SYNFIALabs
    Legal

    Privacy Policy

    Data Protection Information: Responsibility and Scope of Application

    The protection of your personal data is of central concern to us. We process your data exclusively on the basis of applicable data protection laws, in particular the General Data Protection Regulation (GDPR) of the European Union and the Data Protection Act of the United Kingdom.

    This data protection information applies to:

    Website:
    synfia.ai (and associated subdomains)

    Services:
    Synfia Web App – Configuration, execution and evaluation of AI-supported voice and text surveys

    Responsible for data processing:

    Synfia Labs FlexCo
    Neubaugasse 36 1070 Vienna Austria
    hello@synfia.ai

    This data protection information is addressed to the following groups of persons:

    • Visitors to our website
    • Interested parties in our services
    • Employees of customer companies using Synfia
    • Participants in surveys conducted via Synfia

    Purpose Determination for Processing Personal Data

    Website Provision (Website Hosting)

    For the operation of our website synfia.ai, we use hosting services from the following providers:

    • Railway Corp., 548 Market St PMB 68956, San Francisco, CA 94104, USA
    • Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus

    Personal data processing (e.g. IP addresses, technical usage data) may also take place in the USA. We expressly point out that, according to the assessment of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This may entail risks regarding the lawfulness and security of processing.

    As a basis for data transfers to third countries, we use standard contractual clauses approved by the EU Commission (according to Art. 46 Para. 2 and 3 GDPR). These clauses oblige Railway Corp. to ensure the European data protection level even when processing relevant data outside the EU.

    Further information on the standard contractual clauses and data protection of the providers can be found here:

    • Railway Corp. – Data Processing Agreement
    • Hostinger – Privacy Policy

    Processed data categories:

    • IP address and technical connection data
    • Browser information
    • Operating system
    • Date and time of access
    • Referrer URL

    Rechtsgrundlage:
    Legal basis: Legitimate interest according to Art. 6 Para. 1 lit. f GDPR (website operation, system security, error analysis)

    User Behavior Analysis (Web Tracking)

    We use various tracking technologies on our website to analyze user behavior, create reach statistics, optimize user experience and control our marketing measures.

    The following tools are used:

    • Google Analytics
    • Google Tag Manager
    • Meta Pixel
    • LinkedIn Insight Tag (LinkedIn Pixel)
    • TikTok Pixel

    Providers of these services:

    • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
    • Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland
    • LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland
    • TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

    When using these tools, cookies are set and data is transferred to the servers of the respective providers, which may be located in the USA, among other places. We expressly point out that, according to the assessment of the European Court of Justice, there is currently no equivalent level of protection for data transfers to the USA. This may entail risks for the lawfulness and security of processing your data.

    For security, we use standard contractual clauses approved by the EU Commission (Art. 46 Para. 2 and 3 GDPR), which oblige the providers to comply with the European data protection level.

    Processed data categories:

    • IP address (possibly shortened/anonymized)
    • Usage and interaction data (e.g. pages viewed, clicks, scroll depth)
    • Device information (e.g. operating system, browser, device type)
    • Referrer URL
    • Date and time of access
    • Location data (with consent)
    • Cookies and similar technologies

    Rechtsgrundlage:
    Legal basis: Consent of the data subject according to Art. 6 Para. 1 lit. a GDPR

    Widerruf der Einwilligung:
    Withdrawal of consent: You can withdraw your consent to the use of these tracking technologies at any time by deactivating the corresponding options in the cookie settings on our website.

    Additional information from providers:

    • Google: https://policies.google.com/privacy
    • Meta (Facebook/Instagram): https://www.facebook.com/privacy/policy/
    • LinkedIn: https://www.linkedin.com/legal/privacy-policy
    • TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en

    Participation in a Demo Survey

    On our website, you have the opportunity to start a demo survey to learn how Synfia works. As part of this demo, your information is processed and evaluated.

