Privacy notice

Who is responsible

SYNTELO is a product of RMY Holdings Ltd, a UK-based company. RMY Holdings Ltd is the controller responsible for the personal information described in this notice. SYNTELO is intended to be available internationally. You can contact us about privacy at privacy@syntelo.co.uk and about product support at support@syntelo.co.uk.

As a UK-based operator, our primary data-protection framework is the UK GDPR and Data Protection Act 2018, together with the Privacy and Electronic Communications Regulations 2003 and relevant changes made by the Data (Use and Access) Act 2025. Other laws may also apply depending on where you live or how we offer the service there. This notice does not claim compliance with a particular non-UK law.

Information we use

Information you provide in the app

• Account, eligibility and profile: email and account identifiers, username, display name, profile settings, an optional avatar image, your 18+ self-declaration, its server-recorded confirmation time, and the Terms and Privacy versions accepted.
• Life admin: item titles, descriptions, original text, dates, reminders, status and completion history, including information you choose to save after an AI interpretation.
• Connections and assignments: the people you connect with, requests, items you share or assign, assignment status and related history. Information about another person can appear when you choose to connect with or assign an item to them.
• Inputs for interpretation: typed text, images or photos, uploaded PDFs or text files, and audio recordings. The resulting transcript or interpretation may be shown to you and can become part of a saved item if you choose to save it.
• Messages to us: information in support or privacy correspondence.

Information generated while using the service

The app uses account/session information, an Expo push token and basic platform/device description if you enable push notifications, local reminder settings, and selected calendar details or event links if you use calendar integration. The backend also records limited, pseudonymous operational events such as an action category, app version/build, platform, broad timing bucket or error category. Service providers may process ordinary request and diagnostic information needed to run and protect their services.

The website receives ordinary web requests needed to serve and protect its pages. The early-access form is currently disabled and is not collecting signup addresses.

Why we use information

Our lawful bases under the UK GDPR are:

You need an email address to create and use an app account. Other details, optional permissions and early-access signup are choices you make; without particular information or permission, the related feature may not work.

Connections and service providers

When you use Connections or assign an item, the connected or assigned person may see the profile and item information needed for that interaction. You can read your own avatar. Other signed-in users can obtain a short-lived link only to the current avatar of a profile with a searchable username; the bucket is private and previous avatar files are not exposed through that path. Please consider what you include before sharing an item.

We use Supabase for authentication, database and avatar storage; Render for the app backend; OpenAI for requested AI interpretation and transcription; Cloudflare for website delivery, DNS and security, and for a separate early-access service if it is later enabled; and Apple and Expo services where needed for iOS distribution and push delivery. An email service also handles messages sent to our contact addresses. These providers may receive only the information needed for their respective roles and may have their own security or abuse-processing obligations. We do not sell personal information, share early-access addresses with others for their own marketing, use advertising identifiers, or use third-party behavioural advertising or session replay.

AI interpretation and transcription

If you ask SYNTELO to interpret text, a photo, image, PDF or text file, or to transcribe audio, relevant content is sent through our backend to OpenAI to provide that feature. A transcript from “Tell me” may then be sent to the text interpreter. AI output helps turn your input into an item for your review; it can be imperfect, so check important details before relying on them.

Our backend uses store: false on OpenAI Responses requests for text, image and file interpretation. Audio transcription uses a separate API and does not use that Responses setting. This is not a claim of zero provider retention: OpenAI may separately retain information for security, abuse monitoring or other applicable purposes. Uploaded interpretation files are kept temporarily by our backend for the request, which then attempts to remove those temporary copies; avatar images are different and remain in Supabase Storage while associated with your profile.

SYNTELO does not use this AI interpretation to make solely automated decisions with legal or similarly significant effects about you.

Notifications, calendar and device permissions

With notification permission, the app schedules reminders on your device and can register a push token so assignment and related notifications can be sent. The token, platform and a basic device description are stored with your account. Delivery involves Expo and the device platform’s push service, including Apple for iOS. Notification content can appear on your device and in its notification history. You can change notification permission in device settings.

If you enable calendar linking and grant calendar permission, the app can read available calendar details and create an event containing an item title, date and possibly a summary in your chosen device calendar. A link to that event is stored on your device. Calendar events may also be stored or synced by your calendar provider under its own terms. Removing an item can remove its linked event where the app can access it, but deleting your SYNTELO account or signing out does not necessarily remove calendar events already created in a device or third-party calendar; you may need to remove those yourself.

Camera, photo-library, document and microphone access are used when you choose the corresponding capture or upload feature, subject to device permissions. App session, settings, notification and calendar-link information can also remain on your device until cleared by the app or device.

Operational analytics

We record privacy-minimised, pseudonymous events to check whether important app functions work. These include allowlisted event types and limited metadata such as app version, build, platform, capture method, broad latency or error category, and outcome. The event uses a keyed pseudonymous reference rather than your email or plain account ID. Pseudonymised information is still personal information where it can be linked back to a person. We do not put task text, recording content or uploaded files into these operational events.

Events are restricted from ordinary app users and are subject to an approximately 30-day, best-effort deletion process. The account-deletion workflow also purges the account’s associated operational events.

Website early access — effective when signup opens

The website signup is not active yet and currently sends no email address to a signup service. When it is enabled, we plan to collect your email address, a normalised version to avoid duplicates, the time and version of the notice/consent you accepted, and only any minimal technical information actually needed to protect the form from abuse. This separate early-access store will not be part of the SYNTELO app production database.

