What we hold, and why we hold it

2.1Information you give us

When you register and as you use the product, you provide:

• Account information: your name, email address, and a password, which is stored only as a hash. If you sign in with Google we receive your name and email address from Google instead.
• Sign-in credentials you add yourself: a two-factor secret if you turn two-factor authentication on, and the public key of any passkey you register. A passkey's private half is created by your device and never leaves it, so we cannot use a passkey to sign in as you.
• Profile information: a profile picture, a short bio, and the role you chose, which is creator, brand, or agency.
• Business information: your company name and business type, and for agency accounts the names, email addresses and roles of team members you invite, and which clients each of them may see.
• Billing information: your billing name and address. Card details are entered into Razorpay's own form and are never received by, transmitted through, or stored on our systems.
• Content: captions, images, video, drafts, notes, contracts and invoices that you create or upload inside the product.

2.2Instagram data

None of this exists until you connect an Instagram account, and all of it stops being refreshed the moment you disconnect. We read it through Meta's official Graph API using a token you grant and can revoke, which we store encrypted with aes-256-gcm.

• Profile data: username, follower count, following count, biography, profile picture, and account type.
• Content: your posts, reels, stories, captions, hashtags, and the media files attached to them.
• Performance data: likes, comments, saves, shares, reach, impressions, video views and watch time on your own content.
• Audience data: aggregate demographics and activity patterns for your followers, as Instagram reports them. We do not receive, and cannot see, the identity of individual followers beyond those who interact with you publicly.
• Interactions: comments and direct messages sent to your account, which is what makes an automated reply possible.
• Hourly snapshots of a post's numbers, kept so the product can tell the difference between a post doing well and a post doing well for you.

We request the narrowest set of Instagram permissions that makes the features you use work. You can review and revoke them at any time from Instagram's own settings, without going through us.

2.3Feature requests and the public roadmap

The roadmap on this website takes an email address from anybody, with or without a Synclify account. You reach it by choosing to, and nothing on it is required to use the product. It is not the only place we hold something about people who have no account: the contact and agency forms on this website, messages sent to our own Instagram account, bookings made through a customer's public page, the approval and signing links a customer sends to their clients, and the messages, comments and leads in a customer's own Instagram inbox all do, and each is kept under the windows in section 8.

• What you asked for, why you want it, and how you do it today: the words you type into the form. If we publish the request on the board, the title and your description appear there. Your email address never does.
• Your email address: to reply, to send you a private link to your own request, and to tell you when its status changes. It is not added to a mailing list, because there is no mailing list.
• A one-way hash of your IP address: to stop one sender filing hundreds of requests. The address itself is never stored, and the hash cannot be reversed to recover it or used to locate you.
• If you vote on a request, a six digit code sent to your address proves it is yours. That record is your address, whether it has been verified, and which requests you voted for.

A line you leave when voting may be published on the board, but never with your name or address attached to it. Nothing you submit becomes public at all until a person at Synclify has read it and chosen to publish it.

If your address matches a Synclify account we note that the request came from a customer, so we can weigh it properly. We do not attach your request to your account records, and deleting your account does not delete a request you filed.

If you ask the box on our home page something it cannot answer, we may email ourselves the question, with any email address, handle or phone number removed, so we can add an answer. It is used for nothing else.

2.4Competitor data

If, and only if, you use the competitor features, we collect publicly available information from the Instagram accounts you specifically name. We do not select these accounts for you and we do not collect anything about an account you have not entered.

• Public posts, captions and hashtags.
• The like and comment counts Instagram displays publicly.
• Posting frequency and the times of day they publish.

We do not collect, infer, estimate or display private metrics for any account that is not yours. Reach, impressions, saves, shares and audience demographics for a competitor are not available to us and the product will not produce a figure for them. Where a comparison is shown, the figure being compared is always yours.

2.5Information collected automatically

When you use the product we record technical information needed to run it and keep it secure:

• Device and browser type, operating system, and for the mobile app a device identifier used to deliver push notifications.
• IP address, and the approximate location it implies, at city level.
• Which pages and features you used, and when.
• Errors and failures, so a broken feature can be found and fixed.
• Your signed-in sessions, so you can see every device that holds one and end any of them, and failed sign-in attempts on your address, so somebody guessing your password is slowed down.

