About this notice
Last updated: 16 September 2026.
Synaps helps people create and collaborate on design projects. We use personal information to provide the service, keep it reliable, support our users and understand how to make the product better. Optional analytics help us see which features are useful and where people run into difficulties. Advertising measurement has its own purpose and choice, described below.
This notice covers synaps.app, our app on Synaps subdomains, including beta.synaps.app and my.synaps.app, and related communications. The controller for the account, product analytics and marketing activities described here is synaps GmbH, Seitenstettengasse 5/37, 1010 Vienna, Austria. Contact us at office@synaps.app.
Information needed to provide Synaps
Account and workspace information includes your name, email address, account identifier, profile details, workspace membership, permissions and onboarding answers. If you sign in with Google, we receive the profile and authentication information made available through that sign-in, such as your name, email address and profile picture.
We process the projects, files, comments, prompts and other content you choose to create or share, along with the information needed to save and collaborate on them. Other workspace members can see content according to the permissions and sharing options you use. You are responsible for having permission to include other people's information in your content.
For paid plans, we process subscription, billing and payment-status information. Stripe handles payment details; we receive the information needed to manage your subscription, invoices and payment history. When you contact us or book a demo through Cal.com, we process the details you submit to respond and arrange the meeting.
We do not ask you to include sensitive personal information in designs, prompts or support messages. Please avoid including it unless it is necessary for your use of the service.
Understanding and improving the product
With Analytics consent, we use PostHog to understand how people move through the website and use Synaps. This includes page visits, clicks, time spent on pages, onboarding, feature use, collaboration, imports and exports, AI-feature outcomes, loading performance and subscription changes. These signals help us prioritise improvements and identify where users have difficulties.
Events can include browser and device information, such as graphics hardware and display characteristics (including device pixel ratio), IP-derived location, page URLs and referrers, account, workspace and project identifiers, your plan and team size, and relevant file or asset names. Collaboration events can also include collaborator identifiers. When you are signed in, PostHog activity is linked to your account ID and email address. A shared browser identifier can connect visits to our website and app. We use the resulting records to understand individual product journeys as well as to produce overall reports.
Selected onboarding and session events may be held temporarily in browser memory while your choice is being resolved, and sent after Analytics is allowed. Declining clears this pending information. Session replay is disabled in our current website and app configuration.
The app also uses PostHog to deliver feature settings before an Analytics choice is made, without persistent analytics storage. This involves requests to PostHog. A refusal or withdrawal can send a consent-status update. These functions are separate from ordinary product-event collection.
Improving AI features
When you use an AI feature, the providers supporting it, including Google and OpenAI, process your prompt and the content needed for that request. The information involved depends on the feature and what you submit; it can include personal information contained in your input.
With Analytics consent, we also keep prompt text from selected AI features to understand common requests and unsuccessful results and improve those features. These records include your account and, where relevant, workspace identifier, the feature used, the time and whether the request succeeded. We replace obvious email addresses and long number sequences before storing this analysis copy. This safeguard is limited. Names, addresses and other personal information may remain.
Our product-review tools can use Google Gemini to summarise these stored prompts into themes. This is separate from producing the answer you requested. The prompt-analytics events sent to PostHog contain prompt length and outcome rather than the prompt text itself.
Keeping Synaps reliable
We use technical logs and Sentry to investigate errors, monitor performance and protect the service. Diagnostic information can include browser and device details, page or request context, error messages, account ID and email address, and technical information about the action that failed. Cloudflare also processes service logs and selected performance traces.
This operational processing is separate from optional product analytics and can continue when Analytics or Advertising is declined. We use it to maintain a working, secure service. We limit automatic request details in backend error reports, but diagnostic records may still contain information relevant to an error.
Website measurement and advertising
We use Google Analytics to understand website visits and selected actions, such as viewing pricing or choosing to create an account. On the website, Analytics controls Google analytics storage. In the app, the Google tag currently follows the Advertising choice and measures page visits.
On the website, Google Consent Mode loads with storage and advertising signals denied unless you have allowed them. Google can receive cookieless measurement pings before a choice or after refusal. These can include technical information about the visit and its consent status; declining cookies does not mean that no request reaches Google.
With Advertising consent, the website uses Meta Pixel to measure page visits and pricing interest. Meta Platforms Ireland Limited receives visit signals, browser and network information and advertising identifiers. Campaign information can include Google and Meta click identifiers. We use advertising-related signals to understand how people find Synaps and improve the relevance and effectiveness of our own campaigns.
Google Ireland Limited and Meta Platforms Ireland Limited process information under their own applicable terms and privacy notices as well as their arrangements with us. Advertising consent controls the website's Google advertising storage, user-data and personalisation signals. Their policies are available at https://policies.google.com/privacy and https://www.facebook.com/privacy/policy/. We do not display third-party advertisements within Synaps.
