Privacy Policy

This policy explains what personal information we collect, why, who sees it, where it goes, how long we keep it, and what you can do about it. It is written to meet the Protection of Personal Information Act 4 of 2013 ("POPIA"). It covers this website, the product at app.synapticintelligence.ai, and our dealings with you as a prospective or current customer.

1. Responsible party
2. Information Officer
3. When we are the responsible party and when we are an operator
4. What we collect
5. Why, and on what lawful basis
6. Operators and third parties
7. Transfers outside South Africa
8. How long we keep it
9. How we protect it
10. Cookies and similar technologies
11. If you are in the United States
12. Your rights
13. Complaints and the Information Regulator
14. Children
15. Changes to this policy

1. Responsible party

The responsible party in the terms of POPIA is Synaptic Intelligence (Pty) Ltd, a private company registered in the Republic of South Africa, registration number 2026/815493/07.

Physical address: 48 Fussell House, 1st Floor, Atholl Oaklands Road, Melrose North, Johannesburg, Gauteng 2196, South Africa
Email: info@synapticintelligence.ai
Website: synapticintelligence.ai (this site) and app.synapticintelligence.ai (the product)

2. Information Officer

Our Information Officer, registered with the Information Regulator as section 55 of POPIA requires, is Gershon Koral. Any request, question or complaint about personal information should go to the Information Officer at info@synapticintelligence.ai, marked "Information Officer", or by post to the address above. Our PAIA manual (section 51 of the Promotion of Access to Information Act 2 of 2000) is available on request from the same address.

3. When we are the responsible party, and when we are an operator

POPIA distinguishes the responsible party, who decides why and how personal information is processed, from the operator, who processes it on the responsible party's behalf. We are both, for different information:

• We are the responsible party for the personal information of the people we deal with directly: visitors to this website, people who use the contact form, the people who sign up and administer a customer's account, and the people who sign in to use the product. Sections 4 to 15 apply in full.
• We are an operator for personal information contained in the systems and documents a customer connects: an HR directory, a payroll ledger, a CRM, a support desk, a mailbox, a shared drive. The customer is the responsible party for that information, decides what to connect and who in their company may see it, and is responsible for having a lawful basis to process it. We process it only as the product does, on the customer's instruction, under section 20 and 21 of POPIA and the Terms of Service. If you are a data subject whose information is held in a customer's systems, your request should go to that customer; we will help them answer it.

4. What we collect

Where	Personal information	How it reaches us
This website	Our host records the IP address and requested URL in ordinary server logs. If you turn on Google Analytics, it also records which pages you visit, whether you started or finished a sign-up, where you came from, your approximate location and your device and browser, under a random identifier. If you turn on Microsoft Clarity, it records how you use each page (clicks, scrolling and mouse movement, replayable as a recording of the visit) with your device and browser and your approximate location, under a random identifier; text you type is hidden from it. If you turn on Google Ads, Google records whether you arrived from one of our ads, and whether you then started or finished a sign-up or sent the contact form. If you turn on LinkedIn, LinkedIn records the pages you visit and whether you started or finished a sign-up and, if you are signed in to LinkedIn in that browser, links the visit to your LinkedIn account. If you turn on Meta or Microsoft Advertising, each records the pages you visit and whether you finished a sign-up and, if you are signed in to its services in that browser, may link the visit to your account there. What you leave off records nothing (section 10).	Your browser
Contact form	Your name, email address, and optionally your company and the systems you run, together with the message you write and which of our enquiry types you chose.	You type it
Sign-up	Your name, work email address, company name, company website, the kind of business it is, and the tier you were looking at on the pricing page. No card is taken for the free trial. When an administrator chooses a tier, during or after the trial or straight away at sign-up, card details are entered on Paddle's hosted checkout and are never sent to us; we receive a customer reference and the last state of the subscription.	You type it; the sign-in link or your directory confirms the address; Paddle confirms payment
Signing in to the product	Your name, email address and directory identifiers from the ID token your organisation's directory issues (Microsoft Entra ID or Google), or, if you sign in with a link we email you, your email address and when you proved it; and the business title and access role your administrator assigns you.	Your organisation's directory or your mailbox; your administrator
Using the product	The questions you ask, when you asked, which departments answered, what it cost in credits and how many of its figures verified; the records a specialist read while answering, held for 24 hours after the conversation's last question; short notes each department learns about how your company works (how it counts things, where its figures live, what worked, and corrections a person made to an answer), which never contain figures, names or records from your systems; gaps, meaning places where two departments' figures for the same thing did not match, with the kind of difference, what it may suggest, a question to ask next and how often and when it was seen, which never contain figures, names or records either; research findings, meaning short conclusions our Research department reaches about your company's outside world, such as who your competitors are or a market or regulatory fact, with the addresses of the public web pages they rest on and the date each was read, which may name other companies, and public people where a public page does, but never your own people's names, contact details, record numbers or your company's own figures; documents you upload or sync; the connections you configure (the credential itself is stored encrypted and is never shown again). Answers can contain personal information from your connected systems; for that information we are an operator (section 3). The answers themselves are shown to you and kept in your browser, not by us.	Your use of the product
Support and billing	Emails between us, invoices, and the record of what tier your company is on and since when.	Correspondence; the payment processor

