Privacy policy
Last updated 20 October 2026.
This policy is about the people who use our website and who sign in to run events: the company that runs SympoSync (“we”) is responsible for what it describes. It is not about delegates in a session; that is covered at the end.
What we keep, and why
When you visit this website
Our host keeps ordinary request logs (the address your request came from, the page, the time and your browser’s name) to run and protect the service. We use no analytics, advertising or tracking scripts, and our fonts are served from our own pages, so your browser does not contact a font provider.
When you write to us
If you send a form (a demo request, a question, an application to the early-access programme, a request for the security pack) we keep what you typed: your name, work email, organisation and role, the event you mention and your message. We use it to reply to you and to understand what people need. We keep it for up to twelve months, and delete it earlier if you ask.
When you sign in to run events
You sign in with a link we send to your email address, so we keep that address, the roles you hold and when they were given. The activity log records what staff do to other people’s data, with the person’s email, kinds and counts only, never content. Team invitations hold the invited address until they are used or expire.
When you pay
Where card payment is switched on, card payments are handled by Stripe, which keeps your card details; we never see them. We keep the pass you bought, the amount, the dates, the Stripe references, and, if you ask for an invoice, the company name, billing address, VAT and purchase-order numbers you give us. We keep invoices as long as the law requires us to.
Records of use
We keep counts of what a pass is used for: how many phones joined a session and how many answered. They hold no personal data and tell us when a room is near or over what its pass covers.
On what basis
To provide the service you asked for (a contract); to keep it secure and to answer you (our legitimate interests); and to keep the records the law requires (a legal obligation). Where we ask for your consent, you can withdraw it at any time.
Who else handles it
Companies that help us run the service handle some of this on our behalf: our database and storage provider, the hosting platform, Stripe for payments and an email provider. They are listed, with what each does, on the sub-processors page. We do not sell personal data and we do not share it with advertisers.
How long
- Messages from the website’s forms: up to twelve months.
- The activity log: twenty-four months.
- A staff account: while it exists. A member of staff can be erased on request: their account, their sign-in and every copy of their email address, while what they did stays in the log without their address.
- Payment and invoice records: as long as tax and accounting law requires.
Your rights
You can ask us what we hold about you, to correct it, to delete it, to restrict or object to its use, and to receive it in a usable form. You can complain to your data protection authority. To use any of these, write to us through the contact page.
Cookies
We set only the cookies the service needs to work. See the cookies page.
Delegates
People who join a session on their phone are not covered by this policy. The organisation that runs the event decides how their data is used, and we process it for them. Every session’s phone page has a “Privacy and your data” link that says who is responsible, what is kept, for how long, and lets a delegate delete their own answers.
Changes
If we change this policy in a way that matters, we will say so on this page and, where we hold your email as a customer, write to you.