Privacy Policy

Synkra Technologies

Version 1.0 Effective 3 October 2026 Last updated 3 October 2026

This policy explains how Synkra Chat collects, processes, stores, and protects personal information. It is written for customers, their IT and legal teams, and anyone evaluating Synkra Chat for compliance purposes.

1. Hosting and Processing Locations

Synkra Chat uses a multi region architecture. Personal information is processed and stored in the following locations.

• Application servers: European Union, Germany. The Rails application, Sidekiq workers, and all primary processing.
• Primary database: South Africa. PostgreSQL, stored and backed up in South Africa.
• Redis cache: European Union, Germany. Ephemeral, no persistent personal information.
• File storage: South Africa, Cape Town and Johannesburg. All user uploads, attachments, avatars, and knowledge base documents.
• Backup storage: South Africa. Daily backup of the primary file storage bucket.
• Email inbound routing: European Union, AWS EU West 1, Ireland. Inbound email processing only.
• Email outbound delivery: United States or European Union, depending on the recipient location.
• Payment processing: Nigeria and South Africa. Card data and billing records.
• AI inference, primary: United States. AI inference when Token Harbor mode is active.
• AI inference, fallback: European Union, on the application server. Local AI model, no data leaves the server.

Summary of data residency.

• Application data and databases are processed on EU servers but stored and backed up in South Africa. They are never persistently stored in the EU.
• Uploaded files and file backups are hosted in South Africa.
• Inbound email routing passes through the European Union, Ireland, for processing only.
• Payment processing happens in Nigeria and South Africa.
• AI inference routes to the United States when using Token Harbor, with a European Union fallback via Ollama.

Because application data is processed in the European Union but stored in South Africa, transfers out of South Africa are governed by section 72 of POPIA. The European Union provides adequate protection through the General Data Protection Regulation. See Section 12 for full details.

2. Subprocessors

Synkra Chat engages the following subprocessors to operate the service. Every subprocessor is bound by a written agreement that includes data protection obligations at least equivalent to those in this policy.

• Contabo. VPS hosting and infrastructure. Processes all application data in transit and at rest on the server. Located in the European Union, Germany.
• Coolify. Deployment and orchestration. Processes application configuration and deployment metadata. Self hosted on the Contabo VPS.
• Z1 Storage. File and object storage. Processes uploaded files, attachments, avatars, and knowledge base documents. Located in South Africa.
• Paystack. Payment processing and subscription billing. Processes cardholder name, tokenised card details, billing address, transaction amounts, and payment references. Located in Nigeria and South Africa.
• Resend. Transactional and inbound email. Processes recipient name, email address, and email content. Located in the European Union, Ireland, for inbound, and in the United States or European Union for outbound.
• Token Harbor. AI inference, primary. Processes conversation text, prompts, and AI responses during inference. Located in the United States.
• Ollama. AI inference, fallback, self hosted. Processes conversation text, prompts, and AI responses during inference. Located in the European Union, on the application server.

Ollama runs on our own infrastructure and is not a third party subprocessor. It is listed for transparency because it processes the same data categories as Token Harbor.

Subprocessor changes. We notify account administrators by email at least 30 days before adding a new subprocessor or changing the location of an existing one. If you object to a change, you may cancel your subscription before the change takes effect.

3. AI Providers and Model Training

Synkra Chat uses AI features for Suggest Reply, Summarize, Rewrite, and knowledge base assistance.

AI features provide suggestions only. They do not send replies automatically. Every AI result is reviewed, edited, and sent by a team member.

Which AI providers we use.

• Token Harbor, primary. An OpenAI compatible gateway that routes requests to open models. Used when the account is on Token Harbor mode. Processes data in the United States.
• Ollama, fallback. A locally hosted open source model running on the same server as the application. Processes data in the European Union. No data leaves the server.

Whether customer content trains models. No. Customer content is never used to train AI models. This is true for both providers.

Token Harbor provides user controlled data retention and does not enforce a unified privacy policy on customer data. Training on customer data is disabled by default. Token Harbor own terms state that prompts and responses are not used to train their models for API customers.

Ollama runs locally on our infrastructure. No data leaves the server. There is no external model provider and no training pipeline.

What data is sent to AI providers. When you use an AI feature, the following data is sent to the AI provider for that request:

• The conversation history relevant to the request.
• Any knowledge base content the AI needs to reference.
• The prompt or action instruction.
• Business context such as the assistant configuration.

This data is used only to generate the response and is not retained for training.

What is never sent.