We do not collect special personal information (section 26 of POPIA) about the people we deal with directly, and we do not ask for it in the product. A customer who connects a system that contains special personal information, such as an HR directory holding health or union data, is the responsible party for it.

5. Why, and on what lawful basis

Section 11 of POPIA allows processing only on one of a fixed list of grounds. Ours are:

Purpose	Information	Lawful basis (POPIA s11(1))
Answering an enquiry or demo request	Contact form	Your consent, given when you send it (a); and our legitimate interest in replying (f)
Creating and administering your company's account, taking payment, sending invoices and notices	Sign-up, billing	Necessary to conclude and perform the contract with you (b); legal obligation for tax and accounting records (c)
Signing you in and deciding what you may do and see	Sign-in, roles and titles	Performing the contract (b); our and the customer's legitimate interest in keeping every request scoped to the right person and company (f)
Producing answers, verifying their provenance, keeping them auditable	Questions, answers, cited records, documents	Performing the contract (b); as operator for the customer's information
Making answers better for your company over time, unless an administrator switches learning off	Notes each department learns about how your company works; gaps between departments' figures	Performing the contract (b); as operator for the customer's information
Giving the Research department a starting point on your next question, so it can build on what it found before. It re-reads the underlying public pages before stating anything and never cites a finding itself. No other part of the service uses them, and your administrators can confirm, correct or remove each one	Research findings	Performing the contract (b)
Seeing how this website is used, so we can improve it	Website analytics and recordings of visits	Your consent, given by turning each one on in the cookie panel, and withdrawn by choosing Cookie settings at the foot of any page (a)
Seeing which of our Google ads lead to a visit, a sign-up or a demo request, so we can spend on the ones that work	Ad conversions	Your consent, given by turning on Google Ads in the cookie panel, and withdrawn the same way (a)
Seeing which of our LinkedIn ads lead to a visit or a sign-up, and showing our ads on LinkedIn to people who visited	LinkedIn visits	Your consent, given by turning on LinkedIn in the cookie panel, and withdrawn the same way (a)
Seeing which of our Facebook, Instagram and Bing ads lead to a visit or a sign-up, and showing our ads there to people who visited	Meta and Microsoft Advertising visits	Your consent, given by turning on Meta or Microsoft Advertising in the cookie panel, and withdrawn the same way (a)
Metering credits and preventing use past the allowance	Usage records	Performing the contract (b)
Keeping the service secure, investigating misuse, and defending claims	Server logs, usage records	Legitimate interest (f); legal obligation (c)
Telling you about changes to the service, prices or these policies	Administrator email addresses	Performing the contract (b)
Trial reminders: telling a company's administrators how long and how many credits are left on its free trial, and how to choose a plan	Administrator email addresses	Legitimate interest (f); you can unsubscribe from any reminder

Trial reminders. While a company's free trial runs, we email its administrators once a day, starting the day after sign-up, with the days and credits left and a link to choose a plan. One last email says when the trial has ended. The reminders stop when a plan is chosen. Each one has a link to unsubscribe from them and carries our postal address. We send no other marketing email. If we ever do, it will go only to people section 69 of POPIA allows us to send it to, and every message will carry an unsubscribe link and our postal address. We do not sell personal information to anyone.

