Privacy Policy
Last updated: 12 November 2026
This policy explains what personal data we collect when you use Synkro, why we collect it, who receives it and what you can do about it. It covers the Synkro Staff apps for iOS and Android, the web app at app.synkro.co and the website at synkro.co.
Who we are
Synkro is operated by Epseelon OÜ, Narva mnt 5, 10117 Tallinn, Estonia. In this policy, "we" means Epseelon OÜ and "Synkro" means the apps and websites listed above.
We are the data controller for the personal data described in this policy, with one exception explained in the next section. You can write to us about anything in this policy at info@synkro.co.
Data that organizations put into Synkro
Event organizers use Synkro to coordinate their teams. The organization that creates an event decides who is invited to it and what goes into it: tasks, schedules, documents, and the names and email addresses of the people it invites.
For that content, the organization is the data controller and we act as its processor. We handle it only to provide the service, on the terms set out in the data processing section of our Terms and Conditions. If you were invited to an event and have a question about what an organizer has stored about you, please ask the organizer first. We will help them answer you.
What we collect and why
Your account
When you sign up we collect your email address, first name, last name and a password, and we record the date your account was created. We derive your initials from your name.
Passwords are handled by Firebase Authentication, which stores them in hashed form. We cannot read your password.
We use this data to create your account, sign you in and identify you to the people you work with. The legal basis is the performance of our contract with you.
Organizations, events and roles
We store the name of each organization you create or belong to, your role in each event (administrator, editor, teammate or provider) and the invitations you send and receive. An invitation contains the invited person's email address, first name and last name, who sent it, and whether it was accepted.
The legal basis is the performance of our contract with you. For people who are invited but do not have an account yet, it is the organizer's legitimate interest in inviting the members of its team.
Content
We store what you and your team put into Synkro: events (including their name, dates and location), tasks, documents and uploaded files, the tasks each person marks as done, and a history of the changes made to tasks. Task reminders are kept on your own device and are not sent to us.
The legal basis is the performance of our contract with you or with your organization.
Payments
Payments are processed by Stripe. Card numbers and other payment details go directly to Stripe and never reach our systems. We receive and keep a customer reference, the plan you bought, the status of your subscription, and your invoices with the billing details you gave at checkout.
The legal basis is the performance of our contract with you, and our legal obligation to keep accounting records.
Support
We provide support by email. If you write to us, we keep the correspondence: your email address, your messages and anything you attach to them.
The legal basis is our legitimate interest in answering you and supporting the people who use Synkro.
Diagnostics
We use Bugfender to find and fix faults. It records technical logs from the app, crash reports, and the screens and buttons used shortly before a problem occurred, together with the device model, operating system version and app version. In the web app it also records your browser's user agent. When you are signed in, these logs are labelled with the email address of your account so that we can investigate a problem you report.
The legal basis is our legitimate interest in keeping Synkro reliable and secure.
Notifications
If you allow notifications, we store a push token for each of your devices. It is what allows Synkro to send a notification to that device.
The legal basis is your consent, which you can withdraw at any time in your device or browser settings.
Location search
When you type the location of an event, the text you type is sent to Google Places so that it can suggest matching addresses. Synkro does not access the location of your device.
We send account emails (address verification and password reset) through Firebase Authentication and invitation emails through SendGrid. These providers process the recipient's name and email address and the content of the message.
Technical data
Our hosting provider, Firebase Hosting, logs the IP address, browser type and pages requested by each visitor, for security and delivery. The web app also loads its display engine and fonts from Google's servers, and a PDF display library from the cdnjs content delivery network operated by Cloudflare. Google and Cloudflare therefore receive your IP address.
The legal basis is our legitimate interest in delivering and protecting the service.
Storage on your device
Our Cookie Policy describes what Synkro stores in your browser or on your device.
What we do not do
- We do not sell or rent personal data.
- We do not show advertising, and we do not use advertising networks or marketing analytics tools.
- Synkro does not access your device's location, contacts, camera or microphone. It accesses your photos and files only when you choose one to upload.
- We do not make decisions about you by automated means that produce legal or similarly significant effects.
Synkro is not intended for children under 16, and we do not knowingly collect their data.
Who can see your information
The administrators of an organization and the people invited to an event can see the content of that event.
When an organizer invites someone to an event by typing their email address, Synkro checks whether that address already has an account. If it is yours, the organizer sees your name and initials. This is how organizers check that they are inviting the right person.
Who we share data with
We use the following providers to run Synkro. Each of them processes personal data on our behalf, under a contract and only for the purpose listed.
| Provider | What it does for us | Where it is based |
|---|---|---|
| Google (Firebase and Google Cloud) | Sign-in, database, file storage, server functions, web hosting, push delivery, address suggestions | Ireland and United States. Our database and server functions are located in the European Union. |
| Stripe | Payments, subscriptions and invoices | Ireland and United States |
| Bugfender (Beenario GmbH) | Technical logs and crash reports | Germany |
| SendGrid (Twilio) | Invitation emails | United States |
| Gandi | Our domain name and the mailbox we use for support email | France |
| Apple | Push delivery to Apple devices | United States |
| Cloudflare (cdnjs) | Delivery of a script library to the web app | United States, with a worldwide network |
We also disclose personal data when the law requires us to. If Synkro is ever transferred to another company, your data may be transferred with it, and we will tell you before that happens.
Transfers outside the European Economic Area
Some of these providers are based in, or use infrastructure in, the United States and other countries outside the European Economic Area. Where personal data is transferred there, it is protected either by an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for providers certified under it) or by the standard contractual clauses approved by the European Commission. You can ask us for more detail about these safeguards.
How long we keep data
- Account and content: for as long as your account exists, or for as long as your organization keeps the event.
- Account deletion: when you ask us to delete your account, as explained on the account deletion page, we delete your account data and the events, tasks and documents you created within 48 hours of handling your request.
- Billing records: seven years from the end of the financial year concerned, as required by the Estonian Accounting Act.
- Support emails: until your account is deleted, or earlier if you ask us to delete them.
- Diagnostic logs: for a limited period, after which they are deleted automatically.
- Invitations that were not accepted: until the organizer withdraws them or deletes the event.
Copies may remain in our providers' backups for a limited time before they are overwritten.
Your rights
Under the General Data Protection Regulation you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- have the processing of your data restricted;
- receive the data you gave us in a portable format;
- object to processing that is based on our legitimate interests;
- withdraw a consent you gave, without affecting what was done before you withdrew it.
To exercise any of these rights, write to info@synkro.co. We answer within one month. We may need to check your identity first, usually by asking you to write from the email address of your account.
You also have the right to lodge a complaint with a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You can also contact the authority of the country where you live or work.
Security
Data is encrypted in transit and at rest on our providers' infrastructure. Access to the tasks and documents of an event is restricted to the administrators of the organization and the people invited to that event. Administrative access to our systems is limited to the people who need it to run and support Synkro.
No system is perfectly secure. If a security incident affects your personal data, we will inform you and the authorities as the law requires.
Changes to this policy
We will update this page when our practices change and revise the date at the top. If a change is significant, we will also tell you by email or in the app before it takes effect.
Contact
Epseelon OÜ, Narva mnt 5, 10117 Tallinn, Estonia. Email: info@synkro.co.