What we hold, and why we hold it

Synclify is an Instagram operations tool. To do its job it reads your Instagram account, stores what it read, and works on it. This policy explains what that means in practice: what is collected, why each thing is collected, who else it reaches, how long it stays, and the rights you have over it.

It applies to the Synclify web application, the Synclify iPhone application, and this website. It applies whether you are a creator running one account, a brand buying collaborations, or an agency managing accounts for other people.

By using Synclify you agree to this policy. If you do not agree with it, do not connect an account. Where this policy and any other page on this website disagree, this policy is the one that governs.

This policy is written to be read. Every section below carries a plain-English line above the formal text. The plain line is there to help you find the part you want; the text underneath it is the part that binds.

The list above names every category of personal data the product holds. The subsections here describe each group and what causes it to exist.

We use the data described above for the following purposes and no others:

• To provide the product: publishing scheduled posts, showing your analytics, running the automated replies you configured, and keeping your workspace working.
• To generate the drafts, analyses and suggestions you ask for, as described in section 4.
• To compare your account against the competitor accounts you chose to track.
• To bill you, collect payment, and produce invoices and receipts.
• To send you service messages: security alerts, billing notices, failures that affect you, and the weekly digest if you have not turned it off.
• To answer you when you contact support.
• To detect and prevent fraud, abuse, and unauthorised access.
• To meet legal, tax and accounting obligations.

Nothing is published to your Instagram account, and no message is sent from it, until you approve it. The product drafts, schedules and prepares, and every one of those shows you a preview and waits for you to tap approve. Scheduling is publishing with a delay, so it waits for the same tap.

We do not use your data to build advertising profiles, and we do not use it to make decisions about you that produce legal effects without a person involved.

Where you are in a jurisdiction that requires a lawful basis to be named, ours are: performance of a contract, for everything needed to deliver the product you signed up for; legitimate interests, for security, fraud prevention and service improvement; consent, for optional marketing messages, which you may withdraw at any time; and legal obligation, for tax and accounting records.

Synclify uses AI models to write drafts, read images, analyse your content, generate pictures and translate. Three providers are used and all three are named in the processor table above: OpenAI, Google through Google's Gemini models, and xAI for the pictures the studio makes.

What is sent to them is the specific content the task requires. Asking for a caption on a post sends that post. Asking what your last month looked like sends the figures for that month. Your whole library is not uploaded, and your password, payment details and access tokens are never sent to a model.

We do not sell your personal data, and we do not share it for anybody else's advertising. We have never done either.

Your data reaches other companies only in the circumstances below:

• Processors: the thirteen companies named in the table above, each of which sees only the part described beside it, and each of which is bound to use it only to provide that service to us.
• Meta: requests we make to Instagram on your behalf, which is the mechanism by which the product works at all.
• Inside your own organisation: if you are on a team or agency account, the people you invited can see what their role permits. The account owner controls this.
• Legal requirements: where we are compelled, subject to the review process in section 6.
• A business transfer: if Synclify is acquired or merged, your data may transfer with it. You would be told before it did, and this policy or one at least as protective would continue to apply.
• With your consent: anything else, and only after you have agreed to it.

An agency using Synclify to manage your account is a separate controller of the data it holds about its own clients. Its arrangement with its clients is its own, and we are not a party to it.

A brand cannot see what an agency paid a creator, and a creator cannot see a brand's other collaborations. There is no cross-organisation visibility in the product and nothing in this policy should be read as creating any.

Most privacy policies do not publish this. We do, because a commitment nobody can read is not a commitment. When a government body or law enforcement agency asks us for user data, the following applies to every request without exception.

The measures below are the ones actually in place. We have deliberately not listed certifications we do not hold or audits we have not had.

• All traffic between you and Synclify uses TLS. The site and application are served over HTTPS only.
• Data is encrypted at rest in the database.
• Instagram access tokens are encrypted separately with aes-256-gcm, an authenticated cipher, so a token cannot be silently altered as well as not being readable.
• Passwords are stored only as hashes. We cannot read your password, and neither can anybody who obtains the database.
• Access to production systems is limited to the engineers who need it, and is authenticated.
• Permissions inside the product are enforced on the server for every request, not only hidden in the interface.

No system is perfectly secure and anybody who tells you otherwise is selling something. We cannot guarantee absolute security. If a breach affects your personal data we will notify you and the relevant supervisory authority within the time limits the applicable law sets.

