Contents
1.Who is who
You are the controller of the personal data you bring to the platform. SynconAI 360 is the processor, acting on your documented instructions, which for most purposes means the actions you take in the product.
Where you connect a Salesforce org, that org remains yours and your agreement with Salesforce continues to govern it. We read from it; we do not become its controller.
2.What we process, and what we do not
We process your Salesforce metadata: the names and structure of objects, fields, automation and code, and the relationships between them. We process the documents you upload, and the account records of the people on your team.
We do not copy your CRM records. Contacts, accounts, opportunities and cases stay in your org. Where a query returns records live, they are shown to you and not stored.
3.How long we keep it
Metadata for a connected org is held while the org is connected and removed when you disconnect it. Account records are held while your account exists. Records belong to your workspace and are removed with it.
4.Security
Separation between customers is enforced by the database rather than by the application, so a query that fails to scope itself returns nothing rather than another customer’s records. Stored credentials are encrypted with a key derived per customer.
The specific controls, and the ones we do not have, are set out on the security overview. That page states plainly that we hold no security certification, and this document does not claim otherwise.
5.Artificial intelligence
On the Free plan, and on any plan where you add your own key, AI features run on your own provider key. Calls are made to Anthropic or OpenAI on your account, under your agreement with them, so that traffic does not pass through our account with those providers.
On a paid plan with AI included, calls are made from our own accounts with Anthropic and OpenAI. Only the part of your metadata relevant to a request is sent.
We do not use your data to train models. Anthropic and OpenAI both state that they do not train on API traffic, whichever account a call is made from.
6.Subprocessors
The companies that process data on our behalf are listed on the subprocessors page, with what each one can see and the region it operates in. That list names only companies that actually receive data.
We will give notice before adding a subprocessor that can see your data, so you have the opportunity to object.
7.International transfers
The application and its database run in the United States. A subprocessor may operate in another region, and each is identified by region on the subprocessors page so you can assess transfers for yourself rather than taking a general assurance.
8.Helping you meet your obligations
If a person whose data you hold makes a request, the platform gives you the means to find, export and delete what relates to them, and we will assist where the product does not reach.
If we become aware of a breach affecting your data, we will tell you without undue delay, with what we know, what we do not yet know, and what we are doing.
9.Getting your data back, and deletion
You can export your data while your account is active. On termination we delete what we hold, subject to anything we are required to retain by law, and we will confirm when it is done if you ask.
10.Audits
We have no certification to hand you in place of an audit. We will answer a questionnaire, and the security overview is written to answer most of one without a call. Where your review needs more, contact security@synconai360.com.
Questions about this document? Contact hello@synconai360.com.