Privacy Policy

This Privacy Policy describes our policies and procedures on the collection, use and disclosure of your information when you use the Service and explains your privacy rights and how the law protects you. We use your Personal Data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

Words with initial capital letters have meanings defined under the following conditions. The following definitions shall have the same meaning whether they appear in singular or plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for you to access our Service or parts of our Service.
• Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• Company (referred to as either "the Company", "we", "us" or "our") refers to SoftSync AI Inc. 1007 N Orange St 4th Floor, Ste 1382, Wilmington Delaware DE 19801 which operates the SoftSync service.
• Cookies are small files that are placed on your device by a website, containing details of your browsing history among its uses.
• Country refers to: Norway.
• Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Website and the associated web application.
• Service Provider means any natural or legal person who processes the data on behalf of the Company.
• Third-party Integration refers to any external service you connect to the Service (e.g., Google, Microsoft 365/Outlook) to enable features such as contact, calendar, or email synchronization.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

Website refers to SoftSync, accessible from https://softsync.ai.

• You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

While using our Service, we may ask you to provide certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

• Email address
• First and last name
• Phone number
• Address, State/Province, ZIP/Postal code, City
• Workspace and team information

Usage Data is collected automatically when using the Service (e.g., IP address, browser type, pages visited, time and date of visit, time spent on pages, device identifiers).

Cookies on this website fall into the categories below. Only the necessary ones are set when you arrive. Analytics and marketing cookies are set only after you accept them in the cookie banner, and you can change or withdraw that choice at any time using the "Cookies" link in the footer. Declining does not limit your use of the website in any way.

• Necessary / Essential Cookies – for authentication, security, and core functionality of the app.
• Functionality Cookies – to remember preferences (e.g., language, time zone).
• Analytics Cookies – set only with your consent, to measure how the website is used (pages viewed, referrer, approximate location, device type) so that we can improve it.
• Marketing / Advertising Cookies – set only with your consent, to measure advertising performance and to show you SoftSync adverts on Google, Facebook and Instagram after you have visited this website ("retargeting").

This website is hosted on Cloudflare. If you accept analytics and marketing cookies, we load Google Tag Manager, Google Analytics 4 and the Meta pixel in order to measure traffic and advertising performance. If you decline, none of them is loaded at all and no request is sent to Google or to Meta. Consent is denied by default, using Google Consent Mode, until you make a choice.

Our legal basis for analytics and marketing cookies is your consent (GDPR Article 6(1)(a)), together with the consent requirement of the Norwegian Electronic Communications Act (ekomloven). Necessary cookies rely on our legitimate interest in operating a secure and functioning website. You may withdraw consent at any time through the "Cookies" link in the footer. Withdrawing stops all further collection and expires the analytics and advertising cookies we can reach from your browser; data already collected remains subject to the retention periods of the providers listed below.

Google and Meta are established in the United States and may process data relating to your visit outside the EEA. Those transfers rely on the European Commission's standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework. Their own policies are available at policies.google.com/privacy and facebook.com/privacy/policy.

You may connect Third-party Integrations such as Google or Microsoft 365/Outlook. If you connect Gmail or Outlook, we create a profile for each contact in your account(s). You can then choose whether to enrich specific contacts (opt-in; never automatic). The data elements imported depend on the provider and your permissions, and typically include identifiers such as name, email, phone, organization, and profile photo. Features that rely on message content (if any) are clearly disclosed and require additional consent.

Google User Data

When you connect your Google Account to the Service, we request only the minimum scopes necessary for the features you choose. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Scopes We Request and Why

• https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile – authenticate you and display account details.
• https://www.googleapis.com/auth/contacts.readonly – read Google Contacts to create/update profiles in your SoftSync workspace.
• https://www.googleapis.com/auth/gmail.metadata (or gmail.readonly if required by a feature) – read Gmail headers/labels to show interactions on contact timelines. We do not store email bodies by default.
• https://www.googleapis.com/auth/gmail.send – send emails you initiate from the Service via your Gmail account.
• https://www.googleapis.com/auth/calendar.readonly – read Calendar events to display meetings alongside contacts.

Limited Use commitments

• We use Google user data only to provide or improve user-facing features in SoftSync.
• We do not use Google data for advertising or to build advertising profiles.
• We do not sell Google user data.
• We do not allow human access to Google user data except (a) with your explicit consent; (b) for security/abuse investigations; or (c) to comply with applicable law.
• We do not use Google user data to train generalized AI/ML models.

Enrichment of Google-sourced contacts (opt-in)

Enrichment applies only when you choose it for specific contacts (individually or in bulk). When you run enrichment on Google-sourced contacts, we share only the minimum identifiers (e.g., name, email, company) with our enrichment processors, solely to return attributes into your workspace. Providers act on our instructions; they may not use your data for their own purposes. If you do not run enrichment, no Google-sourced data is sent to enrichment providers.

Storage, Security, and Retention of Google Data

• OAuth tokens are stored encrypted and rotated; we revoke within 24 hours of disconnect.
• Contacts (Google-sourced fields you choose to sync) are stored to power your workspace; cache refreshed; deletions propagate within 24 hours.
• Gmail headers/IDs/labels (no bodies by default): retained up to 7 days for timeline rendering and troubleshooting.
• Calendar event IDs/timestamps: retained up to 30 days for timeline rendering.
• After you disconnect Google or delete your Account, Google-derived data we persist is deleted from active systems within 7 days (unless longer retention is required by law or to defend legal claims). Backups purge within 7 days; security logs within 14 days.