We do not operate an advertising network or a session recorder, and there is no third-party product-analytics service in the software you sign in to. The marketing website you are reading this on is separate, and it does use Google Analytics to count visits to its pages. That is the whole of its involvement: it runs on the website only, it is not in the product, and it never sees your account, your posts or your Instagram data.

2.6WhatsApp

None of this exists until you link a handset to a workspace, and it stops the moment you unlink it. WhatsApp runs through Meta's official Business API, so Meta carries the messages in the same way it carries anything else sent on WhatsApp.

• The phone number you linked and the workspace it runs, which is what lets a message from that handset reach your account and no other.
• The messages you send that number and the replies it sends back, kept so a conversation can carry from one message to the next.

A message from a number that is not linked to a workspace gets a fixed answer about what Synclify does, written in advance with no AI involved. Nothing about that number or its messages is kept.

Answers to what you ask are always sent, because you asked. Messages that arrive on their own are different and are off unless you turn them on: either by ticking the box when you link the handset, or by sending /start to that number afterwards. We record when you gave that permission and which of the two ways you gave it, because consent that cannot be evidenced is not consent. Sending /stop withdraws it, takes effect immediately, and removes that record. /unlink disconnects the handset entirely, and disconnecting your last handset withdraws the permission with it.

2.7Link in bio pages

None of this exists until you publish a page at synclify.ai. The page shows what you put on it: your name, photo, short bio, buttons, and the addresses those buttons lead to. Each address is checked against Google Web Risk's list of unsafe sites, which receives the address and nothing else.

When somebody opens your page or taps a button, we record the time, the page or button, the website they came from, their country and city as their IP address implies them, and whether they used a phone, tablet or computer. We keep a one-way hash of their IP address and browser, salted afresh every day, so one person is counted once per day without being followable from one day to the next. The IP address itself is not stored, no cookie is set, and nobody is identified. Individual records are deleted after 90 days; the daily totals made from them are kept with your page.

If your page has a form, or lets brands ask for your media kit, what people send through it reaches you. We hold it on your behalf: you decide what to do with it, and you are responsible for treating it lawfully. That is their name, email address, phone number if asked, the answers and files they gave, a one-way hash of their IP address used only to stop one sender flooding a page, and for a media kit, when they opened the kit link we emailed them. Anybody who sent something through a page can have it deleted at synclify.ai/remove-my-details, without needing an account.

A free Link in bio account holds only what this section and sections 2.1 and 2.5 describe. It never connects to Instagram.

2.8Edits on your own AI

When your own Claude, in Claude Code on your computer, makes an edit through the Synclify connector, your footage stays on your computer and is never uploaded to us. Your Claude reads the account file it needs for the edit through the connector, as it does for any question you ask it there. We receive only:

• The finished video and its cover, which become part of your edits like any other finished video.
• A small file describing each finished video: its length, size, sound level, format and whether the kit's checks passed.
• The files that let you change the video in Synclify: a low-resolution copy of it without its captions and on-screen text, and the edit's timeline, caption text and on-screen text.
• A short summary of the edit: the type of hook, the length, the caption style and the pace.
• The speech of your main footage as audio, only when you choose Synclify's transcript. It is turned into text by xAI and kept with its transcript for 30 days after the edit last changed.
• A support file of logs and versions, only when you report a problem and agree to send it. It never holds footage, and it is deleted after 30 days.

We also record which Claude model made the edit, the version of the editing kit and the name of the app that connected, to keep quality and support working.

2.9Google Calendar and Calls

None of this exists until somebody in your workspace connects a Google Calendar to Calls, and it stops the moment it is disconnected. We connect through Google's official Calendar API using access you grant and can revoke at any time from your Google Account, and we store that access encrypted with aes-256-gcm.

• When you are busy: the start and end of busy times on the calendars you choose, so your booking pages only offer times you are free.
• Your events, so they show on your Synclify calendar: the title, start and end of events on the calendars you choose that you own. For a calendar that is only shared with you, we see just the busy times. Anyone in your workspace who can see both Calls and the calendar can see these events. We read them from Google when the calendar opens, keep them for up to a minute so the page stays quick, and do not save them; your browser keeps the last calendar it showed for up to a day, and clears it when you sign out. We never read the description, guests or location of your events.
• The list of your calendars, their names and whether you own them, so you can choose which ones count as busy and which one bookings go into.
• The events Synclify creates for your bookings, each with a Google Meet link. We can change and delete only the events we created.
• The email address of the Google account you connected, so you can see which one it is.