No automated decisions about you. The product makes no decision with legal or similarly significant consequences for a person by automated means (section 71). It answers questions; people decide what to do with the answers.

Information from Google. When your company connects a Google service (Google Ads, Google Analytics, Search Console, Google Cloud, BigQuery or Google Drive), we read it only with your consent and only to answer your company's questions. Synaptic Intelligence's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use information from Google APIs, including Google Workspace APIs, to develop, improve or train generalised artificial intelligence or machine learning models, and the operators that process it for us may not either. We do not sell it or use it for advertising, and no person reads it except with your consent, for security purposes such as investigating abuse, or where the law requires it.

6. Operators and third parties

The following companies process personal information on our behalf. Each receives only what its column says, under a written agreement that binds it to confidentiality and to section 21 of POPIA or an equivalent standard. Our security page describes the three that receive your data to produce answers or to choose each department's expert methods; this is the full list, including hosting and payments.

Operator	What it does	What it receives	Where
Anthropic, PBC	Provides the language models that route each question, read the records it reaches and compose the answer	Your questions; the records and document passages a question reaches; the company profile and brief; the notes your company's departments have learned; the research findings kept for your company, given to the Research department only; prior turns of the conversation; and, when an administrator turns on Business context, the searches a department makes of the public web, which may name a company or a person. Not used to train models under our agreement.	United States
Voyage AI	Produces the embeddings that let uploaded and synced documents be searched by meaning, when a deployment has it configured	The text of documents you upload or sync, in passages, and the phrase a department searches them with; and, when a department's expert methods are being chosen, their published descriptions and short descriptions of what that department could not answer, kept only when they contain no figure, date, name or record. It does not receive connector data, ledger rows, HR records, questions or answers.	United States
TypeSafe	Its decision model, Jev, judges how demanding each part of a question is, which decides which Anthropic model answers it. It also chooses which published expert methods each department uses for your company, when a deployment has it configured; the choice is kept, and the methods come only from Anthropic and named vendor partners, reviewed and pinned by us. In the same way it chooses which standard business terms your departments are likely to use. Where a deployment reorders search results, it also scores how well each passage a document search found answers that search. When Business context is on, it also judges whether a department's search of the public web is about that department's own figures, and a search it judges otherwise is not made	For choosing the model: your question as restated for answering, each department's part of it and the department names. In a follow-up, the record references and figures the earlier answer cited are replaced with placeholders first; everything else, including a name you typed or one carried over from the earlier answer, is sent as written, so it may contain personal information. Never an answer, and your company's name only if the question itself contains it. For choosing methods: the published name and description of each method being considered; your kind of business; each department's name and description; the kinds of system you have connected (for example "a CRM", never the vendor or the account); never your company's name, a question, an answer, a learned note or any record, so no personal information. For choosing business terms: the same, with each standard term's published name and description in place of methods, so no personal information. For reordering search results: the phrase a department searched your documents with, and the passages of your uploaded or synced documents that search found, each with its file name, which may contain personal information. For judging a web search: the department's name and description, its part of the question (with the same placeholders in a follow-up) and the words of the search. The department writes the search, so it may name your company or a person, or repeat something it has read. Never an answer. TypeSafe does not train its models on any of it.	United States
Microsoft Corporation (Azure)	Hosts the product, its database and document storage; provides Entra ID sign-in; sends the contact form's email through Azure Communication Services	Everything the product stores, encrypted at rest; the sign-in token; the contact form's contents	South Africa (Microsoft's South African Azure region)