Revoking Access

You can revoke the Service's access to your Google Account at any time at myaccount.google.com/permissions. You may also disconnect Google from within the Service under Settings → Integrations. Revoking access may limit functionality that relies on Google data.

Microsoft User Data (Outlook/Office 365)

If you connect Microsoft 365/Outlook, we request substantially equivalent scopes (e.g., Contacts.Read, Mail.ReadBasic/Mail.Read, Mail.Send, Calendars.Read) to create contact profiles, show interactions on timelines, send emails you initiate, and display events. We apply the same use, sharing, security, and retention principles described for Google data.

Enrichment (opt-in): as with Google, enrichment runs only when you choose it for specific contacts; we share minimum identifiers with processors to return attributes.

Use of Your Personal Data

• To provide and maintain our Service, including to sync contacts and (if you choose) related interactions from connected integrations and to deliver features you request.
• To manage your Account as a user of the Service.
• To perform a contract for requested services.
• To contact you regarding updates or security notices.
• To provide you with product updates and newsletters (you can opt out at any time).
• To manage your requests (support).
• For business transfers as permitted by law.
• For other purposes such as analytics and improving the Service.

Sharing of Your Personal Data

• With Service Providers who process data on our behalf (hosting, auth, email, payments, analytics, support, bug tracking, enrichment, if you enable it).
• With Affiliates, subject to this Privacy Policy.
• With business partners (non-Google/Microsoft data only) to offer services, where permitted and with your consent where required. Data obtained via Google APIs or Microsoft Graph is not used for advertising and is not shared with business partners except as permitted (Service Providers acting on our behalf, legal compliance, or with your direction/consent).
• With other users in your workspace, per your workspace settings.
• With your consent or as otherwise required by law.

Security

We use administrative, technical, and physical safeguards appropriate to the data's sensitivity, including encryption in transit and at rest, least-privilege access controls, logging and monitoring, and vulnerability management. Production access is restricted and reviewed. Primary processing region: EU (Stockholm).

Retention of Your Personal Data

We retain Personal Data only as long as necessary to provide the Service and for legitimate business or legal purposes. Unless stated otherwise in this Policy:

• Contact sync cache: 30 days (rolling).
• Gmail/Outlook headers, message/thread IDs, and labels (no bodies by default): 7 days.
• Calendar event IDs/timestamps: 30 days.
• OAuth tokens: encrypted, rotated; revoked within 24 hours on disconnect.
• Backups purge within 7 days; security logs within 14 days.

Transfer of Your Personal Data

Your information may be processed in countries other than where you reside. Our primary processing region is the EU (Stockholm). Where required, we rely on appropriate safeguards for international transfers (such as Standard Contractual Clauses) and implement technical and organizational measures to protect your Personal Data.

Delete Your Personal Data

You may delete certain information from within the Service, disconnect integrations, or request deletion of your Account by contacting us or using in-product controls. We may retain certain information where required by law or for legitimate business purposes (e.g., fraud prevention, security, or legal claims). After account deletion, Personal Data is removed from active systems within 7 days and from backups within 7 days thereafter.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement and legal requirements

The Company may disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency) or to protect rights, safety, and security.

Children's Privacy

Our Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us and we will remove such information as required by law.

Sub-processors

We use carefully selected Service Providers ("sub-processors") to help deliver the Service. We enter into data processing agreements with them and require appropriate security and confidentiality commitments. You can contact us for the current list and to subscribe to updates.

Core sub-processors

Core sub-processors

The CRM data is stored and processed in the EU (Azure, in Stockholm). The website content is delivered through a global edge network (Cloudflare) that caches and routes requests close to visitors but does not hold your data.

Optional enrichment sub-processors (used only if you enable enrichment)

These providers are engaged to enrich contact records you choose to enrich. They do not receive data unless you initiate enrichment for a contact.

Optional sub-processors

Optional sub-processors (enrichment, opt-in)

Website analytics and advertising (only with your consent)

User-connected integrations (optional; not our sub-processors)

You may connect third-party integrations such as Google Workspace and Microsoft 365/Outlook to sync contacts (and, if you choose, interactions). These providers act as independent services you choose to connect; you can disconnect at any time in Settings → Integrations. See "Google User Data" and "Microsoft User Data."

International Data Transfers

Personal Data collected within the European Economic Area (EEA) and the United Kingdom may be transferred to, and stored in, countries that may have different data protection laws. Where we transfer Personal Data outside the EEA/UK, we implement appropriate safeguards such as Standard Contractual Clauses.

Data Retention and Deletion

You may request that your Account be closed at any time. Following account deletion, Personal Data is removed from active systems within 7 days and from backups within 7 days. Log data is retained for 14 days for security and auditing, after which it is deleted or anonymized, unless we are legally required to retain data longer.

Communication

We may send you emails to inform you of Service changes or to communicate technical or administrative information. You may opt out of marketing emails by using the unsubscribe link in those emails. We may still send you transactional or administrative messages related to the Service even after you have opted out of marketing.

Links to Other Websites

Our Service may contain links to websites that are not operated by us. We strongly advise you to review the privacy policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you by posting the new Privacy Policy on this page and updating the "Last updated" date. Where required by law, we will notify you via email or through the Service prior to the change becoming effective.

Contact Us

If you have any questions about this Privacy Policy, you can contact us:

By email: contact@softsync.ai

For privacy-specific inquiries, contact us at privacy@softsync.ai.