Synclify's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train AI models, we do not sell it, and we do not use it for advertising. A person at Synclify can read it only with your permission, to fix a problem you reported, when the law requires it, or for security.

If you book a call on somebody's booking page, they receive your name, your email address, your phone number if they asked for it, your answers to their questions and the email addresses of any guests you add. We hold it on their behalf, email you and your guests the invite and any change to it, and keep it until they delete it. A one-way hash of your IP address and email address is used only to stop one sender flooding a page, and visits to a booking page are counted the way section 2.7 describes. You can have your details deleted at synclify.ai/remove-my-details without an account; any call still booked is cancelled and the person you booked is told.

2.10Autopilot

None of this exists until you turn on Autopilot. What Autopilot stores:

• Your Autopilot terms, every version, and who agreed to each (the consent record).
• The month's plan, each post's brief, its sources, the checks it passed or failed, and what happened to it.
• Footage you upload for Autopilot, the pieces it is cut into, frames taken from it, and a written transcript of what is said in it (the index). The transcript is made on the machine that cuts the footage. Documents you send (PDF, Word, Excel, PowerPoint, CSV, text) and the text read from them; audio and voice notes and a written transcript of what is said in them; files fetched from a Drive or Dropbox link you share; the dates, captions, scripts and notes found in them, which wait for you to confirm.
• Brand deals: the Instagram deliverables of a deal you log in Synclify (due date, brief, the brand's name and handle) are shown to you in Autopilot to confirm.
• Results of posts it made, read from Instagram, to learn what works for your account.

Likeness. Autopilot does not put your face in AI images unless you switch that on in your Autopilot terms.

Holdings and export. Everything above is part of your account export and is deleted with your account, except the minimal consent record, which is kept for 3 years after the account is deleted and then deleted.

4.1What the models do with it

We use these providers through their business API terms, under which content sent by us is not used to train their publicly available models. We do not control those providers' own policies and we link them rather than restating them, because a restatement can go stale without anybody noticing.

4.2Improving Synclify

We may use your content in anonymised and aggregated form to improve how Synclify itself works: to measure whether an analysis was accurate, and to test changes. Aggregated means combined with other accounts so that nothing traces back to you.

You can opt out of this entirely by emailing support@synclify.ai. Opting out does not reduce any feature you have paid for.

4.3What AI output is

Everything an AI model produces in Synclify is a suggestion. It can be wrong, and it can be confidently wrong. You are responsible for reading anything before you publish it. Where the product does not have the data to answer something, it is built to say so rather than to estimate, but that is a design commitment and not a guarantee about every possible output.

4.4Autopilot

Autopilot uses the same providers as the rest of Synclify, named in section 4: the AI models that plan, write, check and edit; the storage that holds your files; the machines that cut footage and render edits. xAI turns the reel's script into the voiceover, and turns speech in your audio, voice notes and footage into text. Drive and Dropbox files are fetched by our machines from a public download address; we never ask for your Google or Dropbox password.

6.1We review whether it is lawful first

No user data is disclosed until the request has been reviewed. Each one is checked to confirm that it:

• Comes from an authority with genuine jurisdiction over us.
• Is legally valid and follows the proper process for its type.
• Complies with the law that applies to it.
• Is specific, rather than a broad sweep for data about many people at once.

6.2We challenge requests we believe are unlawful

Where a request appears to be unlawful, disproportionate or overly broad, we will:

• Refuse it and require a proper legal basis.
• Ask for an overly broad request to be narrowed before we answer any of it.
• Take legal advice where the position is not clear.
• Tell the affected user, wherever we are legally permitted to tell them.

6.3We give the minimum

Where we are lawfully required to disclose data, we disclose only the specific items the order names. We do not supply additional context, adjacent records, or anything that was not asked for, and we do not treat a request for one thing as permission to hand over an account.

6.4We write it down

We keep a record of every government and law enforcement request: what was asked for, by whom, under what authority, what we decided, the reasoning, and what was ultimately disclosed.