    Collected and processed data categories:

    • Identification features (e.g. name, if provided)
    • Company-related information (if provided)
    • Contact data (e.g. email address, if entered)
    • Content you enter or speak during the demo survey
    • Technical data (e.g. IP address, browser information)

    Rechtsgrundlage:
    Legal basis: Legitimate interest according to Art. 6 Para. 1 lit. f GDPR (provision and optimization of the demo offer)

    Integrated data processors:

    • ElevenLabs Inc., 169 Madison Ave #2484, New York, NY 10016, United States
    • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
    • OpenAI, L.L.C., 3180 18th St, San Francisco, CA 94110, United States

    Additional information: We ask you not to provide special categories of personal data (Art. 9 GDPR) as part of the demo survey. This includes in particular data on: ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric characteristics, health data, sex life or sexual orientation.

    If you do not want to provide this data, you can refrain from using the demo survey.

    Contact via Email

    We provide an email address on our website through which you can contact us (e.g. for inquiries about our services or to arrange appointments).

    Collected and processed data categories:

    • Email address
    • Name (if provided)
    • Content of your email message
    • Communication metadata (date, time, IP address)

    Rechtsgrundlage:
    Legal basis: Legitimate interest according to Art. 6 Para. 1 lit. f GDPR (communication with prospects and customers)

    Additional notes: The legitimate interest based on the legal basis consists in processing your inquiry and communicating about offered products and services.

    We ask you not to transmit special categories of personal data according to Art. 9 GDPR in your email correspondence. This includes, for example, information on: health, ethnic origin, political opinions, religious or philosophical beliefs, sex life or sexual orientation.

    Integration of Google Fonts

    For uniform and appealing display of fonts on our website, we use the Google Fonts service, provided by:

    Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland

    When you access our website, your browser loads the required web fonts directly from Google's servers. Your IP address is transmitted to Google and Google becomes aware that our website was accessed via your IP address.

    Collected and processed data categories:

    • IP address
    • Browser information
    • Operating system
    • Date and time of access
    • Referrer URL

    Legal basis:
    Legal basis: Consent of the data subject according to Art. 6 Para. 1 lit. a GDPR

    Withdrawal of consent:
    Withdrawal of consent: You can withdraw your consent at any time via the cookie settings on our website.

    Additional information:
    Additional information: Further information on data processing by Google can be found in Google's privacy policy: https://policies.google.com/privacy

    Online Appointment Booking

    On our website, you can schedule appointments with us. We use the service provider Cal.com for this. Using the appointment booking function may result in data transfer to third countries.

    Provider of this service: Cal.com Inc., San Francisco Bay Area, West Coast, USA

    Collected and processed data categories:

    • Identification features (e.g. name)
    • Contact data (e.g. email address)
    • Company-related information (if provided)
    • Information about your appointment request
    • Free text entries
    • Technical data (e.g. IP address, browser information)
    • Cookies

    Legal basis:
    Legal basis: Consent of the data subject according to Art. 6 Para. 1 lit. a GDPR

    Additional notes:
    Additional notes: If you do not want data transfer, you cannot use online appointment booking and can instead schedule an appointment by phone or email.

    Further information:
    Further information: Detailed information on data protection at Cal.com can be found in Cal.com's Privacy Policy: https://cal.com/privacy

    Newsletter Dispatch

    You have the opportunity to sign up for our newsletter on our website to regularly receive information about our company, new features or offers.

    Collected and processed data categories:

    • Email address
    • Name (if provided)
    • Interaction data with the newsletter (e.g. opens, clicks)
    • IP address (during registration and use)
    • Cookies

    Legal basis:
    Legal basis: Consent of the data subject according to Art. 6 Para. 1 lit. a GDPR

    Withdrawal of consent:
    Withdrawal of consent: You can withdraw your consent at any time with effect for the future by using the unsubscribe link in the newsletter or sending us a message to the contact address mentioned above.

    Integrated data processors:
    Integrated data processors: Resend Inc., 2261 Market Street #4375, San Francisco, CA 94114, United States

    Additional information:
    Additional information: Further details on data protection at Resend can be found here: https://resend.com/legal/privacy-policy

    Display of Third-party Content via Social Media Plugins and Widgets

    We have integrated social media plugins and widgets on our website to show you additional content, improve your user experience and optimize our marketing measures. This may result in data transfer to third countries.

