Privacy Policy
Last updated: November 6, 2026
This policy explains what personal data SYNTELOS ("the Service", at syntelos.app and in our Telegram bot and Mini App) collects, why, who receives it, and your choices.
1. Who is responsible
The controller of your personal data is Mohamad Hosein Mazinani, Yalniz Selvi Cd, Orta Mh, Kartal, Istanbul, Türkiye. Contact for all privacy questions: support@syntelos.app.
2. What we collect
Account data. Email address, display name, profile picture (if you sign in with Google), and a password hash if you sign up with email and password (we never see your password). If you sign in or link with Telegram: your Telegram user ID, name and username.
Workspace content. Workspaces, projects, tasks, comments, tags, statuses, team and member lists, invitations, and settings you create or that other members of your workspace create.
AI and bot data. Messages you send to the Copilot or the Telegram bot, the workspace data needed to answer them, and the replies. Voice messages you send are converted to text; we do not keep the audio file. Messages you forward to the bot for task extraction are processed to create tasks.
Technical data. Time zone and language preferences, basic server logs (such as IP address, request time and errors) that our hosting provider keeps for security and reliability, and cookies needed to keep you signed in.
Payment data. If you buy a plan, the payment is handled by Telegram (Stars) or by a payment provider acting as merchant of record. We receive the plan, status, period and a payment reference, not your card number.
We do not run advertising trackers and do not sell personal data.
3. Why we use it and our legal basis
- To provide the Service you asked for (contract): accounts, workspaces, tasks, notifications, briefings, AI answers.
- To keep the Service secure and prevent abuse (legitimate interest).
- To handle payments, taxes and legal obligations (legal obligation, contract).
- To contact you about the Service, support requests and important changes (contract, legitimate interest).
4. Who receives your data (processors)
We use these providers to run the Service. They process data on our behalf:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, authentication, realtime | Account data, workspace content |
| Vercel | Hosting and delivery of the web app | Technical data, requests |
| OpenRouter and the AI model providers behind it | AI Copilot and bot answers | Your AI messages and the workspace data needed to answer them |
| Groq | Voice-to-text, and AI answers in some configurations | Voice audio you send, or AI messages |
| Telegram | Bot, Mini App, notifications, Stars payments | Telegram ID, messages in the bot |
| Optional sign-in | Email, name, profile picture | |
| Payment provider (named at checkout) | Card payments as merchant of record | Payment details handled by the provider |
Some AI providers may keep prompts for a short time for abuse prevention or, for free models, may use them to improve their services under their own terms. Do not send confidential information that you are not allowed to share with these providers. We do not use your content to train our own models.
We may disclose data if the law requires it, or to protect our rights and the safety of users. If we are ever sold or merged, your data may move to the new owner under this policy.
5. International transfers
Our providers operate in several countries, including the United States and the European Union, and we are based in Türkiye. Your data may therefore be processed outside your country. We choose providers with standard contractual or equivalent protections where available.
6. How long we keep data
- Account and workspace data: while your account exists. You can delete your account yourself at any time in Settings → Danger zone; this takes effect immediately and removes or anonymizes it, except what we must keep for legal or accounting reasons. If you cannot use that option, email support@syntelos.app and we will do it within 30 days.
- Deleted workspaces: when an owner deletes a workspace it becomes inaccessible immediately and is kept for up to 30 days so the owner can restore it, then it is permanently erased.
- Backups: removed on the provider's normal cycle, normally within 90 days.
- Payment records: kept as long as tax and accounting law requires.
7. Your rights
Depending on where you live (for example under the GDPR or Türkiye's KVKK) you may have the right to access, correct, delete, export or restrict the use of your data, to object to some processing, and to withdraw consent. Email support@syntelos.app and we will answer within 30 days. You can also complain to your local data protection authority.
Workspace members can see content that other members add to the same workspace; workspace owners and admins control membership.
8. Security
We use access controls, row-level security in the database, encrypted connections and limited staff access. No system is perfectly secure; if a breach affects your data in a way the law requires us to report, we will tell you and the relevant authority.
9. Children
The Service is not for people under 16. If you think a child has given us data, tell us and we will delete it.
10. Cookies
We use only cookies and local storage that are needed to sign you in and remember basic preferences. We do not use advertising or analytics cookies today. If that changes we will update this policy and ask for consent where required.
11. Changes
We may update this policy. If a change is material we will tell you in the app or by email before it takes effect.
12. Contact
Mohamad Hosein Mazinani, Yalniz Selvi Cd, Orta Mh, Kartal, Istanbul, Türkiye. Email: support@syntelos.app.