This Data Processing Agreement ("DPA") forms part of the Terms of Service between [Company legal name] (Syncfinity) ("SYRIEL", the processor) and the Customer (the controller, or "data user" under Malaysia's PDPA). It applies to personal data in Conversation Data and other Customer Data that SYRIEL processes for the Customer.
1. Roles and instructions
The Customer decides why and how conversation data is processed. SYRIEL processes it only to provide SYRIEL AI as described in the Terms, on the Customer's documented instructions (including actions users take in the product), unless the law requires otherwise; in that case SYRIEL tells the Customer first where allowed.
2. What is processed
- Data subjects: the Customer's users, and the people they chat with (customers, leads, partners).
- Data: names, phone numbers or chat identifiers, message text, voice notes the user chooses to transcribe, and notes users add.
- Purpose: drafting, rewriting, summarizing and transcribing messages; saving chats the user chooses to keep; learning a user's writing style when they turn it on.
- Duration: for the term of the Customer's subscription, then deletion as set out below.
3. SYRIEL's commitments
- Confidentiality: only personnel who need access for support or security, bound by confidentiality, and only with a logged reason. SYRIEL provides no staff screen for reading conversation content.
- Security: encryption in transit and at rest with a per-Customer key, access control, audit logs, backups and vulnerability fixing.
- No training: Customer Data is not used to train AI models, by SYRIEL or its AI sub-processors.
- Help with rights requests: tools for export and deletion, and reasonable help for other requests.
- Breaches: SYRIEL notifies the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data, with the information the Customer needs to meet its own duties (including notifying the Commissioner within 72 hours).
- Deletion: on account deletion, Customer Data is erased and the Customer's encryption key destroyed; backups expire within 30 days.
- Information: SYRIEL provides information reasonably needed to show compliance with this DPA.
4. Sub-processors
The Customer authorizes these sub-processors. SYRIEL gives at least 14 days' notice of new ones (by email or on this page); the Customer may object and, if unresolved, cancel with a pro-rated refund.
- OpenAI, L.L.C. (United States): AI text generation and embeddings, via business API.
- Groq, Inc. (United States): voice note transcription, via API.
- Hostinger International Ltd. (servers in Indonesia): application hosting, database and backups. Stored data stays encrypted with each Customer's key.
- [Email provider]: service emails.
- Stripe (may process data in the United States): payments, invoices and receipts. Account data only: company name, billing email and address, tax ID if given. Card details go straight to Stripe and never reach SYRIEL. No conversation data.
5. Transfers outside Malaysia
Some sub-processors are outside Malaysia. SYRIEL transfers personal data only as permitted by section 129 of the PDPA, under contracts requiring an equivalent level of protection.
6. Customer's commitments
The Customer is responsible for having a lawful basis and giving any notice required for the people whose messages it processes, and for following the rules of the messaging platforms it uses.
7. Liability and order of precedence
Liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict on data protection, this DPA prevails.