If you believe you have found a security problem, email support@synclify.ai and say so in the subject line. We will not pursue anybody who reports a genuine vulnerability to us in good faith and gives us a reasonable chance to fix it.

Data is kept for as long as your account is active, and then for the periods below:

• Account data: until you delete your account.
• Instagram content and performance data: while your account is active, and removed when the account is deleted.
• Competitor data: kept for a limited period and then discarded, because a snapshot of somebody else's public posting is stale quickly and there is no reason to hold it longer.
• AI drafts and transcripts: a 365 day window, and what happens at the end of it differs by kind. The Trust page sets out which are deleted and which are kept whole.
• WhatsApp messages: kept while the handset is linked, and removed when you unlink it.
• Technical logs: kept for a short period for security and debugging.
• Invoices and payment records: kept for the statutory accounting period, which we cannot shorten at your request because the law requires them.

When you delete your account we remove your personal data from our production systems within 30 days, except records we are legally required to keep. Backups are cycled out on their own schedule and are not used to restore deleted accounts.

Retention is enforced by scheduled deletion in the product rather than by anybody remembering to run it. The specific windows are set out on our Trust page, along with the one category the product refuses to touch: the drafts, captions and scripts you made, which are your own work and are kept whole rather than being stripped of their identifying parts.

Depending on where you live, you have some or all of the following rights. We apply them to everybody regardless of location, because operating two standards is how the lower one becomes the real one.

• Access: ask for a copy of the personal data we hold about you.
• Correction: have inaccurate data corrected. Most of it you can correct yourself in Settings.
• Deletion: have your data deleted, subject only to records we are legally required to keep.
• Portability: receive your data in a structured, machine-readable format. Export is built into the product and you do not need to ask us.
• Restriction: ask us to stop processing something while a dispute about it is resolved.
• Objection: object to processing we carry out on the basis of legitimate interests.
• Withdraw consent: for anything you consented to, including marketing and the AI improvement use in section 4.2.
• Complain: to your local data protection authority, at any time, without going through us first.

To use any of these, email support@synclify.ai. We will respond within 30 days. We will not charge you, and we will not ask you why.

We may ask you to confirm who you are before we act on a request, which is a protection for you rather than an obstacle: handing an account's data to somebody who merely claims to own it is itself a breach.

We use cookies and equivalent local storage for:

• Keeping you signed in between visits, which is required for the product to work at all.
• Remembering your preferences, such as which view you last had open.
• Understanding which features are used, so that unused ones can be removed.
• Counting visits to the marketing website, through Google Analytics. This one is on synclify.ai only and never inside the product.

Visitors in the United Kingdom, the European Economic Area and Switzerland are counted without that last cookie. Google Analytics is told not to store anything on your device in those places, so it reports those visits as totals rather than as people, and there is nothing to ask your permission for.

We do not set advertising cookies and we do not permit third parties to set them on our pages. Google's advertising and personalisation storage is switched off for every visitor everywhere, not only the ones the law requires it for, because we run no ads and nothing here should feed one. You can block or delete cookies in your browser; blocking the essential ones will stop you being able to stay signed in.

Synclify is operated from India. Several of the processors named above operate in the United States and the European Union, so your data is transferred internationally in the course of running the service.

Where a transfer is made out of a jurisdiction that restricts it, we rely on the appropriate safeguard for that jurisdiction, which for transfers out of the European Economic Area and the United Kingdom means the Standard Contractual Clauses. You may request details of the safeguard applying to a particular transfer.

Synclify is not intended for anybody under 18 and we do not knowingly collect personal data from children. Instagram's own terms set a minimum age of 13; ours is higher because the product handles contracts, invoices and payments.

If you believe a child has created an account, tell us and we will delete it and the data attached to it.

We may update this policy. The date at the top of this page is the date of the current version.

For a change that materially affects your rights or expands what we collect, we will email you before it takes effect and give you the opportunity to close your account instead. For corrections and clarifications we will update the page and move the date. Continuing to use Synclify after a change takes effect means you accept it.

For anything in this policy, to use one of the rights in section 9, to opt out of the use described in 4.2, or to report a security problem, email support@synclify.ai.

If you are in the European Economic Area or the United Kingdom you also have the right to complain directly to your national data protection authority, and you do not have to contact us first.