Privacy Policy

01What we collect

Account data. Name, email address, password (hashed) or passkey, two-factor authentication settings, and your account preferences.

Financial data. Account details (such as account numbers and account holder names), balances, and transactions from the financial institutions you connect. We retrieve this through the data providers listed in section 2, only after you approve the connection through the provider's consent flow. We never see or store your bank login credentials, and our access is read-only.

Payment data. If you subscribe, Stripe processes your payment. We store your plan, invoice history, and the last four digits and brand of your card. Full card details never touch our systems.

Referral data. If you sign up through a referral link and allow marketing cookies, the referral click ID and the fact that your account and subscription came from that referral. If you enter a referral code at checkout, the code you used. If you take part in our referral program yourself, your referral link, the referrals credited to you, and the rewards you earn.

Support and feedback. Messages you send us and posts you make on our feedback board, along with your name and email.

Technical data. Log data (IP address, browser, device information, timestamps, actions in the service) collected to run and secure the service. Usage analytics as described in section 6.

We do not buy or collect data about you from data brokers or other outside sources. The only third-party data we receive is the financial data you instruct your institutions to share with us.

02Where your financial data comes from

We retrieve financial data through licensed and established connectivity providers. Which provider is used depends on your institution:

GoCardless (GoCardless SAS, France) provides regulated account information services for banks in the UK and Europe. GoCardless is a licensed payment institution supervised by the French ACPR. When you connect a bank through GoCardless, they retrieve your account data with your consent and pass it to us. You have data protection rights toward GoCardless directly, including the right to object to their processing. Read their Privacy Policy and their Bank Account Data End User Terms.

Akahu (Akahu Limited, New Zealand) provides the same role for New Zealand banks, under New Zealand's regulatory regime.

SnapTrade (Passiv Inc., Canada) provides connectivity to brokerages and crypto exchanges. When you connect an account through SnapTrade, you also accept SnapTrade's own End User Terms, which govern their handling of your data.

In each case, the provider acts as its own data controller under its own terms and regulatory obligations. We receive the data they retrieve at your instruction and process it as described in this policy.

03Why we process your data, and on what legal basis

To provide Synci (Art. 6(1)(b) GDPR, contract): fetching your financial data, running your rules and transfers, delivering data to your destinations, managing your account, billing, and running the referral program if you take part in it.

To meet legal obligations (Art. 6(1)(c)): keeping accounting records as required by Norwegian bookkeeping law.

With your consent (Art. 6(1)(a)): identified product analytics (section 6), referral tracking (section 6), optional transaction enrichment (section 4), and any other processing we explicitly ask you about. You can withdraw consent at any time, with effect going forward.

Based on our legitimate interests (Art. 6(1)(f)): anonymous usage measurement (section 6), responding to support requests, securing the service and preventing fraud, sending changelog and product update emails to users (every email has an unsubscribe link, and we stop when you unsubscribe or delete your account), and anonymized, aggregated analysis to improve the service. You have the right to object to processing based on legitimate interests.

We do not use your data for automated decision-making with legal effects, and we never sell personal data.

04Transaction enrichment and AI features

Enrichment cleans up transaction data: proper merchant names, logos, and categories. It is strictly opt-in, available on the Pro plan, and can be switched on or off per financial account in your settings at any time.

When enrichment is on, we send the minimum data needed to our enrichment providers: transaction descriptions, amounts, dates, currencies, and counterparty names. Your identity is pseudonymized toward these providers; they receive an internal reference, never your name or email. Note that transaction descriptions and counterparty names can themselves contain personal information, such as the name of a person you paid.

Our enrichment providers process this data on our instructions as data processors:

• Ntropy, via their EU processing endpoint.
• Microsoft Azure AI Foundry (Azure OpenAI models), through a Data Zone Standard deployment in Microsoft's EU data zone. Our resource is in Sweden, where the data Microsoft stores for it is kept. Each request can be processed in any Azure region within that data zone, which follows Microsoft's EU Data Boundary: EU member states and, as Microsoft describes it, EFTA countries such as Norway and Switzerland. Your data is not used to train models.

05AI assistants and destinations you connect

Separately from the features above, you can direct your own data to third parties you choose:

Destinations. You can create transfer links that send selected data to tools like YNAB, Lunch Money, Actual Budget, Google Sheets, Zapier, or your own webhooks.

AI assistants and other clients. You can connect third-party clients, including AI assistants such as Claude, through the Model Context Protocol (MCP) or our API. The data you request through such a client is transmitted to the provider operating it.

In both cases, you decide what is shared, the connection is scoped to the accounts and data you select, and you can revoke it at any time in your settings. Once data reaches a destination or client you connected, it is governed by that provider's own privacy terms, which we do not control. These providers act at your direction, not ours.

06Cookies and analytics

We built our own consent system. Non-essential cookies and identified tracking are off until you say yes, and you can change your choices at any time, on the website and inside the app. Your preferences are stored on our servers so they follow you across devices.

Analytics runs in two modes:

With your consent, we use PostHog (EU-hosted) for identified product analytics, including session replays. All text in session replays is masked, so the content of your financial data never appears in them. If you withdraw consent, we unlink your identity and stop identified tracking.

Without consent, we collect only anonymous, cookieless usage events that cannot be tied to you. We use this to understand aggregate product usage, based on our legitimate interest. You can object by contacting us.

