Legal

Privacy Policy

Last updated: 19 August 2026

This policy explains what personal data Sygnora handles, why, and your rights. Sygnora is operated by Blue Worlds Inventions Ltd, a company registered in Mauritius (UHY House, 71 Impasse Saipan, 80829 Moka). Contact: support@sygnora.ai.

We handle personal data in line with the Mauritius Data Protection Act 2017 and, where applicable, the EU GDPR and UK GDPR.

1. Two kinds of personal data, two roles

Sygnora is unusual in one respect and this policy is built around it. There is data about you, our customer, for which we are the controller. And there is data about the people your assistant corresponds with, which your assistant receives and records on your behalf. For that second kind, you are the controller and we are your processor: we process it only on your instructions, to run the Service for you, and never for our own purposes.

Data about you (we are the controller)

You give us: your email address, name, password (kept only as a secure hash), the name and settings of your assistant, the documents you write to describe yourself and how your assistant should work, and your plan choice.

Collected automatically: sign-in and session data (IP address, browser, timestamps) for security and to keep you signed in; records of the AI usage your account generates (token counts and cost), used for metering and billing; logs of what your assistant did and why, which are part of the Service you use.

Payment data: paid plans are sold by Paddle, our Merchant of Record. Paddle collects and processes your payment details; we never receive or store your full card number. We receive limited information such as your subscription status, billing country, and the card brand and last digits.

We do not use advertising or cross-site tracking, and we run no third-party analytics. Sygnora sets one essential session cookie.

Data your assistant handles (you are the controller, we are the processor)

When someone writes to your assistant, or when you put your assistant in copy of a conversation, the messages and attachments it receives are stored in your account and processed to do its job: read the conversation, draft a reply, record who owes what, remember how to address the person. That includes the names, email addresses, roles and anything else about third parties that the correspondence carries, and notes your assistant writes about those people so it can work with them over time.

You decide who your assistant corresponds with. You are responsible for having a lawful basis to process their data, for telling them what you need to tell them under the law that applies to you, and for answering their requests about their data. We help you do that: you can search, export, correct and delete everything your assistant holds about a person from your account, and deleting a contact deletes the notes about them.

We will enter into a data processing agreement with you on request, and a copy of our standard terms for processing is available from support@sygnora.ai.

2. Why we use data, and our legal bases

• To provide the Service and your account: performance of a contract.
• To process your subscription through Paddle: performance of a contract, and a legal obligation for tax and accounting records.
• To keep the Service secure, prevent abuse, and protect deliverability for all customers: our legitimate interests and legal obligations.
• To send essential service emails (verification, password reset, security notices): performance of a contract.
• To send optional digests, where you turn them on: your consent, which you can withdraw at any time.
• To comply with the law: a legal obligation.
• Data your assistant handles for you: your instructions, as your processor.

3. AI processing

The assistant works with large language models. To draft a reply or decide what to do next, the relevant parts of a conversation (messages, extracted attachment text, your instructions and the notes your assistant keeps) are sent to our model provider. We send only what the task needs, never your password or payment data. Our current provider is OpenAI, whose API terms state that content submitted through the API is not used to train its models unless the customer opts in, with abuse-monitoring logs retained for a limited period under its platform rules. We will note any material change of provider or of AI data use in this policy.

Every model call your account makes is recorded, with the exact input and output, in your account’s activity log, so you can see what the assistant saw and what it said. Only you can see it.

4. Who else is involved

We do not sell personal data and do not share it with advertisers.

5. International transfers

We are established in Mauritius, which does not hold an adequacy decision from the European Commission. Where we process personal data of people in the EU or UK, transfers are covered by standard contractual clauses and our hosting is in the EU. Our processors are bound by contracts that require equivalent protection.

6. Retention

Mail and records your assistant holds are kept until you delete them, the case they belong to, or your account. Nothing is kept because it might be useful later.

When you ask us to delete your account, your assistant stops reading and sending straight away, and everything is erased thirty days later. The month is there so that a request made in haste can be taken back from your own settings page; after it, the erasure is permanent and covers every case, message, file, contact and document, along with the stored copies of the mail itself.

Usage and billing records are kept for as long as tax and accounting law requires. Crash reports are kept for 90 days. Backups are rotated within 30 days.

7. Your rights

You can access, correct, export and delete your data from your account settings, and you can close your account at any time. The export is a single download containing every case, message, file, contact and document your account holds, in a machine-readable form, which is what portability means. For anything you cannot do from the settings, write to support@sygnora.ai and we will answer within one month. If you are in the EU or UK you may complain to your local supervisory authority; in Mauritius, to the Data Protection Office.

If you are not our customer but your data was processed by a Sygnora assistant, the customer running that assistant is the controller of your data. Write to them first; if you cannot, write to us at support@sygnora.ai and we will help you reach them.

8. Changes

We will post changes here and, for material changes, notify you by email before they take effect.