Who we are and what this covers
Synapse is provided by Synheart AI Inc. (“Synheart”, “we”, “us”), a company based in Vancouver, British Columbia, Canada. This policy explains how we handle personal information in Synapse: the web app at synapse.synheart.ai, the synapse.work website, the Synapse MCP server that AI assistants connect to, and the Synapse features of the Synheart command-line tool.
Life by Synheart and Synheart’s other products have their own policy at synheart.ai/privacy. Where this policy mentions Life, it covers only what Life shares with Synapse.
Our role and your organization’s role
Synapse is a workplace product, so two parties are responsible for your information:
- Your organization (usually your employer) decides which tools to connect, which sources become shared memory, who gets a seat and how the privacy floor is set. For that work data, your organization is the controller and we process it on its behalf and on its instructions.
- Synheart is responsible for your account, for billing and for this website, and for human-state data you choose to share through Life by Synheart.
If you have a question about why your organization connected a tool, or you want to exercise your rights over its work data, you can ask your organization’s administrator. You can also write to us and we will help or pass your request on.
What we collect
Account and organization
Your name, email address and profile picture; the organizations you belong to and your role in them; how you sign in (password, Google, Apple, or your company’s Google or Microsoft single sign-on) and your multi-factor settings. For security we record the IP address, browser and approximate location (city, region and country) of sign-ins and sessions.
Work signals from connected tools
When your organization connects a tool, Synapse collects activity and timing, not the content of the work. What each connection stores:
| Source | What Synapse stores | What it never stores |
|---|---|---|
| GitHub, GitLab | Commit IDs, author handles, times and short subjects; pull and merge request numbers, authors and times; review activity; the text of Markdown, RFC and ADR files in repositories chosen as memory | Commit email addresses, full commit messages, diffs, pull request descriptions, review comment text |
| Linear, Jira | Issue keys and titles, status changes, owners, teams and times | Descriptions, comments, attachments, work logs |
| Slack | Message IDs, authors and times. Text only from public channels an administrator chooses as team memory, and decisions someone saves with the remember command | Direct messages, private and shared channels, attachments, other message text |
| Notion | Titles, links and text of pages chosen as memory, and who can read them | Comments, media, pages not chosen |
| Microsoft 365 | For Outlook, Teams and OneDrive: event, message and file IDs with their times and authors, and file names; the text of OneDrive folders chosen as memory | Email subjects, addresses and bodies; message text; meeting details; recordings; other file contents |
| Zoom | Meeting IDs, hosts, and start and end times | Topics, attendees, chat, recordings, transcripts |
| Google Drive, Calendar | See section 6 | See section 6 |
When an assistant searches code through Synapse, GitHub code search runs live in the repositories the organization’s GitHub App can reach. Synapse passes the results to the assistant and keeps none of them. Synapse can also post review comments on pull requests through the GitHub App.
AI tool usage
If your organization connects Claude, OpenAI, Cursor, GitHub Copilot or ChatGPT reporting, Synapse stores daily counts and costs, such as requests, tokens, accepted suggestions and spend. People in these reports are stored under keyed pseudonyms, not names or email addresses. If you turn on token reporting in the Synheart CLI, it sends per-session token counts, model, estimated cost and active time. Prompts, conversations, code, file paths and completions are never collected.
Agent activity
For each call an AI assistant makes to Synapse we record the tool, the person and client it acted for, the time and the outcome. Guard rules report daily counts of how often each rule stopped or paused an action. Detailed decision records are shared only if you turn that on.
Human state from Life by Synheart
Only if you connect Life by Synheart to Synapse yourself, Life sends Synapse state scores it works out on your device, such as focus, load, fatigue, recovery and readiness, each with how reliable the reading was. Raw sensor readings stay on your device. You can disconnect at any time, and Synapse stops receiving new data at once.
Billing
Plan, seat count, usage counts and billing contact details. Payments are handled by Stripe; we never see or store full card numbers.
This website and messages you send us
synapse.work uses no analytics, advertising or tracking tools. If you use the contact form, it opens your own email app and we receive only the email you choose to send.
How we use it
We use personal information only to:
- provide Synapse: build your organization’s memory and search, compute team and personal metrics, answer AI assistants, run goals and alerts, and enforce agent rules;
- keep accounts secure, prevent abuse and investigate incidents;
- meter usage and bill for it;
- send service messages, such as security notices, invitations, alerts you set up and billing receipts;
- fix problems and improve how the product works, using operational logs and error reports; and
- meet legal obligations.
We do not sell personal information, use it for advertising, or use your organization’s data to train AI models.
Where the law asks for a legal basis, we rely on our contract with you or your organization to provide the service, on our legitimate interest in keeping it secure and working, on your consent for human-state data and for connecting your own Google account, and on legal obligations where they apply.
Who can see what
- Only you can see My Effectiveness and your own agent decision records. Administrators cannot open them.
- Team figures are shown only for groups at or above the privacy floor: 10 contributors by default. Administrators can set it from 4 to 50, and must acknowledge the trade-off before lowering it. A smaller group can see its own figures only while every member has opted in. Below the floor, Synapse does not even show how many people contributed.
- Administrators see aggregates, configuration and an audit log. They can see who has connected tools or Life, but never anyone’s individual metrics. There is no ranking of people.