Referral tracking runs only with your marketing consent. When you arrive through a link from one of our affiliates or from a customer who referred you, and you allow marketing cookies, Affonso (EU-hosted) records the referral so the right person is credited when you sign up and subscribe. We share your email address and an internal account reference with Affonso for that purpose, and Affonso receives payment events from our Stripe account so it can credit referred subscriptions. Until you allow marketing cookies, Affonso's script does not run, nothing about the referral is stored on your device, and nothing is sent to Affonso: the referral stays only in the page address, including in a link you follow to app.synci.io, where you can make the same choice. If you reject marketing cookies, or later withdraw consent, we delete the referral cookies and forget the referral, and your sign-up is not credited through the link. A referral code you enter yourself at checkout works differently: it is credited without any cookie or tracking, because you chose to use it. If you take part in our referral program, we share your name and email with Affonso to create your referral link and track the rewards you earn.

To measure whether our ad campaigns work, we import aggregate campaign statistics (impressions, clicks, spend) from the ad platforms we advertise on, currently Reddit Ads, into our analytics. This data describes our campaigns, not you, and we do not send any data about you to ad platforms.

Details are in our Cookie Notice.

07Who we share data with

We share personal data with service providers that process it on our behalf, under data processing agreements, and only as needed to run Synci:

• Infrastructure: DigitalOcean (backend and database, EU), Vercel (frontend), Cloudflare (network and security)
• Enrichment: Ntropy, Microsoft Azure (section 4)
• Email: Resend (primary), Mailgun (backup), Google Workspace
• Support and feedback: Featurebase (EU-hosted)
• Analytics and monitoring: PostHog (EU-hosted), Laravel Nightwatch
• Affiliate and referral tracking: Affonso (Germany, EU-hosted)
• Accounting: Fiken

Stripe processes payments as an independent controller under its own terms, acting as merchant of record for purchases.

Beyond that, we share data only: with the financial data providers and destinations you connect (sections 2 and 5); if required by law or a competent authority; or as part of a business transfer such as a merger or acquisition, in which case this policy continues to apply to your data.

08International transfers

We keep processing inside the EEA wherever possible. Our servers are in the EU, and our analytics and support providers process data in the EU. For enrichment, Ntropy uses its EU processing endpoint, and Azure OpenAI processes requests within Microsoft's EU Data Boundary, which can include Switzerland, a country covered by an EU adequacy decision.

Some providers involve transfers outside the EEA: Akahu operates from New Zealand and SnapTrade from Canada, both countries covered by EU adequacy decisions. US-based providers (such as Google, Microsoft, Resend, Mailgun, and Cloudflare) are covered by the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Copies of relevant safeguards are available on request.

09How long we keep your data

Financial data has its own strict retention window. Every transaction, balance, and log we fetch is kept in our active systems only for the length of your retention setting, measured from when we fetch it. A daily cleanup then deletes it from those systems, rather than flagging it as deleted. You control the window in Settings: new accounts start at 30 days, and you can choose from a minimum of 7 days (needed to prevent sync errors and duplicates) up to your plan's maximum. The minimum only limits that rolling window; it does not stop you from deleting a connection or your account, or from asking us to erase your data sooner. Deletion covers transactions, balances, transfer logs, rule logs, and bank logs. Your connections and accounts remain until you remove them. Data already delivered to a destination you connected is outside our systems and follows that destination's practices.

Backups. Our database backups are encrypted. Deleting data from our active systems does not immediately remove it from earlier backup recovery points; those expire on our ordinary backup cycle.

Everything else. The retention window applies only to financial data. Other records about you are kept as follows:

• Account data: until you delete your account.
• Invoices and accounting records: 5 years, as required by Norwegian bookkeeping law.
• Referral and commission records: kept after account deletion as part of those accounting records, because they document commission paid to affiliates and credit applied to customer bills.
• Support conversations: deleted on request or account deletion, and purged after 24 months of inactivity.
• Public feedback posts (feature requests, comments, votes): anonymized when you delete your account, so the content remains without any link to you; deleted or redacted entirely on request.
• Security and access logs: up to 12 months, so we can investigate incidents.
• Consent records: kept as proof of lawful processing.

When you delete your account, we delete your personal data from active systems promptly and from backups in the ordinary backup cycle, keeping only what law requires us to keep and the minimum needed to prevent fraud and abuse, resolve disputes, or enforce our agreements.

10How we protect your data

All data is encrypted at rest and in transit. Selected sensitive fields are also encrypted individually at the field level: account identifiers such as account numbers and IBANs, account holder details, the balance history we record for each account, and the access tokens and secrets that connect your accounts and destinations. Other data, including transaction details, holdings, and the balance summary shown for each account, is protected by the encryption at rest and in transit but not encrypted field by field. We never store bank credentials, and our provider access is read-only. Further details about our technical safeguards are in our Security overview.

No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur. If a personal data breach occurs, we notify the Norwegian Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms. If a breach is likely to result in a high risk to you, we also tell you directly without undue delay, unless an exception in the law applies, for example because the data was encrypted and unreadable to anyone who obtained it. Where we handle data as a processor for an app (see the Portal Privacy Notice), we notify that app without undue delay, and the app decides on these notifications as the controller.

11Your rights

Under the GDPR (and the UK GDPR if you are in the UK), you have the right to access your data, correct it, delete it, restrict or object to processing, receive a copy in a portable format, and withdraw any consent at any time. Most of this you can do directly in the app; for anything else, email support@synci.io and we will respond within 30 days.

If you believe we process your data unlawfully, you can complain to Datatilsynet (the Norwegian Data Protection Authority, datatilsynet.no) or your local supervisory authority.

12Minors

Synci is not for anyone under 18. We do not knowingly process children's data; if you believe we hold any, contact us and we will delete it.

13Changes to this policy

We will update this policy when our practices change. The date at the top always reflects the current version, and we will notify you of material changes in the app or by email.

14Contact

Tonning, doing business as Synci
Nordbø 15
5009 Bergen, Norway
support@synci.io