Privacy Policy

1. Who We Are and What This Policy Covers

This Privacy Policy explains how Saynovo, a product of SyntroAI ("Saynovo", "we", "us", "our"), collects, uses, shares, and protects personal information when you visit saynovo.com, create an account, connect a Google Business Profile, generate and edit a website, or publish a site on your own domain. For questions or requests about your data, email [email protected].

This Policy does not govern the websites our customers create and publish through Saynovo. For those sites, the customer who operates the site is the business responsible for its visitors' data, and Saynovo acts only as a service provider or processor on the customer's behalf, as described in Section 8.

2. Information We Collect

Information you provide directly:

• Account information - your email address and basic profile details when you create a Saynovo account. Sign-in is by emailed link; we do not store passwords.
• Business details - the business name, address, phone number, hours, services, photos, and other content used to build and publish your website, whether you enter it yourself, import it, or it is drawn from your connected Google Business Profile.
• Edit instructions - the prompts and messages you send to the Saynovo editor when you talk to your site to change it, along with the resulting versions of your site content.
• Subscription and billing details - your plan, billing email, and limited transaction records. Payments are processed by Stripe; we never receive or store your full card number. See Section 5.
• Messages and requests - support emails and service requests you submit.

Information from Google Business Profile:

When you choose to connect your Google Business Profile, you authorize Saynovo through Google's official sign-in to read profile information such as your business name, address, phone number, hours, categories, description, reviews, and photos. We use this information only to provide and improve the user-facing features you asked for - generating and populating your website and keeping it current. We request the narrowest access needed and you can disconnect at any time, as described in Section 12.

Google Limited Use disclosure. Saynovo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, this means we (1) use Google Business Profile data only to provide and improve the user-facing features that are prominent in Saynovo - generating and maintaining your website - and only access it with your consent; (2) do not transfer that data except as necessary to provide those features (for example, sending imported business data to our AI provider to generate your site and to our hosting provider to serve it), to comply with applicable law, or as part of a merger, acquisition, or asset sale with notice to you; (3) do not use it for serving advertisements or to determine creditworthiness or for lending purposes; and (4) do not allow humans to read it, except with your consent for support you request, to comply with law, for security, or where the data has been aggregated and anonymized. We do not sell Google user data, and we do not use it to train generalized AI or machine-learning models.

Information from visitors to your published site:

When you publish a website with Saynovo, visitors to that site may submit information through it, for example by using a contact or quote form. For that visitor data, you are the controller and Saynovo acts as your service provider or processor, as described in Section 8. Requests from a visitor about their data should be directed to the business that operates the site; we will assist that business in honoring such requests.

Information collected automatically:

• Essential cookies - a session cookie to keep you signed in. We do not use third-party advertising cookies. See Section 9.
• Logs - standard server logs (IP address, browser type, pages requested) used for security and troubleshooting, including logs generated by our hosting and network provider.
• Usage data - features used, AI-edit consumption, and timestamps, so we can meter usage and operate your subscription.
• Preferences - settings such as theme choice, stored in your browser.

Information we do not intentionally collect:

Saynovo is a business website tool. We do not ask for, and you should not submit, government identifiers, health information, financial account credentials, or other sensitive personal information through the service.

3. How We Use Information

• to provide, operate, host, and secure the Saynovo service, your account, and your site;
• to generate a website from your business details and your connected Google Business Profile;
• to apply the changes you request when you talk to your site in the editor;
• to publish your site on your own custom domain and provision and renew SSL for it;
• to meter usage (including AI edits), process payments and manage subscriptions through Stripe, deliver receipts and billing notices, and provide support;
• to monitor for, prevent, and investigate fraud, abuse, security incidents, and violations of our terms;
• to send service notices, and, with your consent or as otherwise permitted by law, product updates you have asked for;
• to comply with legal obligations and enforce our terms.

Where a legal basis is required, we rely on performance of our contract with you, our legitimate interests in operating, securing, and improving the service, your consent (for example, connecting your Google account or receiving marketing), and compliance with legal obligations. In Canada, we collect, use, and disclose personal information with consent and for purposes a reasonable person would consider appropriate in the circumstances.

4. AI Processing and Edit Prompts

Saynovo uses AI to generate your website and to make the edits you request when you talk to your site. To do this, some content - such as your business details, imported Google Business Profile data, and your edit instructions (the prompts you speak or type) - is sent to our AI model provider, Anthropic, through its commercial API, and the generated site or changes are returned as output. We send only what is needed for the feature to work.