- Shared memory follows the source’s permissions. Google Drive, OneDrive and Notion documents are returned only to members who can open them at the source, checked again on every request. Slack channels and repositories an administrator chooses as team memory are readable by the whole organization.
- Synheart staff can view an organization’s aggregate figures and audit log when needed to support it, secure the service or meet legal obligations. That access is limited to authorized staff.
Google user data
Connecting Google is optional. Each member connects their own Google account, and Synapse only reads: it never creates, changes, shares or deletes anything in Google.
What we access
- Google account (openid, email): your email address and Google account ID, to confirm which Google account is yours so your activity and meetings are attributed to you.
- Google Calendar (calendar.readonly), only if you connect it: the start and end times, status and type of events on your own calendar, so declined and out-of-office events can be left out. Only event IDs and times are stored. We never read titles, descriptions, attendees or locations.
- Google Drive (drive.readonly), only if you link it, and only in shared drives your organization’s administrator adds to Synapse: the names, links and text of Google Docs, Google Slides, plain-text and Markdown files, and which members can open each file. My Drive is never included.
How we use it
Drive text is split into passages and indexed so members can search it in Synapse and through AI assistants connected to Synapse. A file is returned only to members who have linked their own Google account and can open it in Google Drive. Calendar times are used only to compute your meeting load, which only you can see.
How we store, share and delete it
- Google access tokens are encrypted, with keys held in AWS Key Management Service.
- Indexed Drive text is stored in our database, kept separate for each organization.
- To make text searchable, passages are sent to our embedding provider, DeepInfra, which processes them only to return search vectors. We share Google data with no one else, except as required by law.
- Unlinking Google Drive removes your access to every Drive file at once. When an administrator removes a shared drive, its indexed text is deleted. A file you can no longer open is removed at the next sync. Erasing your Synapse data deletes your Google tokens.
Limited Use
Synapse’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertisements, we do not sell it, we do not use it to train generalized AI or machine-learning models, and people at Synheart do not read it except with your permission, for security purposes, to comply with law, or where it has been aggregated and anonymized for operations.
Service providers we use
These companies process personal information for us, only to provide their service and under contract terms that require them to protect it:
| Provider | What they do for Synapse |
|---|---|
| Amazon Web Services | Hosting, databases, file storage, encryption keys and outgoing email |
| DeepInfra | Turning document passages and search queries into search vectors |
| Stripe | Payments, invoicing and sales tax |
| Sentry | Error reports from the web app, with tokens and personal details removed |
| Grafana Labs | Storage and search of operational logs |
| ip-api.com | Looking up the approximate location of a sign-in from its IP address |
The tools your organization connects, such as GitHub, Slack or Google, are not our service providers: they share data with Synapse because your organization or you asked them to, under their own terms. Synapse also sends messages to Slack when your organization sets up alerts there.
We will update this list before adding a provider that processes personal information.
Where your data is stored
Synapse runs on Amazon Web Services in the United States (us-east-1, Northern Virginia). If you are outside the United States, your information is transferred there. Where the law of your country requires safeguards for that transfer, such as standard contractual clauses, we put them in place.
How long we keep it
| Data | How long |
|---|---|
| Your account | While your account is open. When you delete it, it is removed after a 30-day grace period in which you can change your mind. |
| Organization memory, work signals and audit log | While your organization uses Synapse, until an administrator deletes them or the organization erases its data. |
| Data from a disconnected tool | Collection stops when a tool is disconnected. An administrator can choose to delete its data at the same time. |
| AI usage reports, token reports, guard counts and agent task records | 90 days |
| Google Drive text | Until the shared drive is removed or you can no longer open the file, as described in section 6 |
| Operational logs | At least 30 days, and network and access audit logs for up to one year, for security |
| Backups | Encrypted database backups are kept for 35 days, then overwritten |
When data is erased, it is removed from our live systems right away and drops out of backups as they expire.
How we protect it
- Data is encrypted in transit, and our database accepts only encrypted connections.
- Data is encrypted at rest. Credentials for connected tools get a second layer of encryption with keys held in AWS Key Management Service.
- Each organization’s data is kept separate and every request is checked against the signed-in person’s organization and role.
- AI assistants sign in with OAuth 2.1 and PKCE, and their access can be revoked at any time.
- Access by Synheart staff is limited to people who need it.
No system is perfectly secure. If you find a vulnerability, please report it to security@synheart.ai. If a breach affects your personal information, we will tell you and the authorities as the law requires.
Your rights and choices
Depending on where you live, including under Canada’s PIPEDA, the EU and UK GDPR and California privacy law, you can ask to access, correct, delete or export your personal information, object to or restrict how it is used, and withdraw consent you gave.
- In the app: disconnect Life or any tool you connected, erase your own Synapse data from the privacy settings, or delete your account. An organization owner can erase all of the organization’s Synapse data.
- By email: write to legal@synheart.ai. We may need to confirm your identity, and we respond within the time the law requires, usually within 30 days. If the request concerns work data your organization controls, we will work with your organization to answer it.
You can also complain to a data protection authority, such as the Office of the Privacy Commissioner of Canada or the authority where you live. We would appreciate the chance to sort it out with you first.
Children
Synapse is a workplace product for people aged 16 and over. It is not directed to children, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
If we change this policy, we will update the effective date above. If a change materially affects how we use your information, we will tell you by email or in the app before it takes effect. See also our terms of service.