Skip to content
Syntra

Privacy Policy

Last updated:

This policy explains how Syntra handles your personal data when you use the Syntra assistant on WhatsApp, your Syntra account at app.asksyntra.com and this website. If anything is unclear, write to [email protected].

The short version

  • Syntra is an AI assistant on WhatsApp. To answer you, it processes what you send it and, if you connect them, your Gmail, Google Calendar and Google Drive.
  • We use your data only to provide Syntra. We don't sell it or show ads, and neither we nor our AI provider use it to train AI models.
  • Google data is read only when you ask, and Syntra sends, changes or uploads something only after you tap to confirm.
  • Files are deleted after 90 days, and you can ask us to delete everything at any time.

See also our Terms of Service.

1. Who is responsible for your data

The data controller is Pavlo Golovatyy, Via Papa Giovanni XXIII, 3, 66020 San Giovanni Teatino (CH), Italy (“Syntra”, “we”, “us”).

For anything about your data, write to [email protected]. For everything else: [email protected].

2. What data we process

  • WhatsApp identifiers: your phone number or WhatsApp user ID, and the profile name you set in WhatsApp.
  • Your messages and files: what you write, your voice notes and their transcriptions, the photos, documents and other files you send, and Syntra's replies, including the images, videos and files it creates for you.
  • Memory: a short profile Syntra keeps about you (for example the name you want to be called, your language, what you do and how you like answers) and summaries of past conversations, so it stays consistent over time.
  • Your skills: the instructions and files you create or install as skills.
  • Account data: your Syntra account ID, WhatsApp ID and name; your sign-in sessions with the IP address and browser (user agent) used; one-time sign-in links, stored only as a hash.
  • Google data, only if you connect Google: see Google user data.
  • Usage and technical data: daily counters for images and videos, server logs, and technical traces of how Syntra handled a request (which can include parts of the conversation), used to run, secure and fix the service.

We don't ask for sensitive data such as health information. If you choose to share it in a conversation, it is processed only to answer you.

3. Why we use it and on what legal basis

Provide Syntra: answer your messages, work on your files, create images and videos, remember your preferences and run your skills
Performance of our agreement with you (Art. 6(1)(b))
The Gmail, Google Calendar and Google Drive features you choose to connect
Performance of our agreement (Art. 6(1)(b)), within the permissions you grant on Google's consent screen
Your Syntra account and sign-in
Performance of our agreement (Art. 6(1)(b))
Keep Syntra secure and working: prevent abuse, apply daily limits, find and fix bugs
Our legitimate interest in a secure and reliable service (Art. 6(1)(f))
Comply with the law and establish or defend legal claims
Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f))
Sensitive data you choose to share in a conversation
Your explicit consent, given by sharing it (Art. 9(2)(a)); you can withdraw it at any time

Syntra's replies are generated by AI, but we don't make decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). We don't sell your data, we don't use it for advertising, and we don't build marketing profiles.

4. Google user data

Syntra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting Google is optional. You connect Gmail, Google Calendar and Google Drive one at a time from your Syntra account, and Google shows you which permissions Syntra asks for before you agree. Right after you connect one, Syntra may write to you in the WhatsApp chat about what it can now do, or finish a request you made earlier that needed it.

What Syntra accesses and why

Basic profile (openid, email, profile)
Identifies the Google account you connected, so Syntra works with the right one.
Gmail: read (gmail.readonly)
Searches and reads your emails and attachments when you ask, for example to find an invoice or summarize a thread, and saves an attachment to your files when you ask.
Gmail: compose (gmail.compose)
Writes drafts for you, and sends an email only after you tap to confirm on a card showing the recipients, subject and text.
Google Calendar: events (calendar.events)
Reads your events; creates, changes or deletes events and answers invitations only after you tap to confirm.
Google Calendar: calendar list (calendar.calendarlist.readonly)
Reads your calendars and time zone, so dates and times are right.
Google Calendar: free/busy (calendar.events.freebusy)
Checks when you're free.
Google Drive: read (drive.readonly)
Searches and reads your files (Docs, Sheets, Slides and text files), and copies a file to your Syntra files when you ask to work on it.
Google Drive: files created by Syntra (drive.file)
Uploads files Syntra made for you to a “Syntra” folder in your Drive, only after you tap to confirm.

How Syntra uses it

  • Only to provide the features you ask for, which you see in the chat. Syntra reads Google data when a request of yours needs it; it doesn't scan your account in the background.
  • Sending an email, changing your calendar and uploading to Drive always need your tap on a confirmation card.
  • We don't use Google data for advertising, we don't sell it, and we don't use it to build profiles for other purposes or to assess creditworthiness.
  • We don't use data obtained through Google Workspace APIs to develop, improve or train generalized or non-personalized AI or machine-learning models. Our AI provider processes it only to write Syntra's replies to you, and does not use it to train its models.
  • No person reads your Google data, unless you ask us to look at a specific item, it is necessary for security (for example investigating abuse or a bug), or the law requires it.

Who it is shared with

Only what is needed to answer you, and only with:

  • xAI, our AI model provider, which receives the parts needed to write a reply (for example the emails Syntra found for your question);
  • Meta (WhatsApp), which delivers Syntra's replies to you;
  • Amazon Web Services (Stockholm, Sweden), where files you ask to copy are stored in your private folder, and E2B, where they are opened in your private sandbox when Syntra works on them.

We don't transfer Google data to anyone else, except to comply with the law, or as part of a merger, acquisition or sale of assets and only after asking for your explicit consent.