    We particularly use the following integrations:

    • Facebook plugins (e.g. Like button)
    • YouTube embeds

    Providers of these services:

    • Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland
    • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

    When you access a page of our website that contains such a plugin, your browser automatically establishes a direct connection to the servers of the respective providers. Depending on the configuration and your user account (if you are logged in there), personal data is transmitted.

    Collected and processed data categories:

    • IP address
    • Browser and device configuration
    • Date and time of access
    • URL of the accessed page
    • Data on interactions with plugins or embedded content
    • Cookies
    • Location data (with consent)

    Legal basis:
    Legal basis: Consent of the data subject according to Art. 6 Para. 1 lit. a GDPR

    Withdrawal of consent:
    Withdrawal of consent: You can withdraw your consent at any time via the cookie settings on our website.

    Additional information from providers:

    • Facebook Plugins: https://developers.facebook.com/docs/plugins
    • Facebook Privacy Policy: https://www.facebook.com/privacy/policy/
    • YouTube / Google: https://policies.google.com/privacy

    Important note: If you are logged into Facebook or YouTube, the provider can associate the visit to our website with your profile. To prevent this, log out of the respective services before visiting our website.

    We have no influence on the data processing of these third-party providers. Please refer to the respective privacy policies for further information.

    Purpose Determination for Processing Personal Data: B2B synfia.ai Web App – Configuration and Management of AI-supported Surveys

    As part of using our Synfia SaaS platform, we process personal data to provide, configure and manage AI-supported voice and text surveys.

    App Hosting

    Collected and processed data categories:

    • Technical data (e.g. IP address, device information)
    • Log data for error analysis and system security
    • Platform usage data (e.g. logins, actions)

    Legal basis:
    Legal basis: (Pre-)contractual obligations according to Art. 6 Para. 1 lit. b GDPR

    Integrated data processors:
    Integrated data processors: Railway Corp., 548 Market St PMB 68956, San Francisco, CA 94104 (Server location: Amsterdam, Netherlands)

    Additional information:
    Additional information: The location of the data center used is within the EU in Amsterdam.

    Provision of the Offered Service

    We process data to enable you to configure, conduct and evaluate surveys with AI language models.

    Collected and processed data categories:

    • Contents of AI prompts and responses
    • Configuration settings
    • Project and campaign information
    • Technical access data (e.g. API keys)
    • Contact and account data
    • Uploaded media files (audio, text) if applicable

    Legal basis:
    Legal basis: (Pre-)contractual obligations according to Art. 6 Para. 1 lit. b GDPR

    Integrated data processors:

    • Railway Corp., Server location EU (Amsterdam)
    • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
    • OpenAI, L.L.C., 3180 18th St, San Francisco, CA 94110, United States
    • ElevenLabs Inc., 169 Madison Ave #2484, New York, NY 10016, United States

    Additional notes:
    Additional notes: We point out that when using AI-based services (OpenAI, ElevenLabs), transmission to the USA may take place. For security, we use the EU Commission's standard contractual clauses.

    Customer Registration

    Collected and processed data categories:

    • Name
    • Company information
    • Contact data (email, phone number)
    • Authentication data (password hashes, tokens)
    • Usage and access data

    Legal basis:
    Legal basis: (Pre-)contractual obligations according to Art. 6 Para. 1 lit. b GDPR

    Integrated data processors:
    Integrated data processors: Okta, Inc., 100 First Street, San Francisco, CA 94105, USA Data centers: Dublin (Ireland) and Frankfurt (Germany)

    Payment Processing and Invoicing

    For payment processing, we use the service provider Stripe. The processing of payment data is carried out via Stripe's European subsidiary, but may include transmission to the USA.