With your freely given consent, we will use the address only for SYNTELO launch announcements, early-access invitations and directly related launch communications. You will be able to unsubscribe easily in those emails or by contacting privacy@syntelo.co.uk. Withdrawing consent will stop these messages. We may keep a minimal do-not-contact record so we do not accidentally email you again. We will not use the list for unrelated third-party marketing, sell it, or share it with others for their own marketing.

Website requests and cookies

The current static SYNTELO pages do not include our own analytics or advertising cookies, tracking pixels or session-replay code. We have not added browser storage to these pages. Cloudflare, as the website and security provider, may process ordinary request information such as an IP address, request time, URL and browser or device information needed to deliver and protect the site. Any security technologies used by the final hosted configuration must be checked before this notice is published. If non-essential cookies or similar technologies are added later, we will explain them and seek consent where required.

International processing

Some service providers may process information in a country other than the one where you live, including outside the UK. Where a transfer of UK personal information requires a lawful transfer mechanism or safeguard, we use an appropriate one as required by law. Other local transfer rules may also apply. Contact privacy@syntelo.co.uk for information about safeguards applicable to your information.

How long we keep information and account deletion

• Account, profile, tasks, connections, assignments and avatar: kept while needed to provide your account and the service, until you remove them or delete your account, or until they are otherwise no longer required. Shared records can be affected by another user’s deletion.
• Interpretation inputs: the backend attempts to remove temporary uploaded image, file and audio copies after processing. Information you choose to save as an item remains with that item. Provider-side security or abuse retention may continue separately.
• Operational analytics: approximately 30 days on a best-effort basis, with associated events purged by the account-deletion workflow.
• Support and privacy correspondence: kept for as long as needed to respond, keep a necessary record and meet applicable obligations.
• Early-access information, once enabled: kept until you withdraw consent, the launch-communication purpose ends, or it is otherwise no longer needed. A minimal suppression record may remain where necessary to honour an unsubscribe.
• Website and service technical information: retained only as needed for delivery, security, troubleshooting or legal obligations, subject to provider settings and retention terms that require final verification.

You can request account deletion in the app. The workflow removes the account’s avatar objects and associated operational analytics, deletes the Auth user, and relies on database relationships to remove associated active app records. It also clears this device’s app state and scheduled notifications on a best-effort basis. If a deletion step fails, the app may ask you to try again or contact support. Deletion from active systems does not mean immediate erasure from every backup; copies may remain until normal backup rotation expires, and providers may have separate lawful retention. Calendar events already created outside SYNTELO may remain until you remove them from the calendar.

Security

We use technical and organisational measures designed to protect information, including authenticated access and controls around app data and service credentials. No internet service or electronic system can be guaranteed completely secure. Please contact privacy@syntelo.co.uk if you have a privacy or security concern.

Sensitive information

SYNTELO does not intentionally require or solicit UK GDPR Article 9 special-category information, and its current features are not designed specifically to process it. Please do not deliberately include health information; racial or ethnic origin; political opinions; religious or philosophical beliefs; trade-union membership; genetic data; biometric data used to identify a person; or information about sex life or sexual orientation in items, images, documents or audio.

Free-text and upload features mean accidental submission is possible. If such information is supplied, it may pass through the same app and AI flows described above. Please avoid including more personal information about yourself or others than is needed.

If SYNTELO later intentionally supports processing special-category information, we will establish an appropriate lawful basis and Article 9 condition, put in place any required consent and safeguards, and update our disclosures before enabling that use. We do not claim an Article 9 condition for an intentional special-category feature at the current launch.

Children’s use

SYNTELO accounts and service use are intended for adults aged 18 and over wherever they live. SYNTELO is not directed at children. If you are under 18, you should not create or use an account. We do not knowingly seek to collect children’s personal information. If you believe a person under 18 has created an account, please contact privacy@syntelo.co.uk.

The planned launch app requires an active 18+ self-declaration before account creation. After signing in, users must confirm the current policies before normal app use; the server then records that confirmation with its own timestamp and the applicable Terms and Privacy versions. Self-declaration is not identity verification and cannot guarantee that a person under 18 will be unable to access the service.

Depending on where you live, additional child-specific privacy requirements may apply. We do not claim compliance with a particular non-UK children’s privacy regime without verification.

Your rights and complaints

Under UK data-protection law, depending on the circumstances, you may have the right to access your personal information, correct it, ask for its deletion, restrict its use, receive it in a portable form, or object to certain uses. Where we rely on consent, you can withdraw it at any time without affecting processing that was lawful before withdrawal. Depending on where you live, local law may give you additional rights or require further information or choices. Contact privacy@syntelo.co.uk to make a request; we may need to verify your identity and will assess it under applicable law.

You have an absolute right to object to the use of your personal information for direct marketing. You can also unsubscribe from early-access emails once they exist.

If UK data-protection law applies to our handling of your information, you can complain to the UK Information Commissioner’s Office (ICO). You do not have to contact us first. Visit the ICO complaint website. Depending on where you live, you may also have the right to complain to a local privacy or data-protection authority.

Changes to this notice

We will update the “Last updated” date when this notice changes. If a change materially affects how we use personal information, we will bring it to users’ attention where appropriate.