Under Anthropic's commercial terms, data sent through the API is not used to train Anthropic's models by default; Anthropic may retain API data for a limited period (approximately 30 days) for trust-and-safety and legal compliance purposes under its own terms. We do not use your personal information or your site content to train our own or any third party's AI models.

We retain your edit prompts and the related processing logs for a default window of 90 days so we can apply your changes, show you your edit history, troubleshoot, and protect against abuse, after which they are deleted or anonymized on a rolling basis. You can delete this data sooner by deleting your account, as described in Section 12. AI output can be inaccurate; you are responsible for reviewing your generated website content before publishing, as described in our Terms of Service.

5. Billing and Payments

Subscription purchases and AI-edit purchases are processed by Stripe, Inc. ("Stripe"), our payment processor. Saynovo (operated by SyntroAI) is the seller of record for the transaction. When you pay, your card details are collected and processed directly by Stripe under its own privacy policy; Stripe acts as our service provider (processor) for payment processing and as an independent controller for its own fraud-prevention and legal-compliance purposes. Saynovo receives only limited billing data, such as your name, billing email, subscription tier, transaction status, and the last digits or a token of a payment method. Saynovo never receives or stores your full card number.

6. How We Share Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only with:

• Service providers (sub-processors) that help us operate, under contracts limiting their use of the data: Anthropic (AI processing), Cloudflare (hosting, custom domains, SSL, and security), our managed database and queue hosts, our source-repository host, and our email delivery provider. Our current list is published at Sub-processors;
• Stripe - our payment processor, which handles payment processing and, for its own fraud-prevention and legal-compliance purposes, acts as an independent controller, as described in Section 5;
• Google - only as needed to read the profile data you authorized when you connect your Google Business Profile;
• The public - content you choose to publish on your website is, by its nature, public once the site is live on your domain;
• SyntroAI - Saynovo is a SyntroAI product and shares infrastructure and staff with its parent. If you engage SyntroAI to expand your site into custom software, information needed for that engagement is shared internally for that purpose;
• Professional advisors - lawyers, accountants, and auditors under confidentiality obligations;
• Legal and safety - when required by law, legal process, or to protect rights, safety, and the integrity of our services;
• Business transfers - in connection with a merger, acquisition, financing, or sale of assets, subject to this policy and with notice where required by law.

7. Your Website and Its Source

Saynovo is a hosted service. We build, host, and maintain your website as a platform asset on your behalf; you do not receive or download the underlying source code. You retain ownership of the business content you provide and publish (such as your text, photos, and logo). Deletion obligations in this policy apply to personal information and your content, not to Saynovo's platform code, templates, or de-identified derived data. If you later engage SyntroAI to expand your site into custom software, that is a separate engagement under its own agreement.

8. Sites You Publish: You Are the Controller for Your Visitors

Saynovo wears two hats. For the data described elsewhere in this policy - your account, your business content, your billing relationship, and your use of saynovo.com - Saynovo decides how and why data is processed and is the responsible business (controller). But when your published site collects personal information from your visitors - for example, contact form submissions, quote requests, and the server logs generated by hosting your site - you (the customer) are the business or controller responsible for that data, and Saynovo processes it only on your behalf and on your instructions as a service provider or processor.

As the operator of your published site, you are responsible for:

• publishing your own privacy notice on your site that accurately describes your data practices - visitors to your site should read that notice, not this one;
• obtaining any consents your visitors' jurisdictions require;
• responding to your visitors' privacy rights requests - if a visitor contacts Saynovo directly about data on your site, we will direct them to you and assist you in responding;
• not collecting sensitive data categories through your site without an appropriate legal framework in place.

Saynovo will not use your site visitors' data for its own purposes, except in aggregate or de-identified form to operate, secure, and improve the platform, or as required by law. Business customers who need a formal data processing agreement can review our Data Processing Addendum or email [email protected].

9. Cookies

On saynovo.com we use cookies and similar technologies for strictly necessary purposes - a session cookie to keep you signed in, security, and load balancing - and for functional preferences such as remembering settings like theme choice. We do not use third-party advertising cookies, and we have not added a cookie-based analytics tool; if that changes, we will update this section and obtain any consent the law requires.

You can control cookies through your browser settings; blocking strictly necessary cookies may break sign-in and core features. We honor Global Privacy Control (GPC) signals where the law requires; we do not respond to other "Do Not Track" browser signals.