    Payment service provider used: Stripe Payments Europe Ltd. 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland

    Collected and processed data categories:

    • Payment information (e.g. credit card data, bank details, billing address)
    • Invoice data
    • Transaction data (amount, date, purpose)
    • IP address
    • Device and browser information
    • Cookies and similar technologies

    Legal basis:

    • Fulfillment of a legal obligation according to Art. 6 Para. 1 lit. c GDPR (e.g. tax and commercial law retention obligations)
    • (Pre-)contractual obligations according to Art. 6 Para. 1 lit. b GDPR
    • Standard contractual clauses of the EU Commission (security of data transfers to the USA)

    Additional information:
    Additional information: Stripe may also transfer personal data to third countries (particularly the USA). For security, we use standard contractual clauses according to Art. 46 Para. 2 and 3 GDPR. More detailed information on data protection at Stripe can be found here: https://stripe.com/at/privacy

    Sending Product News

    We regularly inform our customers about new features, relevant changes and developments of the Synfia platform. We send product news in the form of emails.

    Collected and processed data categories:

    • Name (if provided)
    • Email address
    • Account information (for assignment to customer account)
    • Information about interactions with emails (opens, clicks, unsubscribes)
    • IP address (during sending and retrieval)

    Legal basis:
    Legal basis: Legitimate interest according to Art. 6 Para. 1 lit. f GDPR (Interest in informing existing customers about product-related changes and improvements)

    Withdrawal option:
    Withdrawal option: You can object to receiving product news at any time, e.g. via the unsubscribe link in each email or by notifying our contact address.

    Integrated data processors:
    Integrated data processors: Resend Inc. 2261 Market Street #4375, San Francisco, CA 94114, United States

    Additional information:
    Additional information: Further information on data protection at Resend can be found here: https://resend.com/legal/privacy-policy

    Cookies and Local Storage Technologies

    Our website uses cookies and local storage technologies (Local Storage and Session Storage) to provide essential functions, improve user experience, enable analytics and control marketing measures.

    Rechtsgrundlagen:
    Legal basis: The respective legal basis depends on the purpose:

    • Technically necessary cookies: legitimate interest according to Art. 6 Para. 1 lit. f GDPR
    • All other cookies: consent according to Art. 6 Para. 1 lit. a GDPR

    Hinweis:
    Note: You can set in your browser settings at any time whether cookies may be stored. You can also withdraw your consent to the use of non-necessary cookies via the cookie settings on our website.

    Data Retention Period

    We only keep your personal data for as long as necessary to achieve the purposes stated in this privacy policy or as required by legal retention periods.

    After the respective processing purpose ceases to exist or legal deadlines expire, the data is routinely deleted.

    Data Sharing

    Personal data is only shared:

    • For contract fulfillment to integrated data processors (see above)
    • If you have expressly consented
    • If we are legally obligated to do so
    • To protect legitimate interests (e.g. assertion of legal claims)

    Your data is not sold to third parties.

    Protection of Personal Data

    We implement appropriate technical and organizational measures to protect your data from manipulation, loss, destruction or unauthorized access. These include:

    • Encryption of connections (TLS)
    • Access controls
    • Logging of accesses
    • Minimization of stored data

    Obligation to Provide Data

    When visiting the website: No legal or contractual obligation. However, without processing certain technical data, the website cannot be displayed correctly.

    When using our services: Certain information is required to conclude and fulfill contracts. Without this information, the services cannot be provided.

    Withdrawal of Given Consent

    If you have given us consent (Art. 6 Para. 1 lit. a GDPR), you can withdraw it at any time with effect for the future.

    The legality of processing carried out until withdrawal remains unaffected.

    Rights of Data Subjects

    You have the following rights:

    • Information (Art. 15 GDPR)
    • Rectification (Art. 16 GDPR)
    • Erasure (Art. 17 GDPR)
    • Restriction of processing (Art. 18 GDPR)
    • Data portability (Art. 20 GDPR)
    • Objection (Art. 21 GDPR)
    • Withdrawal of consent (Art. 7 Para. 3 GDPR)
    • Complaint to a supervisory authority (Art. 77 GDPR)

    How to exercise your rights:
    How to exercise your rights: You can reach us using the contact details provided at the beginning of this privacy policy.

    Data Deletion Request:
    You can submit a request to delete your personal data through our data privacy portal.

    Go to Data Privacy Portal

    Changes to This Privacy Information

    We reserve the right to adapt this privacy policy to bring it in line with changed legal situations or new services.

    The current version is published on our website.

    Date of publication of the current version: 02.07.2025