• Password or authentication credentials.
• Payment card details.
• Files not attached to the current conversation.
• Contact information of other accounts.

4. Data Retention Periods

POPIA requires that personal information is not kept longer than necessary for the purpose for which it was collected. Synkra Chat applies the following retention periods.

Active account data.

• Contacts: retained while the account is active.
• Conversations and messages: retained while the account is active.
• Uploaded files and attachments: retained while the account is active.
• Help center articles: retained while the account is active.
• Labels, teams, macros: retained while the account is active.
• AI operation logs: 90 days.
• Email notification logs: 30 days.

Free plan uploaded files. Files uploaded by Free plan accounts are retained while the account is active. When the account is deleted, files are deleted within 30 days.

Inactive Free accounts. If a Free plan account has no logins for 12 consecutive months, we send a warning email. If there is no response and no login within 30 days of the warning, the account and its data are deleted.

Support and operational data.

• Support tickets and correspondence: 3 years from closure.
• Billing records and invoices: 7 years, required by the Companies Act.
• Payment transaction records: 7 years, required by tax and financial law.
• Audit logs: 12 months.
• Discount eligibility documents: 3 years from the end of the verification period.

Website technical data.

• Server access logs: 90 days.
• Error and diagnostic logs: 30 days.
• Security event logs: 12 months.

Backup retention. Synkra Chat runs a daily backup of the primary file storage bucket in South Africa to a backup bucket in the same country. Backups are retained for 30 days. After 30 days, older backup versions are deleted automatically.

What happens when a retention period ends. When a retention period expires, the data is deleted, destroyed, or de identified as soon as reasonably possible and no later than 6 months after the retention period ends, as required by POPIA.

5. Account Closure, Export, and Deletion

Closing your account by cancellation. When you cancel your subscription, your account is not deleted. It is downgraded to the Free plan. Your data stays on the platform so you can continue to access it within Free plan limits.

Data retained after cancellation: contacts, conversations and messages, uploaded files, help center articles, and labels, teams, and macros. Free plan limits apply. If your data exceeds Free plan allowances, some features pause but nothing is deleted automatically.

Requesting full account deletion. If you want your account and data permanently deleted, email hello@synkra.co.za or use the deletion request form in Settings, then Account.

What is deleted:

• All contacts.
• All conversations and messages.
• All uploaded files.
• All help center articles.
• All labels, teams, macros, and settings.
• All user accounts associated with the organisation.

What is not deleted immediately:

• Billing records and invoices, retained for 7 years for legal compliance.
• Support correspondence, retained for 3 years.
• Aggregated anonymised statistics that cannot identify any individual.

Data export. You can export your data at any time. Options:

• Contacts: export as CSV from the contact list.
• Conversations: export individual conversations as transcripts.
• Help center articles: export as markdown.
• Full account export: request from Settings, then Privacy, then Export. The package is delivered within 5 business days as a signed download link that expires in 7 days.

Backup retention after deletion. When your account is deleted, we remove it from the primary database immediately. However, file backups in South Africa may retain the deleted data for up to 30 days. After 30 days, all backup copies are purged and cannot be recovered.

6. POPIA Legal Bases

Synkra Chat processes personal information under the Protection of Personal Information Act. We rely on the following legal bases.

Contractual necessity. Most processing happens because it is necessary to provide the service you have subscribed to. This covers creating and managing your account, delivering conversations, messages, and support features, processing payments, and sending service notifications and invoices.

Legitimate interest. We process certain information for legitimate business interests that do not override your rights. This covers preventing fraud and abuse, improving the reliability and security of the platform, understanding usage patterns to improve the product, and communicating about service updates.

Consent. We rely on consent for marketing emails, which you can opt out of at any time, and optional features such as AI assisted replies, which you enable per account.

Legal obligation. We process certain information because the law requires it. This covers retaining financial records for 7 years under the Companies Act, responding to lawful requests from regulators, and complying with tax law.

Vital interest. We may process information to protect someone life or safety in an emergency. This is rare and only applies in extraordinary circumstances.

7. Special Personal Information

POPIA defines certain categories of information as special personal information that requires extra protection. These categories are religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, and criminal behaviour.

POPIA prohibits the processing of special personal information unless one of the specific exemptions in sections 27 to 33 applies.

Faith based organisations. Synkra Chat is used by organisations across every sector, including faith based organisations and community groups. If your organisation processes information about members religious beliefs, you must ensure you have a lawful basis to do so.