Paddle.com Market Ltd (UK) / Paddle.com Inc. (US)	Takes card payments as merchant of record and runs the monthly subscription: it sells you the subscription on our behalf, calculates and remits VAT or sales tax, and issues your receipt and invoice. For the card transaction Paddle is a responsible party in its own right, under its own privacy policy, as well as our operator	Your name, email address, company reference and billing country and address; your card details, entered on Paddle's hosted checkout and never seen by us	United Kingdom and United States
Google LLC (Fonts)	Serves the typefaces this website uses	Your IP address and browser details, in the request for the font files. No cookie is set.	Global
Google LLC (Analytics)	Measures how this website is used, only if you turn on Google Analytics	The pages you visit on this website, whether you started or finished a sign-up, the page you came from, your approximate location, your device and browser, and a random identifier kept in a cookie. Not used for advertising: the signals Google uses for ads stay switched off. It receives nothing from the product.	United States and wherever Google processes data
Google LLC (Ads)	Tells us which of our Google ads led to a visit, a sign-up or a demo request, only if you turn on Google Ads	That you visited this website, started or finished a sign-up or sent the contact form, with the ad you clicked if you came from one, your approximate location, your device and browser, and a random identifier kept in a cookie. Never what you typed into the form. Not used to show you ads: personalised advertising stays switched off, and it runs in Google's restricted data processing mode. It stays off when your browser sends the Global Privacy Control signal. It receives nothing from the product.	United States and wherever Google processes data
Microsoft Corporation (Clarity)	Records how this website's pages are used, so we can see where people get stuck, only if you turn on Microsoft Clarity	Your clicks, scrolling and mouse movement on this website, the pages you visit and the page you came from, your approximate location, your device and browser, and a random identifier kept in a cookie. Text you type is hidden before it leaves your browser. Not used for advertising. It receives nothing from the product.	United States and wherever Microsoft processes data
LinkedIn Ireland Unlimited Company / LinkedIn Corporation (Insight Tag)	Tells us which of our LinkedIn ads led to a visit or a sign-up, only if you turn on LinkedIn	The pages you visit on this website, whether you started or finished a sign-up, the page you came from, your IP address, your device and browser, and an identifier kept in a cookie; if you are signed in to LinkedIn in that browser, LinkedIn links the visit to your account. We see only totals, never who you are. LinkedIn may use the visit to show you our ads on LinkedIn. It stays off when your browser sends the Global Privacy Control signal. It receives nothing from the product.	Ireland, the United States and wherever LinkedIn processes data
Meta Platforms Ireland Limited / Meta Platforms, Inc. (Meta pixel)	Tells us which of our Facebook and Instagram ads led to a visit or a sign-up, only if you turn on Meta	The pages you visit on this website, whether you finished a sign-up, the page you came from, your IP address, your device and browser, and an identifier kept in a cookie; if you are signed in to Facebook or Instagram in that browser, Meta may link the visit to your account. We see only totals, never who you are. Meta may use the visit to show you our ads on Facebook and Instagram. It stays off when your browser sends the Global Privacy Control signal. It receives nothing from the product.	Ireland, the United States and wherever Meta processes data
Microsoft Corporation (Advertising)	Tells us which of our Bing ads led to a visit or a sign-up, only if you turn on Microsoft Advertising	The pages you visit on this website, whether you finished a sign-up, the page you came from, your IP address, your device and browser, and an identifier kept in a cookie. We see only totals, never who you are. Microsoft may use the visit to show you our ads. It stays off when your browser sends the Global Privacy Control signal. It receives nothing from the product.	United States and wherever Microsoft processes data

Systems you connect. When you connect a vendor's system, we read from that vendor using the credential you granted; the vendor sees the requests we make in your name. The vendor is not our operator: it is a system you already use, under your own agreement with it.

Disclosures we may be required to make. We will disclose personal information where a law, a court order or a regulator with authority requires it. We will tell you first unless the law forbids us to, and we will disclose no more than is required.

Change of ownership. If our business is sold or merged, personal information may transfer to the successor, who will be bound by this policy. We will tell you before that happens.

