Privacy policy

Last updated: October 2026

Who we are

[Nome legal da Agência], tax number [NIF da Agência], registered at [Morada da sede da Agência], is the controller of this site's data and of the Synkora platform accounts.

For any request about your data, write to support@synkora.pt.

What data we handle and why

• Proposal requests. Name, email, company, country and message, to answer your request. We keep them for 180 days.
• Waiting list. Only your email, to tell you when Synkora opens. After that message, we delete it.
• Platform account. Name, email and password (stored hashed, never as text), or, if you sign in with Google, only the email, the name and the Google account id. They are used to provide the service you signed up for.
• Acceptance of the terms. When you create the account, we keep the version of the terms you accepted, the date, the professional-use declaration and an encrypted digest of the IP address (never the address itself), to prove the acceptance. We keep it while the account exists.
• Billing. Company name, address and tax number, for the invoices. Payments are made on Stripe: we never see or store card details.
• Security. To stop abuse of the form, we keep only a hashed summary of the IP address for one hour, never the address itself.

The data of each company's customers

On the platform, the data each business keeps (customers, orders, conversations) belongs to that business. The business is the controller and we are its processor, under the data processing agreement (Article 28 GDPR). We only process that data to provide the service and on the business’s instructions.

If you are a customer of a company that uses the platform and want to use your rights, contact that company. If needed, we help.

If you book on a company's booking page, you can ask for notices on your phone (push notifications), only if you want them. We keep the technical address your browser gives us for this, linked only to that booking, and delete it when the booking is over or cancelled, or when you turn the notices off. The notices only say the company's name and the day and time.

Where it is kept and who helps us

The platform data is hosted in data centres in the European Union. We work with these processors, each under its own data processing agreement:

• Cloudflare: hosting, database and files, in the European Union.
• Stripe: payments and subscription billing.
• Resend and Amazon SES: sending the service's emails.
• TOConline: the certified invoices for the subscription, in Portugal.
• Google: only if you choose to sign in with Google, if the business connects Google Calendar (coming soon) or, for the websites we run, for Search Console and Analytics.
• Google Analytics: on this site, only if you accept visit measurement (see Cookies and visit measurement).
• Meta: only if the company connects WhatsApp, Instagram or Messenger.
• The business’s certified invoicing (TOConline or InvoiceXpress; Moloni coming soon): only if the business connects its own account; the data stays in Portugal.

Some of these providers (Stripe, Google, Meta and the email providers) may process data outside the European Economic Area. They do so with the safeguards the GDPR requires: an adequacy decision in force at the time of the transfer, such as the EU-US Data Privacy Framework, or the European Commission's standard contractual clauses.

For how long

• Proposal requests: 180 days, then deleted automatically.
• Waiting list: until the opening message, at most one year, then it is deleted.
• A company's account and data: while the account exists; you can export everything at any time. With a paid subscription, the account closes at the end of the period already paid. Once the account is closed, we keep the data for 90 days, so you can reopen it or export it, and then delete everything, including the archive and the weekly copies.
• Invoices: 10 years, as Portuguese law requires.
• Change history (“Who changed what”): deleted after 30 days on the Bookings and Essential plans and during the trial, 180 days on Business and 365 days on Enterprise, with no copy.
• Conversation messages: on the Bookings and Essential plans and during the trial, messages older than 12 months leave the database for the business’s own archive, also in the European Union, which the owner can download; on Business and Enterprise they stay in the database.
• Technical records: automation runs are deleted after 90 days, request counters after 400 days and failed sign-in attempts after 30 days.

Data we receive from Google

We only receive data from your Google account when you choose one of these connections, and only what each one needs:

• Sign in with Google. Your name, email and Google account ID (the openid, email and profile scopes), to create the account and sign in without a password.
• Google Calendar (coming soon), when the business connects it. The list of your calendars (the calendar.calendarlist.readonly scope), to choose which one to connect, and the events of the chosen calendar (the calendar.events scope), to sync the workspace bookings both ways.
• Search Console and Analytics, for the websites we run. Only for customers whose website we built: that site's search and visit reports, and verifying and setting up the property, to show the figures in the workspace. The property stays in the customer's Google account.

We use this data only for these features. We do not sell it, we do not use it for advertising and we do not share it with third parties, except the processors on this page, to provide the service. Use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect it in the workspace or remove access at any time at myaccount.google.com/permissions. When the connection is removed, we delete the stored access keys.

Cookies and visit measurement

The platform uses only the cookies needed to keep you signed in and, while signing in with Google, a temporary security cookie. We use no advertising cookies.

This site uses cookies only if you accept visit measurement with Google Analytics, in the notice shown on your first visit.

Google Analytics 4, only if you accept. If you choose “Accept” in the cookie notice, we use Google Analytics 4 to understand how the site is visited: pages viewed, where you came from, the type of device and browser, the approximate country and city, and how long the visit lasted. To do this, Google stores cookies whose names start with _ga in your browser, with a random identifier. Google Analytics 4 does not store IP addresses. Advertising signals are switched off and we do not link this data to your identity.

Google Ireland Limited processes this data as our processor and may transfer it outside the European Economic Area, with the safeguards described above. The data is kept in Google Analytics for 14 months at most, and the cookies expire after 2 years at most.

The legal basis is your consent: without it, Google Analytics is not loaded. You can change your mind at any time under “Cookie preferences”, at the bottom of every page; if you decline, we delete this site’s _ga cookies. Your choice is kept in this browser (not in a cookie) for 6 months; after that, we ask again.

Your rights

You can ask to access your data, correct it, delete it, restrict or object to its processing, and receive it in a format you can take to another service. We answer within one month.

If you think we have not handled your data properly, you can complain to the Portuguese data protection authority (cnpd.pt) or to the data protection authority of your country.

Changes

If this policy changes, we publish the new version here. If the change is important, we tell account holders by email.