POPIA provides an exemption in section 28 for spiritual or religious organisations, or independent sections of those organisations, that process information about the religious or philosophical beliefs of their members. This exemption applies only if the processing is necessary to achieve the organisation aims and principles, the information concerns data subjects who belong to the organisation, and the information is not supplied to third parties without consent.

This exemption applies to your organisation, not to Synkra Chat. If you are a faith based organisation using Synkra Chat to manage member data, you are the responsible party for that special personal information. Synkra Chat is the operator, processing on your documented instructions. You must ensure you have a lawful basis and that your use complies with section 28.

What Synkra does.

• We process whatever data you choose to store in your account, on your instructions.
• We do not use special personal information for our own purposes.
• We do not share special personal information with third parties beyond the subprocessors listed in Section 2.
• We apply additional safeguards in the form of encrypted storage, access controls, and audit logging.

What you must do.

• Obtain explicit consent from members where required.
• Ensure your use of the data complies with section 28.
• Document your lawful basis for processing special personal information.
• Provide us with written instructions for any special personal information you ask us to process on your behalf.

Other special personal information. If your organisation processes other special personal information through Synkra Chat, for example health information in a healthcare context, you must ensure you have a lawful basis under the applicable section of POPIA, sections 26 to 33. Synkra processes this data as your operator.

8. Data Processing Addendum and Operator Terms

Our role. Under POPIA, when you use Synkra Chat to process personal information about your customers, contacts, or members, you are the responsible party for that information, and Synkra Chat is the operator. This means we process personal information only on your documented instructions and only for the purpose of providing the service.

Our obligations as operator. Under sections 20 and 21 of POPIA, we commit to:

1. Processing personal information only on your documented instructions.
2. Implementing appropriate security safeguards under section 19.
3. Not engaging a sub operator without your prior authorisation.
4. Assisting you in responding to data subject access requests.
5. Notifying you immediately if we become aware of a security compromise.
6. Deleting or returning personal information when the contract ends.
7. Maintaining records of our processing activities.

Our obligations as responsible party. For our own account data, including your account information, billing details, and usage logs, we are the responsible party. We handle this data in accordance with this policy and POPIA.

Data Processing Addendum. We offer a Data Processing Addendum that formalises these obligations. To request one, email hello@synkra.co.za. The addendum sets out the scope and purpose of processing, confirms the security safeguards in place, lists the subprocessors in Section 2, addresses cross border transfers in Section 12, provides for audit rights and compliance reporting, and sets out the process for handling data subject requests. For customers who need a signed addendum before subscribing, contact us and we will provide one.

9. Encryption and Security

POPIA section 19 requires responsible parties to take appropriate and reasonable technical and organisational measures to protect personal information. Synkra Chat implements the following.

Encryption in transit. All data transmitted between your browser and Synkra Chat is encrypted using TLS 1.2 or higher. This covers login and authentication, all API requests and responses, WebSocket connections for real time updates, and email delivery to customers.

Encryption at rest. Data at rest is encrypted using AES 256. This covers the primary PostgreSQL database, uploaded files and attachments stored in Z1 Storage, backup files stored in the backup Z1 bucket, and Redis cache contents.

Password and credential handling.

• User passwords are hashed using bcrypt. We never store passwords in plain text.
• API tokens are stored hashed and cannot be retrieved after creation.
• Payment card details are tokenised by Paystack. Synkra never sees or stores raw card numbers.

Multi factor authentication. Two factor authentication is available and optional for all users. It supports app based one time password through Google Authenticator, Authy, 1Password, and similar, and SMS one time password. We encourage administrators and anyone with billing access to enable it.

Network security.

• Firewalls restrict access to the VPS.
• SSH access to the server requires key based authentication, not passwords.
• Only necessary ports are exposed to the internet.
• Regular security patches are applied to the operating system and dependencies.

Endpoint security. Staff and contractors who have access to systems processing personal information use full disk encryption on their devices, strong passwords and multi factor authentication, and secure, updated operating systems and browsers.

Security certifications. Synkra Chat is not currently SOC 2 or ISO 27001 certified. Subprocessors maintain their own certifications where applicable. We will pursue formal certification as customer demand requires it.

10. Internal Access Controls

Who has access. Access to production systems and personal information is limited to Synkra engineers who require access for operational purposes, and the account owner and administrators of each account.

The principle of least privilege.

• Every engineer has the minimum access required for their role.
• Production database access is restricted and logged.
• No engineer has standing access to full production data. Access is granted for specific tasks and revoked afterward.
• Access is reviewed regularly.