7. Transfers outside South Africa

The product is hosted in South Africa. The application, its database and every document you upload or sync are held in Microsoft's South African Azure region, and sign-in and the contact form's email run through the same Microsoft tenancy. Personal information leaves the country only for the operators below, and section 72 of POPIA allows each transfer on the ground stated:

Recipient	What leaves	Country	POPIA s72 ground
Anthropic	Your questions and the records and passages each one reaches, for the duration of the model call	United States	s72(1)(a): bound by written terms giving substantially POPIA's protections, including no training and no onward transfer; and s72(1)(c): necessary to perform the contract, since an answer cannot be composed without the model reading the question
Voyage AI	Document passages, search phrases, and descriptions of what a department could not answer (with no figure, date, name or record), for the duration of the embedding call, when a deployment has it configured	United States	s72(1)(a) and s72(1)(c), as above
TypeSafe	Your questions, split by department, for the duration of the call that chooses the model; a department's part of a question and the words of its web search, for the duration of the call that judges the search, when Business context is on; and document passages with their file names, and the search phrase that found them, for the duration of the scoring call, when a deployment reorders search results	United States	s72(1)(a) and s72(1)(c), as above
Paddle	Your name, email address, company reference and billing country and address, if you pay by card	United Kingdom and United States	s72(1)(c): necessary to perform the contract you chose to pay by card, which is concluded with Paddle as merchant of record; s72(1)(a): Paddle's terms and the laws it is subject to, including UK data protection law
Google (Fonts)	Your IP address, in the request for this website's typefaces	Wherever Google's nearest edge server is	s72(1)(a): Google's published terms; the request carries no cookie and identifies no account
Google (Analytics)	The pages you visit on this website and the details listed in section 6, only if you turn on Google Analytics	United States and wherever Google processes data	s72(1)(b): your consent, given by turning it on in the cookie panel; and s72(1)(a): Google's data processing terms
Google (Ads)	That you visited this website, started or finished a sign-up or sent the contact form, and the details listed in section 6, only if you turn on Google Ads	United States and wherever Google processes data	s72(1)(b): your consent, given by turning it on in the cookie panel; and s72(1)(a): Google's data processing terms
Microsoft (Clarity)	How you use this website's pages and the details listed in section 6, only if you turn on Microsoft Clarity	United States and wherever Microsoft processes data	s72(1)(b): your consent, given by turning it on in the cookie panel; and s72(1)(a): Microsoft's data protection terms
LinkedIn (Insight Tag)	The pages you visit on this website, whether you started or finished a sign-up, and the details listed in section 6, only if you turn on LinkedIn	Ireland, the United States and wherever LinkedIn processes data	s72(1)(b): your consent, given by turning it on in the cookie panel; and s72(1)(a): LinkedIn's data processing terms
Meta (pixel)	The pages you visit on this website, whether you finished a sign-up, and the details listed in section 6, only if you turn on Meta	Ireland, the United States and wherever Meta processes data	s72(1)(b): your consent, given by turning it on in the cookie panel; and s72(1)(a): Meta's data processing terms
Microsoft (Advertising)	The pages you visit on this website, whether you finished a sign-up, and the details listed in section 6, only if you turn on Microsoft Advertising	United States and wherever Microsoft processes data	s72(1)(b): your consent, given by turning it on in the cookie panel; and s72(1)(a): Microsoft's data protection terms

If you are outside South Africa. Your company's information is sent to and stored in South Africa, and processed in the United States by the operators in section 6 (and, for card payments, by Paddle in the United Kingdom). Data protection law in those countries may differ from yours. An Enterprise agreement can place the deployment in the region you require.

TypeSafe's other requests (section 6), which choose methods, business terms and a new company's departments, carry nothing that is personal information: a kind of business, department names and descriptions, kinds of system, and published method and term descriptions.

Where none of those grounds applies to a particular transfer, we rely on your consent under s72(1)(b), which you give by signing up after reading this policy and may withdraw by cancelling. If the model and embedding calls leaving the country is a constraint for you, say so on the demo call and we will tell you plainly what can and cannot be arranged; an Enterprise contract can add a data processing agreement that records the position.

