Privacy policy

1. Who to contact and our role

Sync Scala operates this service under the Sync Scala name. Contact support@syncscala.com or use our contact form for a privacy request. Please identify the account or contact record concerned and what you would like us to do. Do not include identity documents or sensitive information unless we ask for information necessary to verify the request.

We determine how account administration, service security and support information are used. When an organisation uploads contact data and instructs us to process it on its behalf, that organisation determines the purpose of that processing. An applicable data processing agreement must govern processing that requires one. If your request concerns such a customer's records, we may need to assist or direct it to that organisation. We remain responsible for processing purposes that we determine ourselves.

2. Information you give us

We collect information needed for the features you choose. Required fields are identified when you register or submit a form. Without required account information we cannot create and secure an account; without a reply address we cannot respond to your enquiry. Optional business details help tailor your buyer profile but should be limited to what is relevant.

• Account information: name, email address, password hash, account role, acceptance of terms and account creation time. Passwords are hashed rather than stored as readable passwords.
• Password recovery: when requested, we send a reset link to your account email and store a hash of its single-use token with creation and expiry times. Links expire after 30 minutes. A completed reset removes the reset record and ends existing sign-in sessions; expired records are cleaned during later recovery requests. Email systems also process the delivery message.
• Business inputs: website URL, company or offer description, target regions, company sizes, buyer preferences, pricing context, profile edits and approvals.
• Workspace information: submitted or retrieved website content, generated buyer profiles, imported contact rows and field mappings, research runs, results, exported records and suppression information.
• Usage records: credit grants, holds, charges and releases; provider request identifiers, timestamps, outcomes and cost receipts; AI model identifiers and token or cost information when available.
• Contact requests: the name, reply email, subject, message and privacy acknowledgement you provide, plus submission time. The form stores the request for review; it does not sign you up for marketing.

3. Information from the service and other sources

Our website and infrastructure process technical request information needed to deliver and protect the service, which can include IP addresses, browser request details, request times and error records. A first-party session cookie keeps you signed in. Our Cookies policy describes it and the local preference used to remember the cookie notice.

Where a website-reading or enrichment integration is enabled and you request it, information can come from the website you submit and the provider responding to that request. Business-contact fields can include a person's name, employer, job title, work email, professional profile URL and company information. Imported files may also contain contact fields supplied by the customer. Phone-number discovery is not currently enabled.

Source data may originally come from public professional sources, customer submissions or a provider's licensed collection. We do not claim that every underlying source is public or that every record was supplied directly by the person concerned. Provider references and request receipts help identify the source used for a particular operation. Contact us if you want to ask where information about you came from.

4. Purposes and legal bases

Where UK or European data-protection law applies, a purpose needs an appropriate lawful basis. The basis depends on the relationship and processing involved. Accepting our terms or acknowledging this policy does not by itself constitute consent to unrelated processing or marketing.

• Account access and features you request: performing our agreement with you, or taking requested steps before an agreement. Where your employer is the customer, our legitimate interest is providing and administering the service for that organisation.
• Support and enquiries: responding to your request and providing the service, using contract where applicable or our legitimate interest in handling enquiries and resolving issues.
• Security, reliability and misuse prevention: our legitimate interests in protecting accounts, investigating faults and preventing fraud or abuse, balanced against the impact on people.
• Credit and operational records: performing the service agreement and our legitimate interests in accurate usage accounting and dispute resolution. Specific legal obligations may require some records to be retained or disclosed.
• Customer-directed contact processing: the customer's documented instructions and applicable processing agreement govern our role. The customer must establish its own lawful basis and outreach permissions. A verified address is not a lawful basis.
• Privacy requests, legal claims and required disclosures: complying with applicable legal obligations or establishing, exercising or defending legal rights where permitted.
• Optional activities that require consent: a separate, informed choice before that activity begins. We currently do not run advertising or optional analytics trackers on these pages.

5. AI-assisted buyer profiles

When you request an AI-generated buyer profile, relevant business descriptions, website material and generation instructions are sent to the configured AI service. The integration supports OpenRouter and, where configured, Anthropic. OpenRouter can route the request to the provider operating the selected model. Model and generation records are kept with the operation where available.

Do not include secrets or unnecessary personal information in prompts or business descriptions. Provider retention and model-use policies depend on the selected service and its applicable terms. We do not make a blanket promise that every model provider offers zero retention or excludes all training use. Ask us about the active provider before sending material subject to additional restrictions.