Account level access. Within your own Synkra account, administrators can see all conversations, contacts, and settings. Agents can see conversations assigned to them or shared with their team. You control who is an administrator and who is an agent.

Audit logging.

• All administrative actions on production systems are logged.
• All authentication events are logged.
• Access to the production database is logged.
• Audit logs are retained for 12 months.
• Audit logs are not visible to account users by default but can be requested.

Background checks. Engineers and contractors with production access undergo reference checks. This is proportionate to the sensitivity of the data they can access.

11. Incident Response

POPIA section 22 requires that we notify the Information Regulator and affected data subjects if there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

What counts as a security compromise. A security compromise includes unauthorised access to personal information, loss of personal information such as through a stolen device, unauthorised destruction or alteration of personal information, ransomware or malware attacks affecting personal information, and accidental disclosure of personal information to the wrong party.

Our response process.

1. Detect and contain. We monitor for security events and take immediate action to contain any compromise.
2. Assess. We determine the nature and scope of the compromise, which data is affected, and the likely consequences.
3. Notify. If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we notify the Information Regulator via their eServices portal as soon as reasonably possible, and affected account administrators by email as soon as reasonably possible.
4. Remediate. We fix the underlying issue, apply additional safeguards as needed, and document the incident.

What we tell you. When we notify you of a breach affecting your account data, we include a description of the possible consequences of the breach, a description of the measures we have taken or will take to address it, any recommendations for measures you can take to mitigate harm, and if known, the identity of the unauthorised person or the source of the breach.

Timing. We aim to notify affected account administrators within 72 hours of confirming a breach, and the Information Regulator within the same window.

Customer responsibilities. If you discover a security issue affecting your Synkra account:

1. Email hello@synkra.co.za immediately.
2. Do not attempt to investigate on your own.
3. Preserve any evidence you have.
4. We will work with you to contain and remediate the issue.

Post incident. After every incident, we produce an internal report covering what happened, why, what was affected, and what we changed to prevent recurrence. We share relevant findings with affected customers.

12. Cross Border Data Transfers

Because application data is processed in the European Union and stored in South Africa, and some subprocessors operate outside South Africa, transfers of personal information outside South Africa are governed by section 72 of POPIA.

Which transfers happen.

• Application processing: European Union, Germany. All account data, conversations, contacts, and settings during processing.
• Application storage and backup: South Africa. All account data, conversations, contacts, and settings at rest.
• Inbound email routing: European Union, Ireland. Inbound customer emails during processing.
• Outbound email delivery: United States or European Union. Outbound notification emails and replies.
• Payment processing: Nigeria and South Africa. Cardholder name, billing details, and transaction amounts.
• AI inference, primary: United States. Conversation text, prompts, and AI responses.

What safeguards apply. For all cross border transfers, we rely on one or more of the following POPIA section 72 conditions:

1. Consent. Where required, we obtain your consent for the specific transfer.
2. Contractual necessity. The transfer is necessary for the performance of a contract between you and us.
3. Adequate protection. The recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection substantially similar to POPIA.
4. Vendor safeguards. Our subprocessors are bound by Data Processing Agreements that include standard contractual clauses and equivalent protections.

Adequacy of the European Union. The European Union General Data Protection Regulation provides protection substantially similar to POPIA. Processing in the European Union is subject to section 72(1)(a) of POPIA as providing an adequate level of protection.

Your rights regarding cross border transfers. You have the right to know which of your personal information is transferred outside South Africa, object to a specific transfer, and request details of the safeguards in place. If you object to a cross border transfer that is essential to the service, we may not be able to continue providing that part of the service. Because application data is processed in the European Union, full objection to cross border transfer would prevent use of the service.

13. Your Rights

Under POPIA, you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate personal information.
• Delete personal information we no longer have a lawful basis to retain.
• Object to processing based on legitimate interest.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Information Regulator.
• Not be subject to automated decision making that produces legal or substantial effects without human oversight.

How to exercise your rights. Email hello@synkra.co.za with your request. We respond within 30 days. We may need to verify your identity before processing the request.

Complaints. If you are not satisfied with our response, you can lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: complaints.IR@justice.gov.za

14. Contact

For questions about this policy, data protection, or security:

• Email: hello@synkra.co.za
• Information Officer: Refilwe Molapisi
• Response time: we respond within 2 business days for general enquiries. Security incidents are handled with urgency.
• Business hours: Monday to Friday, 08:00 to 17:00 South African Standard Time.

For urgent security matters, mark your email as urgent. We aim to respond within 4 hours during business hours.