8. How long we keep it

Section 14 of POPIA says we may keep personal information no longer than the purpose requires unless a law or a contract requires longer. Our periods:

Information	Kept for
Contact form messages	Until the enquiry is closed and for 12 months after, then deleted
Sign-up records that did not become an account	90 days, then deleted
Account, billing and invoice records	The life of the account and five years after it closes, as tax and company law require
Questions and usage	The life of the account. You can look back over the audit-trail period of your tier (30, 90, 365 or 730 days, or as agreed on Enterprise); the period is measured on read, so an upgrade lets you see what a smaller tier would have hidden
Answers and their provenance	Not kept by us. They are kept in the browser of the person who asked, which holds the last 30 conversations, until that person clears them
What a specialist read while answering	24 hours after the conversation's last question, then deleted automatically; it is kept only so a follow-up does not read everything again
Notes a department has learned about how your company works	Until the company is deleted. A note drawn from a document is removed when that document is deleted, re-filed or moved. An administrator can switch learning off on the Company page, after which the notes are not used
Gaps between departments' figures	Kept only while learning is switched on. Deleted 180 days after the gap was last seen, or when the company is deleted. An administrator can dismiss a gap; it returns only if it is seen again
Research findings	An unconfirmed finding stops being used 90 days after it was last refreshed and is deleted after 180 days. A finding your administrator has confirmed or corrected is kept until they remove it. All are deleted when your company is deleted. None is kept while learning from use is switched off
Uploaded and synced documents, and their passages	Until you remove them, or the account closes; passages are deleted with the document they belong to
Connection credentials	Until you remove the connection or the account closes; deleted, not archived
Sign-in session	Eight hours from sign-in; the cookie expires and is not renewed silently
Server logs	30 days, unless kept longer for a specific security investigation
Website analytics	14 months in Google Analytics, then deleted; the cookie in your browser lasts up to 2 years unless you clear it or switch it off
Recordings of visits	30 days in Microsoft Clarity, then deleted, unless we mark a recording to keep, which keeps it up to 13 months; Clarity's other data is kept 13 months. Its cookie in your browser lasts up to 1 year unless you clear it or switch it off
Ad conversions	Kept by Google under its advertising terms; the cookies in your browser last 90 days unless you clear them or switch Google Ads off
LinkedIn visits	Kept by LinkedIn under its advertising terms; reports we see are totals. The cookies in your browser last up to 30 days unless you clear them or switch LinkedIn off
Meta visits	Kept by Meta under its business terms; reports we see are totals. The cookies in your browser last 90 days unless you clear them or switch Meta off
Microsoft Advertising visits	Kept by Microsoft under its advertising terms; reports we see are totals. The cookies in your browser last up to 13 months unless you clear them or switch Microsoft Advertising off

When an account closes, the ability to ask stops at once and the remaining information is deleted at the end of the periods above. Backups are overwritten on a rolling cycle of not more than 35 days.

9. How we protect it

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. The security page describes the architecture; the measures that matter most for personal information are:

• every request is resolved to one company and one person before anything is read, and every query is scoped by that company, so no request can reach another tenant's data;
• what a person may do and what they may see are two separate controls, set by an administrator and re-checked on every request;
• connection credentials are encrypted at rest with a key held outside the database, and are never returned once saved;
• all traffic is encrypted in transit; the session cookie is HTTP-only, secure and expires in eight hours; the sign-in token is verified against the directory's published keys, never merely read;
• every connection is read-only by construction, so a compromise of the product could not be used to alter your systems;
• operator access to a customer's tenant for support is granted in the deployment's configuration, not in the product, so no administrator inside the product can grant it to themselves;
• the product host is excluded from search engines and answers no request without a session.

If something goes wrong. If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible, as section 22 of POPIA requires, and where we are the operator we will notify the responsible party immediately so that it can do so.

