Privacy Policy

The Service processes the following categories of personal data.

• Sign-up and authentication (required): email address, name, password (stored as a bcrypt hash)
• When signing up via Google: Google profile identifier (googleId) and profile image (avatar)
• Optional: job title (jobTitle) and language preference (locale)
• Authentication: JWT tokens (accessToken and refreshToken) stored as httpOnly cookies
• User-generated content: workspaces, projects, tasks, documents, comments, team chat, meeting recordings and transcripts, and uploaded files
• Automatically collected: access IP address, service usage and activity logs, and error diagnostics (Sentry)
• Where you enable an integration: Google (sign-in and Calendar), GitHub, and Slack integration tokens and the data processed through those integrations

The Service processes personal data for the following purposes. Personal data is not used for purposes other than those stated, and where the purpose changes, we take the necessary measures, such as obtaining separate consent.

• Member registration and management, and identity verification and authentication
• Providing Service features such as work management and collaboration (workspaces, projects, tasks, documents, chat, meeting transcription, and more)
• Responding to inquiries and delivering notices
• Analyzing usage statistics, improving quality, diagnosing errors, and responding to security incidents

For data subjects to whom the GDPR applies (such as residents of the EU/EEA), the Service processes personal data on the following legal bases.

• Performance of a contract (GDPR Article 6(1)(b)): processing to provide the Service and manage accounts under the user agreement
• Legitimate interests (GDPR Article 6(1)(f)): processing to maintain service security, diagnose errors, prevent abuse, and improve the Service
• Consent (GDPR Article 6(1)(a)): processing to which you have separately consented, such as optional external integrations (you may withdraw consent at any time)

• Account information: retained, in principle, until you withdraw your membership. Information subject to a statutory retention obligation is kept for the period prescribed by the relevant law.
• Service usage and activity logs: retained for 90 days on the free plan and 365 days on paid plans, depending on your plan, after which they are destroyed.
• Meeting recordings and transcripts: retained or deleted according to each workspace's retention settings.
• Statutory retention: where laws such as the Act on Consumer Protection in Electronic Commerce or the Protection of Communications Secrets Act require retention for a certain period, the data is kept for that period.

The Service processes personal data within the scope of its processing purposes and provides personal data to third parties only as permitted by the Personal Information Protection Act, such as with the data subject's consent or under specific provisions of law. We do not sell users' personal data to third parties for commercial purposes. For external integrations (Google, GitHub, Slack, and others), data is transmitted only where the user has personally enabled the integration and solely to the extent necessary to provide that integration feature.

To provide the Service smoothly, the Service entrusts the following processing activities to external specialist providers. In line with the Personal Information Protection Act, the outsourcing agreements specify matters such as the prohibition of processing beyond the purpose of the entrusted work and the implementation of safeguards, and we supervise the processors' compliance.

The meeting transcript analysis feature uses an LLM provided by DeepSeek (China), and in this process meeting transcript text is transferred to China. Please refer to the "Cross-Border Transfer of Personal Data" section below for details of this transfer.

The Service transfers personal data abroad for certain processing activities. In accordance with the Personal Information Protection Act, we disclose the details of these cross-border transfers below. Data subjects may refuse the cross-border transfer of their personal data; in that case, however, use of the relevant features (such as meeting transcription and analysis or external integrations) may be limited.

Data subjects may exercise the following rights at any time, through the settings available within the Service or by contacting the Data Protection Officer (privacy@syno.team).

• The right to request access to how personal data is processed
• The right to request correction in the event of errors
• The right to request deletion
• The right to request suspension of processing

Data subjects to whom the GDPR applies may, in addition to the above, exercise the right to data portability, the right to object to automated decision-making, the right to object to processing, and the right to withdraw consent.

The Service responds to requests to exercise these rights within the period prescribed by applicable law, and where a data subject exercises their rights through an agent, we may verify that the agent is duly authorized.

If you need to consult or report a personal data infringement, you may contact the following authorities.

• Korea Internet & Security Agency (KISA) Privacy Infringement Report Center: privacy.kisa.or.kr / 118 (no area code)
• Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
• Supreme Prosecutors' Office Cyber Investigation Division: spo.go.kr / 1301 (no area code)
• National Police Agency Cyber Bureau: ecrm.cyber.go.kr / 182 (no area code)
• Data subjects under the GDPR: you may lodge a complaint with the supervisory authority in your country of residence.

The Service is not directed to children under the age of 14 and does not permit registration by children under 14. If we become aware that the personal data of a child under 14 has been collected without the consent of a legal guardian, we will destroy that data without delay.

The Service destroys personal data without delay when it becomes unnecessary, for example when the retention period has elapsed or the processing purpose has been achieved.

Upon withdrawal of membership, personal data is handled through de-identification rather than immediate and complete deletion. Specifically, the email address and name are masked, and the password, Google identifier (googleId), and refresh token (refreshToken) are deleted. However, content shared with other members within a workspace (projects, tasks, documents, comments, and the like) may remain, owing to the nature of collaboration, in order to protect other users' rights to use the Service.

Information held in electronic file form is permanently deleted using methods that prevent recovery or reproduction, and information that must be retained under applicable law is stored separately in a distinct database or storage location before being destroyed.

The Service implements the following technical and administrative measures to ensure the security of personal data.

• Encryption in transit: TLS is applied to all communication channels to protect data transmission.
• Encryption at rest: sensitive credentials are protected with AWS KMS-based envelope encryption.
• Password protection: passwords are never stored in plaintext and are stored as bcrypt hashes.
• Access control: role-based access control (RBAC) restricts access to personal data to authorized persons only.
• Access logging: access records for personal data processing systems are retained to detect unauthorized access.

The Service uses only httpOnly authentication cookies (accessToken and refreshToken) for user authentication. These cookies are essential to maintaining your signed-in state and for security. The Service does not use tracking cookies for advertising or behavioral data collection.

The Service has designated a Data Protection Officer who is responsible for overseeing personal data processing and handling data subjects' complaints and remedies, as follows.

• Service name: Syno
• Operating entity: [Operating entity — to be completed before publication]
• Data Protection Officer: [DPO name — to be completed before publication]
• Contact email: privacy@syno.team

This Privacy Policy applies from its effective date and may be revised to reflect changes in law or in the Service. Where content is added, removed, or modified, we will give notice within the Service at least 7 days in advance (or at least 30 days in advance for changes that are material or unfavorable to users).