and message content
- Configured model providers or inference infrastructure — Prompts, files, parameters, datasets, or other inference data required by the workflow, evaluation, or training configuration
- Configured integrations — Data exchanged with external services when your organization authorizes a connection or action
- Umami and OpenReplay, when enabled and consented — Product analytics and private session telemetry
- Hosting, storage, database, and operational providers — Infrastructure needed to run the selected cloud deployment
For the current cloud-hosted service, primary platform infrastructure is hosted in the European Union, currently in the Netherlands. If your organization routes data to a provider outside the EU or European Economic Area, or if a service provider processes data elsewhere, the transfer may be governed by an adequacy decision, Standard Contractual Clauses, or another applicable safeguard. Self-hosted deployments are governed by the customer's chosen infrastructure and providers.
We do not share data with advertisers or data brokers.
6. Data Retention
The following are current default retention periods for the cloud Service. Organization administrators can configure supported retention policies, and a contract, legal hold, security need, backup, or provider policy may require a different period.
| Data type | Default retention or lifecycle | | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | User account data | While the account is active; deletion of the user record occurs after an accepted deletion request, while organization-owned records may remain under their own policies | | Workflow and agent configurations | While the organization retains them, or until an administrator deletes them | | Workflow executions | 90 days by default; configurable per organization | | AI conversations | 90 days by default; configurable per organization | | AI runtime execution traces | 30 days by default; configurable per organization | | Observability spans | 30 days by default; configurable per organization, with a 30-day minimum in the current worker | | Observability rollups | Hourly: 7 days; daily: 90 days; monthly: 365 days by default | | Audit logs | 365 days by default; configurable per organization and subject to legal or security requirements | | Data imports | 180 days by default, with associated storage cleaned up by the retention worker | | Generated data exports | Downloadable export files expire after 7 days; export records follow the applicable export retention policy, 30 days by default | | Notifications | 90 days by default | | Product analytics | Retained according to the configured Umami/OpenReplay deployment and consented analytics settings | | Sessions | Expire according to the configured access, refresh, and CSRF token lifetimes |
Data export is available through Settings > Security & Data > Privacy and is rate-limited to one request per 7 days. The current self-service export covers the categories supported by the export service, including account and membership data, conversations, notifications, user-attributed audit events, user-created agents, Knowledge Bases and workflows, API-key and connection metadata, and feedback. It does not include secrets and may not include every organization-owned record or every product domain. Contact us for a broader request where required by applicable law. Account deletion is subject to subscription, ownership, and organization checks; it does not automatically erase records that belong to an organization, a provider, a legal hold, or a backup lifecycle.
7. Your Rights
Under GDPR and other applicable privacy laws, you may have the right to:
- Access — Request or review personal data held about you through Settings > Security & Data > Privacy where available
- Rectification — Correct inaccurate data through Settings > Personal > Profile or by contacting us
- Erasure — Request deletion of your account and personal data, subject to applicable exceptions
- Portability — Request a machine-readable export of the categories currently supported by the Service where the right applies
- Restriction — Ask us to limit processing in the circumstances provided by law
- Objection — Object to processing based on legitimate interests in the circumstances provided by law
- Withdraw consent — Withdraw consent where processing is based on consent, without affecting prior lawful processing
- Lodge a complaint — Contact your local data protection authority
To exercise these rights, use the platform settings or contact [email protected]. We will respond without undue delay and normally within one month of a verified request, subject to lawful extensions and identity verification requirements.
8. Children
Sinapsis AI is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will delete it promptly where required by law.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification where appropriate. The "Last updated" date at the top of this page reflects the most recent revision.
10. Contact
For privacy questions, data protection requests, or requests concerning analytics and cookies, contact us at:
Email: [email protected]