AI output is used to assist business research and remains subject to your review. Sync Scala is not designed to make solely automated decisions about an individual's employment, credit, insurance or other matters with legal or similarly significant effects.

6. Who can receive information

Information is accessible to the account using the relevant workspace and to authorised operators or service providers where access is needed to run, support or protect the service. We do not publish account details or support requests as a public directory. Exporting data creates a separate copy under the exporting customer's control.

• Hosting and infrastructure providers process service traffic, application data, logs and backups as needed to host and maintain the service.
• Configured AI services receive the inputs needed for the generation you request, as explained above.
• Enabled website-reading and business-data integrations receive the domain, filters or contact fields necessary for the requested operation. The current enrichment integration is Treg and its relevant downstream provider routes; it is unavailable until activated.
• Authorised people reviewing support requests receive the information submitted in the form and relevant account or troubleshooting records.
• Professional advisers, authorities or other recipients may receive information when required by law or necessary to establish, exercise or defend legal rights, with disclosure limited to what is appropriate.
• Payment processing is not active at this launch. We will update the relevant notices before enabling paid checkout. Do not send payment-card details through the contact form.

7. International processing

AI, infrastructure and data providers may process information in countries different from your own. The countries and protections involved depend on the provider and service configuration. This policy is not a representation that all processing stays in the UK or the European Economic Area.

Where transfer rules apply, the relevant transfer arrangement and safeguards must be assessed before that processing is used. Contact support@syncscala.com or use our contact form for information about the active processing locations and any applicable transfer safeguards before submitting information with residency or transfer restrictions. Do not assume a specific certification or contractual transfer mechanism has been adopted simply because an integration is listed here.

8. Retention and deletion

Retention depends on the purpose of the record, whether the account remains active, outstanding support or billing questions, security needs, legal obligations and any applicable processing agreement. We do not currently apply one universal automatic deletion period to all account, contact and backup records.

Active workspace records remain available for the account's requested work until removed or reviewed for deletion. Contact messages are kept to handle and follow up the enquiry and resolve related issues. Operational and credit records may need to be retained to explain activity or investigate a dispute. Ask us to review information that is no longer needed.

The sign-in session expires after a maximum of 30 days unless it is ended earlier. Expiry of a cookie does not by itself delete the account or every server-side record. Account closure and data-erasure requests are handled separately.

Deleting live records does not instantly remove all backup copies. Backup handling is considered as part of a deletion request, including any justified retention and measures needed to avoid restoring deleted data to active use. A minimal suppression record may need to be retained to honour an objection. We explain relevant exceptions rather than promise that every copy disappears immediately.

9. Security and confidentiality

The production website uses HTTPS. Account passwords and server-side session tokens are stored as hashes, and account routes require authentication. Access controls and backups support operation and recovery. These measures reduce risk but do not make any online service completely secure.

Use a unique password, protect your email account and avoid putting secrets into descriptions, imports or support messages. If you believe there is a security issue, contact support@syncscala.com or use the contact form with enough detail for us to investigate without sharing live credentials.

10. Your privacy rights and choices

Depending on the law that applies and the circumstances, you may request access to personal data, correction, erasure, restriction, portability, or object to processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Some rights have conditions or exceptions; we explain if we cannot fully comply.

You can object to use of your personal data for direct marketing. If your details appear in a workspace, tell us the relevant email address or professional record and the concern. We may need to verify identity or authority proportionately and determine whether we hold the data on behalf of a customer. Do not send unnecessary identity documents.

Send a request through the contact form or to support@syncscala.com. We will handle it within the applicable legal time limits, including any permitted extension that is explained to you. If you are unhappy with how your information is handled, you may complain to the relevant data-protection regulator. In the UK, this is the Information Commissioner's Office at ico.org.uk. You do not have to waive that right or complete a private dispute process first.

11. Children, external links and updates

The service is for adult professional users and is not intended for children. Do not upload children's information or use the service to target them. Contact us if you believe such information has been submitted so we can investigate and take appropriate action.

Links to other websites take you to services governed by their own notices. We cannot control how they handle information. We update this policy when relevant processing changes and display the revision date here. Where a change requires additional notice or a new choice, we will provide it as required.