10. Cookies and similar technologies

This website asks before it sets any cookie. Google Analytics, Microsoft Clarity, Google Ads, LinkedIn, Meta and Microsoft Advertising each have their own switch; a switch appears in the panel once that service is in use on this site. If you turn one on, the site loads it and it sets the cookies below; if you leave it off, the site loads nothing for it, sets no cookie for it and sends it nothing. Your choice is remembered in your browser's local storage, not in a cookie. You can change it at any time: Cookie settings, also at the foot of every page. Switching one off again deletes its cookies. Google Ads only measures which of our ads led somewhere, in Google's restricted data processing mode; the site shows no ads and builds no audiences. LinkedIn tells us which of our LinkedIn ads led to a visit or a sign-up, and may use the visit to show you our ads on LinkedIn. Meta and Microsoft Advertising do the same for our Facebook, Instagram and Bing ads. If your browser sends the Global Privacy Control signal, Google Ads, LinkedIn, Meta and Microsoft Advertising stay off and their switches cannot be turned on. The fonts are loaded from Google, which sees the request (section 6).

Name and kind	Purpose	Lasts
_ga (Google Analytics cookie)	A random identifier that tells one visit from another, so we can count visitors and see which pages they read.	2 years
_ga_S8M4CT4G5J (Google Analytics cookie)	Keeps track of the current visit.	2 years
_clck (Microsoft Clarity cookie)	A random identifier that tells one visitor from another, so visits can be grouped.	1 year
_clsk (Microsoft Clarity cookie)	Joins the pages of one visit into a single recording.	1 day
_gcl_au (Google Ads cookie)	A random identifier that lets Google tell which ad, if any, led to a sign-up or a demo request.	90 days
_gcl_aw (Google Ads cookie)	Set only when you arrive from one of our ads: remembers that click, so a later sign-up or demo request can be counted against it.	90 days
li_fat_id (LinkedIn cookie)	Set only when you arrive from one of our LinkedIn ads: remembers that click, so a visit or a sign-up can be counted against it.	30 days
li_giant (LinkedIn cookie)	An identifier for a group of LinkedIn members, used to count visits from our ads without naming anyone.	7 days
_fbp (Meta cookie)	A random identifier that lets Meta tell which of our Facebook or Instagram ads, if any, led to a visit or a sign-up.	90 days
_fbc (Meta cookie)	Set only when you arrive from one of our Facebook or Instagram ads: remembers that click, so a later sign-up can be counted against it.	90 days
_uetsid (Microsoft Advertising cookie)	Joins the pages of one visit, so a sign-up can be counted against the ad that led to it.	1 day
_uetvid (Microsoft Advertising cookie)	A random identifier that tells one visitor from another across visits.	13 months
_uetmsclkid (Microsoft Advertising cookie)	Set only when you arrive from one of our Bing ads: remembers that click.	90 days
LinkedIn's own cookies, on linkedin.com	Set by LinkedIn on its own domain when LinkedIn is on, to recognise LinkedIn members and measure our ads; covered by LinkedIn's cookie policy.	Up to 1 year
Meta's own cookies, on facebook.com and instagram.com	Set by Meta on its own domains when Meta is on, to recognise its members and measure our ads; covered by Meta's cookie policy.	Up to 1 year
Microsoft's own cookies, on bing.com	Set by Microsoft on its own domain when Microsoft Advertising is on, to measure our ads; covered by Microsoft's privacy statement.	Up to 13 months
Google's own cookies, on google.com and doubleclick.net	Set by Google on its own domains when Google Ads is on, to measure ad conversions; covered by Google's privacy policy.	Up to 13 months
Microsoft's own cookies, on clarity.ms	Set by Microsoft on its own domain when Clarity loads, to tell visitors apart; covered by Microsoft's privacy statement.	Up to 1 year
Your choices (local storage, not a cookie)	Remembers which optional cookies you allowed, so the cookie panel is not shown again, and the light or dark theme if you picked one. Always on; it never leaves your browser.	Until you clear your browser's site data

The product at app.synapticintelligence.ai sets exactly the following:

Name and kind	Purpose	Lasts
Session cookie	Keeps you signed in after your directory has authenticated you. Strictly necessary; the product does not work without it.	8 hours
Handshake cookie	Carries the one-time state that protects the sign-in and connector-consent redirects from forgery.	Minutes; deleted when the redirect completes
Browser session storage	Remembers, for the current tab only, which company an operator is standing in and whether a tier preview is on.	Until the tab is closed

None of these tracks you across sites, and none is used for advertising. Because they are all strictly necessary, the product shows no consent banner; blocking them in your browser will prevent sign-in. The product runs no analytics.