Emails, support and product communications
We use Brevo to send account, billing, collaboration and other service messages, and to manage onboarding and product communications. When you sign up, your email address, name, signup date and plan are added to an onboarding contact list. Service events can update that record with information such as subscription status, credit usage and workspace activity. Collaboration notifications may include a short comment excerpt.
These details help us send useful messages at the relevant point in your use of Synaps. Links in emails may include campaign labels so that we can understand which communications lead people back to the product. Analytics and Advertising cookie choices are separate from email preferences.
You can unsubscribe from promotional emails using the link in the message or by contacting office@synaps.app. We may still send essential account, security and billing communications. We use consent where required for promotional communications; any applicable existing-customer exception is limited by the relevant law.
Why we process this information
We rely on performance of our contract with you, or steps you ask us to take before a contract, to provide accounts, save and share your work, fulfil AI requests, manage subscriptions and respond to service requests (Article 6(1)(b) GDPR). We process records required for accounting, tax and other legal duties under Article 6(1)(c).
Optional product analytics, prompt-content analysis and consent-based advertising use your consent (Article 6(1)(a)). You can withdraw that consent. Acceptance of our terms is not consent to optional tracking.
Our legitimate interests under Article 6(1)(f) include operating and securing the service, delivering feature settings, diagnosing faults, handling enquiries and maintaining consent records. We balance those interests against your rights. Consent is still required where applicable rules require it for device storage or access; calling a technology cookieless does not itself create an exemption.
Google's denied-consent website measurement is described above so you can distinguish it from consented storage. Its technical consent signals do not replace the legal requirements that apply to our processing.
The providers that help us
We use service providers for hosting, authentication, storage, payments, communications, AI and measurement. These include Cloudflare and Supabase for infrastructure and account services, Stripe for payments, PostHog for product analytics and feature settings, Sentry for diagnostics, Brevo for communications, Cal.com for demo scheduling, and Google and OpenAI for the AI features described above. Google and Meta also receive the measurement and advertising information described in this notice.
Providers receive information relevant to the functions they perform. Some act on our instructions; others, including certain payment and advertising services, also process information for their own purposes under their privacy notices. We may also disclose information where required by law, to protect legal rights or in connection with a business transfer, subject to applicable safeguards.
Our PostHog integration uses its EU service. The use of European infrastructure does not mean that all provider processing or access is limited to Europe. Where personal information is transferred outside the EEA, the applicable safeguard may be an adequacy decision or contractual safeguards such as the European Commission's standard contractual clauses. You can contact us for details of the arrangements relevant to your information and how to obtain a copy of the safeguards.
How long information is kept
We keep account and project information for the period needed to provide the service and manage your relationship with us. When you delete your account, we begin removing associated account and project data. Shared workspace information may also relate to other members, and legal, security and backup requirements can affect when removal is complete.
For product events, diagnostic records and communication history, retention depends on the purpose, whether the information is still needed to investigate an issue or understand product use, and the retention settings of the provider involved. We retain billing and legal records for the periods required by applicable law, and may retain information necessary to establish or defend a legal claim.
The prompt-analysis records in our app database are linked to your account and are removed when the associated account is deleted. Provider records, copies in backups and previously prepared reports have separate handling requirements. Browser-cookie expiry does not delete information already received by a provider.
Withdrawing consent limits future consent-based processing; it does not automatically erase information already collected. You can separately request deletion. Contact us for the retention criteria or deletion process relevant to your information.
Your choices and rights
Open Cookie settings in the website footer or Settings, then Privacy, in the app to manage optional measurement choices. Choices can be stored in your browser and, when signed in, on your account. You may be asked again if a notice changes, your browser storage is cleared or a choice is not available on another device. See synaps.app/cookies for the technologies and controls.
Under applicable data-protection law, you can request access, correction, deletion, restriction and, where applicable, portability of your personal information. You can withdraw consent at any time without affecting processing that was lawful before withdrawal. You can object to processing based on legitimate interests and to direct marketing.
Email office@synaps.app to exercise these rights or ask a question. We may need information to verify your identity. Some requests are subject to legal exceptions, including obligations to keep billing records. You can complain to the Austrian Data Protection Authority at https://www.dsb.gv.at/ or to the supervisory authority where you live or work.
We do not currently use browser Do Not Track signals as a substitute for the choices in our consent controls. You can also manage cookies through your browser, although disabling necessary storage may affect sign-in or other service functions.
Security, age and changes
We use technical and organisational measures designed to protect personal information, including access controls and safeguards appropriate to the services involved. No online service can guarantee complete security. Please protect your account and take care when sharing project links or inviting collaborators.
Synaps is intended for adults aged 18 and over. If you believe a child has provided personal information to us, please contact office@synaps.app.
We update this notice as the service and its processing change. The date above identifies this version. Where a change requires fresh consent, we must obtain it separately. Publishing a new notice does not grant it.