How long it is kept

  • Access keys (OAuth tokens): stored encrypted on our server in Italy until you disconnect Google or ask us to delete your account. The assistant's server holds a short-lived access key in memory for up to one hour; the long-lived key never leaves the account platform.
  • Google content is not copied into a separate database. What Syntra reads for you becomes part of the conversation and its memory, kept as described in How long we keep your data; files you ask to copy are deleted after 90 days.
  • Our AI provider keeps requests for up to 30 days to monitor abuse, then deletes them.

How to revoke access and delete it

  • In your Syntra account, turn Gmail, Google Calendar or Google Drive off: Syntra stops using it right away, while Google keeps listing the permission until you disconnect. Or tap Disconnect Google: Syntra's access is revoked at Google and the stored keys are deleted.
  • Remove Syntra's access at any time from your Google Account, under Your connections to third-party apps & services. From then on Syntra can no longer reach your Google data.
  • To delete the stored keys and the Google data in your conversations, memory and files, write to [email protected].

5. Who we share data with

We use these providers to run Syntra. They act as our processors: they handle data only on our instructions and under data processing terms.

  • Meta Platforms Ireland Ltd. (WhatsApp Business Platform) carries messages between you and Syntra and stores them for up to 30 days. It receives your WhatsApp identifiers, messages and files. EU and United States. Your use of WhatsApp itself is covered by WhatsApp's own privacy policy.
  • xAI (Grok models) writes Syntra's replies, transcribes voice notes and creates images and videos. It receives the conversation content needed for each reply and the files and images involved, with a pseudonymous ID instead of your number, and keeps requests for up to 30 days. United States.
  • Amazon Web Services EMEA SARL stores your files and skills, encrypted, in Stockholm, Sweden (EU).
  • E2B (FoundryLabs, Inc.) runs your private sandbox, where Syntra opens and creates files. It receives the files being worked on and a pseudonymous ID, and the sandbox is destroyed after 10 minutes of inactivity. United States.
  • Cloudflare, Inc. provides DNS, network security and delivery for our websites. It processes IP addresses and technical data of web requests. Global network.
  • Search providers. Web, news, image and place searches go through Syntra Search, our own search service, which passes the text of the search query to third-party search, maps and web-capture providers. Your phone number and name are not sent.

Syntra's conversations, memory, account database and logs run on a server we manage in Italy.

When you connect Google, data moves between Syntra and Google on your instructions. Google handles your Google account under its own privacy policy. We may also disclose data to public authorities when the law requires it.

6. Transfers outside the EU

Some providers process data in the United States. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR); otherwise, on the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR), included in the provider's data processing terms. You can ask us for a copy at [email protected].

7. How long we keep your data

Messages, conversation history and memory
As long as you use Syntra. Deleted within 30 days of your request.
Files you send and files Syntra makes
Deleted automatically 90 days after they are saved.
Your skills
Until you delete them, or ask us to.
Sandbox
Destroyed after 10 minutes of inactivity; only what is saved in your files remains.
Download links Syntra sends you
Expire after 7 days.
Sign-in links
Valid for 10 minutes, single use.
Sign-in sessions
End when you sign out, or after 7 days without use.
Google access keys
Until you disconnect Google or ask us to delete your account.
Technical logs and traces
As long as needed to run and secure the service; deleted with your conversations when you ask.
Copies at Meta and xAI
Up to 30 days, under their terms.

We may keep some data longer when the law requires it or to establish or defend legal claims.

8. Your rights

Under the GDPR you have the right to:

  • access your data and get a copy of it;
  • have it corrected or deleted;
  • restrict its processing, or object to processing based on our legitimate interest;
  • receive the data you gave us in a portable format;
  • withdraw your consent at any time, without affecting processing done before.

To exercise them, write to [email protected]. We answer within one month. We may ask you to confirm the request from your WhatsApp number, so we know it's really you.

You can also lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali, or the authority of the EU country where you live or work.

9. Minimum age

Syntra is for people aged 16 or over. If you are under 16, please don't use it. If we learn that we hold data of someone under 16, we delete it.

10. How we protect your data

  • Connections to our websites and to our providers are encrypted (HTTPS/TLS).
  • Messages to Syntra are encrypted in transit, but they are not end-to-end encrypted like chats between people: Meta's and Syntra's servers process them in order to answer you.
  • Google access keys are stored encrypted, and the long-lived key never leaves our account platform.
  • Files are encrypted at rest, and each user's files can only be reached with credentials limited to that user's own folder.
  • Each user gets a private sandbox, and E2B and xAI receive a pseudonymous ID instead of your phone number.
  • Anything that sends or changes something in your Google account needs your explicit confirmation.

No system is perfectly secure. If a breach affects your data and is likely to put your rights at risk, we will tell you and the authority as the law requires.

11. Cookies

asksyntra.com doesn't use cookies, analytics or third-party trackers. app.asksyntra.com uses only the cookies strictly necessary to keep you signed in and to connect Google securely. Cloudflare may set strictly necessary security cookies to protect our sites from bots. Strictly necessary cookies don't require consent.

12. Changes to this policy

We'll update this policy when Syntra changes, and publish the new version here with its date. We'll tell you about important changes in advance, in the chat or on this site, and always before Syntra starts using Google data in a new way.

13. Contact

Pavlo Golovatyy, Via Papa Giovanni XXIII, 3, 66020 San Giovanni Teatino (CH), Italy. Email: [email protected].