Privacy Policy

1. Controller

2. What data we process and why

2.1 Account and authentication

When you register and sign in, we process your email address. We use a passwordless sign-in method: you receive a single-use link by email (magic link) that expires after a short time. We do not store a password.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

Storage period: Until your account is deleted. For technical reasons, personal data may remain in rolling backups for up to 7 days after deletion; it is then automatically overwritten.

2.2 Glossaries and terms

Content you create in syncTerms (glossaries, terms, attributes) is stored in our database. We access this content solely for the purpose of operating and maintaining the service and — at your request — to handle support enquiries.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

Storage period: Until the respective content or the account is deleted; plus the backup retention of up to 7 days mentioned above.

2.3 Payment data

Paid plans (Basic, Pro) are processed via Stripe. Payment data (credit card, IBAN, etc.) is processed and stored exclusively by Stripe — we do not receive or store full payment method details. We only store the Stripe customer ID, the subscription status and the metadata required for billing.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

Processor: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, D02 H210, Ireland. A data processing agreement pursuant to Art. 28 GDPR is in place with Stripe. Where data transfers to Stripe, Inc. (USA) occur as part of payment processing, they take place on the basis of the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR); alternatively on the basis of standard contractual clauses (Art. 46(2)(c) GDPR).

2.4 Transactional emails

We send transactional emails (login links, payment notifications, subscription reminders) via Postmark, a service of ActiveCampaign, LLC, 1 N Dearborn St, Chicago, IL 60602, USA. For this purpose we transmit your email address to the provider.

A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR); alternatively on the basis of standard contractual clauses (Art. 46(2)(c) GDPR).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

2.5 Server logs

When you access the app, our hosting provider Scalingo SAS records technical connection data: IP address, requested URL, timestamp, HTTP status code, browser type. This data is stored for a maximum of 7 days and serves solely for troubleshooting and secure operation.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation)

2.6 Session cookie

After you sign in, we set a strictly necessary session cookie that maintains your login session. This cookie contains no personal content and is deleted when you sign out or when the session expires.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); Section 25(2) no. 2 TDDDG (strictly necessary)

2.7 No analytics, no tracking

We do not use any web analytics tools, tracking mechanisms or third-party cookies. No profiling and no automated decision-making within the meaning of Art. 22 GDPR takes place.

2.8 Internal access (support and administration)

Persons with administrative access may access account and content data when handling support requests, for abuse prevention and to comply with legal obligations. Access is limited to what is necessary and is logged.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); Art. 6(1)(f) GDPR (legitimate interest in secure operation)

3. Hosting and infrastructure

The app runs on servers operated by Scalingo SAS (13 rue Jacques Peirotes, 67000 Strasbourg, France) in the osc-fr1 region. Data is stored exclusively in data centers located in France. Scalingo uses 3DS OUTSCALE SAS (1 rue Royale, 92210 Saint-Cloud, France) as a sub-processor for the infrastructure; its data centers are likewise located in France.

A data processing agreement pursuant to Art. 28 GDPR is in place with Scalingo. No transfer of personal data to a third country outside the EU or EEA takes place as part of the hosting.

4. Disclosure to third parties

We do not disclose your data to third parties unless this is necessary for the performance of the contract (Stripe, Postmark, Scalingo as processors) or we are legally obliged to do so.

5. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR).

Send requests to: support@syncterms.com

6. Right to lodge a complaint

You have the right to lodge a complaint with the competent data protection supervisory authority:

7. Minimum age

syncTerms is not directed at children under 16. We do not knowingly process data of persons under 16.