This policy explains what personal data SYRIEL AI handles, why, and your choices. It is issued by [Company legal name] (Syncfinity) ([SSM registration number]) under Malaysia's Personal Data Protection Act 2010 (PDPA). Questions: privacy@[your-domain].
1. Two kinds of data
- Account data about our customers and their users: name, email, company, role, password (stored hashed), billing details (card details are typed on Stripe's page and never reach us), support tickets, and usage records (for example how many AI actions were used). For this data, we decide how it is used.
- Conversation data: the messages of the people our customers chat with, processed when a user presses a SYRIEL button. For this data, our customer (the business) decides how it is used and we process it on their behalf, under our Data Processing Agreement.
2. What the extension reads, and when
- The extension works in the chat you have open in your browser, but reads that conversation only when you press a SYRIEL button (for example AI Reply, Rewrite, Ask, Transcribe, Save chat or Check ready replies).
- It reads the recent messages of that one chat, and voice notes only when you ask for a transcript.
- On other websites ("Works anywhere"), SYRIEL runs on a page only after you open it there (toolbar button, shortcut or right-click menu). It reads only the text you highlight or paste into the SYRIEL panel. On Telegram Web, pressing Save chat also reads the messages already loaded in the chat you have open, at that moment only. It looks for voice notes on the page only when you press "Find voice notes", and sends only the ones you choose to transcribe (or files you upload). It does not read the rest of the page. To insert a draft, it types into the box you last clicked, only when you press Insert.
- It never reads your contact list, never sends messages, and never runs in the background on other chats.
3. What we keep
- Drafting a reply: the chat is sent to our server and to the AI provider to write the suggestion, then discarded. We keep only the number of messages, the latest customer message and the AI suggestion, encrypted, and delete them after your company's retention period (30 days by default).
- Contacts: a person's name and number are saved only when a user presses "Save chat", adds the contact by hand, or the company turns on automatic contact saving.
- Saved chats: kept only when a user presses "Save chat", until deleted.
- Imported chats: a user can upload a chat file that their own chat app gave them (for example a Telegram, Messenger or Instagram download). Only the messages are kept, encrypted with the company's key, like any saved chat. The uploaded file itself is not stored.
- Pasted chats: for sites without an export (such as Shopee or Lazada seller chats), a user can paste a conversation they copied themselves. It is sent once to the company's AI provider to sort out who said what; the user checks the result, and only then are the messages kept, encrypted like any saved chat. The pasted text is not kept anywhere else.
- Pictures and files in saved chats: kept only if the company allows it and the user ticks "keep pictures" when saving (pictures already on screen), or attaches a document or video they downloaded from the chat. The file and its name are encrypted with the company's key, count toward the company's storage, and are deleted with the chat or the account. Every time someone opens a file on its own, it is logged.
- Reply flows: example chats the company writes so SYRIEL can suggest its usual next reply. An admin can start one from a saved chat: the copy hides the customer's numbers, emails and links, and is encrypted with the company's key like the chat itself.
- Voice transcripts: kept encrypted for the retention period so the same voice note is not transcribed twice.
- Style learning (optional, off by default): a user's replies in chats they saved, used to suggest replies in their own style.
- Everything above is encrypted with a key unique to each company. SYRIEL staff have no screen that shows conversation content, and every opening of a saved chat is logged and visible to the customer.
4. Why we use data
- To provide the service you asked for (the contract with you).
- To secure the service, prevent abuse, and fix problems (our legitimate interests).
- To bill, keep accounts and meet legal duties (legal obligation).
- To send service emails (verification, password reset, billing, important changes). Marketing emails only with your consent, with an unsubscribe link.
We do not sell personal data, do not use conversation data for advertising, and do not use it to train AI models.
5. Who we share it with
Only service providers that help us run SYRIEL AI, under contracts that require them to protect the data and use it only for us: AI providers (OpenAI for text generation and search, Groq for voice transcription), hosting (Hostinger: our servers, the database and its backups are in Indonesia), email delivery and payment processing (Stripe). The current list is in the Data Processing Agreement. Some providers are outside Malaysia (our servers in Indonesia, and the AI providers in the United States); we only transfer data where the PDPA allows and with suitable safeguards. We may disclose data if the law requires it.
6. How long we keep it
- Draft records and voice transcripts: your company's retention period (30 days by default).
- Saved chats (with their pictures and files), knowledge files and saved replies: until you delete them or close your account.
- Access logs of saved chats: as long as the chat exists.
- Billing records: as long as tax law requires (generally 7 years in Malaysia).
- After an account is deleted, its data is erased and its encryption key destroyed; backups roll over within 30 days.
7. Your rights
Under the PDPA you may ask to access or correct your personal data, ask for a copy in a portable format, withdraw consent, and limit processing. Signed-in users can download their data and delete their account in Privacy & data. If you chatted with one of our customers and want to exercise your rights, contact that business first; we will help them respond. Otherwise email privacy@[your-domain]. We reply within 21 days.
8. Security and breaches
We use encryption in transit (HTTPS) and at rest, per-company encryption keys, access controls and audit logs. If a personal data breach happens that is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and affected customers as the law requires.
9. Chrome extension: Limited Use
SYRIEL AI's use of information received from the browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the features you ask for, is not transferred to third parties except as needed to provide those features or as required by law, is not used for advertising, and is not read by people except with your permission, for security, or as required by law.
10. Changes and contact
We will post updates here and tell account owners about important changes. Contact: [Company legal name] (Syncfinity), [Registered address, Malaysia], privacy@[your-domain].