11. If you are in the United States

US state privacy laws, such as California's, ask us to say the following. It applies to people we deal with directly (section 3).

What we collected in the last 12 months. Identifiers: your name, email address, IP address and cookie identifiers. Commercial information: your company's plan and billing records. Internet activity: the pages you visit on this website, only if you turn analytics on. Professional information: your business title and company. And the content of the questions and documents a company gives us. Section 4 says where each comes from, section 5 why we use it, and section 8 how long we keep it.

No selling. Sharing only with LinkedIn, Meta and Microsoft Advertising, and only if you allow it. We do not sell personal information. Google Ads, if you turn it on, only measures which of our ads led to a visit, a sign-up or a demo request, in Google's restricted data processing mode. LinkedIn, Meta and Microsoft Advertising, if you turn them on, may use your visit to show you our ads on their services, which these laws count as sharing for cross-context behavioural advertising; each is off unless you switch it on, and you can switch it off at any time from Cookie settings. We honour the Global Privacy Control signal: if your browser sends it, Google Ads, LinkedIn, Meta and Microsoft Advertising stay off.

No sensitive personal information. We do not collect sensitive personal information about the people we deal with directly.

Your requests. Wherever you live, you can ask to know what personal information we hold about you, get a copy of it, correct it or delete it, or ask us to stop any sale or sharing, by emailing info@synapticintelligence.ai. Someone you authorise can ask for you. We verify a request by email, from the address we hold for you. Asking will not change how we treat you. If we refuse, you can appeal by replying to our answer.

12. Your rights

Under POPIA you may, free of charge unless the Act allows a fee, and by writing to the Information Officer (section 2):

• ask whether we hold personal information about you, and for a copy of it (section 23), together with the identity of everyone who has had access to it;
• ask us to correct or delete information that is inaccurate, out of date, incomplete, misleading, or that we are not entitled to hold (section 24);
• object to processing that rests on our legitimate interests (section 11(3)), and to any direct marketing (section 11(3)(b)), on reasonable grounds;
• withdraw consent where consent is our basis (section 11(2)); this does not affect processing done before the withdrawal, and it may mean we cannot provide the service;
• ask about automated decision-making (section 71), though we make none;
• complain to the Information Regulator (section 13).

We will confirm receipt within five business days and answer within 30 days. If we need longer, we will say so and why, within that time. If we refuse a request, we will tell you why and how to complain. Where you are asking about information held in a customer's connected systems, we will pass the request to that customer as the responsible party and help them answer it.

People in a customer's company can see the questions they asked and the answers they received in the product; an administrator can remove documents and connections; and a company's administrator can end the account, which triggers the deletion in section 8.

13. Complaints and the Information Regulator

If you think we have handled your personal information wrongly, please tell the Information Officer first: we would rather fix it than be told about it later. You also have the right to lodge a complaint with the Information Regulator (South Africa) at any time:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints: complaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Website: inforegulator.org.za

14. Children

The service is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18, and a person under 18 may not sign up. If you believe a child has given us personal information, tell the Information Officer and we will delete it. A customer who connects a system containing children's information, such as a school's records, is the responsible party for it and must have the competent person's consent that section 35 of POPIA requires.

15. Changes to this policy

We will change this policy when the service, the law or our operators change. Each version carries its version number and effective date at the top. A change that adds an operator who receives your data, moves it to a new country, or uses it for a new purpose will be notified to your company's administrators by email at least 30 days before it takes effect, and you may cancel before then if you do not accept it. Other changes take effect when published here. The version in force is always the one at synapticintelligence.ai/privacy.