10. Data Retention

We keep personal information only as long as needed for the purposes described in this policy:

• Account and site data - for the life of your account and subscription, and deleted when you delete your account as described in Section 12;
• Edit prompts and processing logs - for a default rolling window of 90 days, after which they are deleted or anonymized;
• Google Business Profile data - retained only while your profile stays connected; when you disconnect it, the data derived from it is purged from your site as described in Section 12;
• Billing records - the limited transaction data we hold is retained as required for tax, accounting, and legal obligations even after account deletion; payment records held by Stripe are retained under its own policies and legal obligations;
• Server and security logs - retained for a limited rolling window (default 90 days) for security and troubleshooting.

If you cancel without deleting your account, we retain your data for a reasonable wind-down period and then delete or anonymize it, except where we must keep records to meet a legal obligation. Residual copies in encrypted backups expire on their normal rolling cycle.

11. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, SSL on published sites, access controls, signed sign-in links, and secrets kept out of our database. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security; you are responsible for keeping access to your sign-in email confidential. If we learn of a breach affecting your personal information, we will notify you and regulators as required by law.

12. Your Rights, Deletion, and Disconnecting Google

We extend the core rights below to all users, subject to verification of your identity and any limits in applicable law. We will not discriminate against you for exercising your rights, and you may use an authorized agent where the law allows (we may require proof of authorization).

Delete my account and all data (self-service).

You can delete your account and all of your data yourself, without contacting us, from your account page using the "Delete my account and all data" action. When you confirm it, we revoke any connected Google authorization, take down and delete your published site, and delete your account, business details, generated site content, edit prompts, and associated logs from our active systems. We complete this deletion promptly and in any case within 30 days, except for the limited records we are legally required to keep (such as billing and tax records) and routine backups, which are purged on their normal rolling cycle. This action is permanent and cannot be undone.

Disconnect Google Business Profile (delete on disconnect).

You can disconnect your Google Business Profile at any time from your account page, or from your Google account's connected-apps controls. When you disconnect from within Saynovo, we revoke the OAuth token and purge the data derived from your Google Business Profile from your site and our active systems; your site keeps only the content you have entered or edited yourself, which you can change or remove. Disconnecting stops all further access to that profile.

Canada (PIPEDA and provincial laws).

You have the right to access the personal information we hold about you, to challenge its accuracy and completeness and have it amended as appropriate, and to withdraw consent to further collection, use, or disclosure (subject to legal or contractual restrictions and reasonable notice; withdrawing consent for core processing may require deleting your account). You may also complain to us and to the Office of the Privacy Commissioner of Canada.

United States state privacy laws.

Depending on your state, you may have the right to know and access the personal information we have collected about you, to correct inaccurate personal information, to delete personal information subject to statutory exceptions, and to obtain a portable copy of it. Saynovo does not sell personal information and does not share it for targeted advertising, so there is no sale or sharing to opt out of; we honor Global Privacy Control signals where required. We do not use sensitive personal information for purposes that would require a right to limit its use. If we deny your request, you may appeal by replying to our decision, and we will respond as the applicable law requires.

European Economic Area, United Kingdom, and Switzerland.

Saynovo is built for businesses in the United States and Canada. If you nevertheless use the service from the EEA, UK, or Switzerland, you may have rights under GDPR-style laws to access, rectify, erase, restrict, or object to processing, to data portability, to withdraw consent, and to lodge a complaint with your local supervisory authority.

To exercise any other right, or if you need help, email [email protected]. We will verify your request and respond within the time required by applicable law. Where we hold visitor data as a processor for one of our customers, we will refer the request to that customer and assist them in responding. Marketing emails we send include an unsubscribe link; service emails needed to operate your account and site cannot be opted out of while your account is active.

13. International Transfers

We operate internationally, and our infrastructure and service providers process data primarily in the United States and on global networks. If you access the service from another country, your information will be transferred to and processed in those countries, which may have different data protection laws than your jurisdiction. Where required, we rely on appropriate safeguards for such transfers, such as contractual protections with our service providers.

14. Children

Saynovo is a business tool and is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 where a higher age applies), and individuals under 18 may not create accounts. If you believe a child has provided us personal information, contact us and we will delete it.

15. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date, and for significant changes affecting active accounts we will provide reasonable advance notice by email or in the product.

16. Contact

Saynovo is a product of SyntroAI. A dedicated legal entity for Saynovo is being formed; once it exists, its registered name and business address will be published in this section and in Section 1 of the Terms of Service.

Privacy questions and requests: [email protected]. Put "Privacy request" in the subject line and we will route it to whoever handles your request.