Privacy Policy

PYRX Technologies operates Synapse, an event-driven customer communications platform that provides email automation, template management, audience segmentation, and analytics for businesses. Our platform serves both direct users (you) and enables you to communicate with your own end users through the Service.

This Privacy Policy applies to all information collected through:

• The Synapse marketing site at crm.pyrx.tech
• The Synapse dashboard at synapse-app.pyrx.tech
• The Synapse API at synapse-api.pyrx.tech
• The Synapse event ingestion endpoint at synapse-events.pyrx.tech
• All Synapse SDKs and developer tools
• Email communications from Synapse

As Data Controller

We act as a data controller for information we collect directly from you — your account information, usage data, billing information, and support communications. We determine the purposes and means of processing this data.

As Data Processor

We act as a data processor for the personal data of your end users that you submit to Synapse through the API, SDK, or dashboard (e.g., your contacts' email addresses, event data, segmentation attributes). You are the data controller for this data, and we process it solely on your instructions to provide the Service.

4.1 Information We Collect as Controller

Account Information

When you create an account, we receive your name, email address, and organization name through our authentication service. We also store your workspace memberships, roles, and preferences.

Billing Information

We do not collect or store credit card numbers or payment method details. All payment processing is handled by Lemon Squeezy, our Merchant of Record. We receive subscription status, plan details, customer ID, and billing period information from Lemon Squeezy via webhooks.

Usage Data

We collect information about how you interact with the Service, including pages visited in the dashboard, features used, API calls made (method, endpoint, response code), and timestamps. This data helps us improve the product, diagnose technical issues, and enforce rate limits.

Support Communications

When you contact us for support, we collect the content of your communications and any attachments you provide.

API Key Metadata

We store metadata about your API keys (name, scope, creation date, last used). The key value itself is bcrypt-hashed and cannot be retrieved after creation.

4.2 Information We Process as Processor

Contacts

Contact records you create or import, including email addresses, names, and any custom properties you define.

Events

Event data you send to the event ingestion endpoint, including event name, properties, and associated contact identifiers.

Email Interactions

Email delivery status, open events, click events, bounce notifications, and unsubscribe requests for emails sent through the Service.

Segments

Segment definitions and audience membership data derived from contact properties and event data.

Server Logs

Our servers automatically log request metadata including IP address, user agent, referrer, request path, and response code for security monitoring and debugging.

Device Information

We collect browser type, operating system, screen resolution, and language preference to optimize the dashboard experience.

IP and Geolocation

We use IP-based geolocation (via Cloudflare CF-IPCountry header) to determine your country for geo-pricing purposes. We do not perform precise geolocation tracking.

Cookies and Local Storage

We use essential cookies and local storage for authentication and preferences. See our Cookie Policy for details.

We use the information we collect to:

• Provide, operate, and maintain the Service, including email delivery, flow execution, and analytics
• Manage your account, workspace memberships, and access permissions
• Process billing transactions through Lemon Squeezy and enforce plan limits
• Monitor for security threats, detect fraud, and prevent abuse
• Analyze usage patterns to improve the Service and develop new features
• Send transactional communications (account verification, service notifications, billing alerts)
• Comply with legal obligations, respond to legal process, and protect our rights

We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or Customer Data to third parties for their marketing purposes.

Sub-Processors

We share data with our sub-processors solely as necessary to provide the Service. See Section 8 for the complete list.

Legal Requirements

We may disclose information when required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such transfer and any changes to this Privacy Policy.

Aggregated Data

We may share aggregated, anonymized, and de-identified data that cannot reasonably identify you for industry analysis, benchmarking, and product improvement.

We use the following sub-processors to operate the Service:

We will notify existing customers at least 30 days before adding a new sub-processor.

Our infrastructure is hosted on Google Cloud Platform in the United States. Your data may be transferred to and processed in the United States and other countries where our sub-processors operate.

For transfers of personal data from the European Economic Area (EEA) or United Kingdom to countries that do not have an adequate level of data protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent transfer mechanisms.

We implement industry-standard security measures to protect your data:

• Encryption in transit — all data transmitted between you and the Service is encrypted using TLS 1.2+
• Encryption at rest — all data stored in our databases and storage systems is encrypted at rest
• Tenant isolation — PostgreSQL Row-Level Security (RLS) policies enforce strict data isolation between workspaces at the database level
• API key security — API keys are bcrypt-hashed before storage; the plaintext key is shown once at creation and cannot be retrieved
• JWT authentication — dashboard sessions use RS256-signed JWTs verified via JWKS endpoint with 6-hour key cache
• Role-based access control — 6 distinct roles (owner, admin, developer, marketing, operations, viewer) with granular permission enforcement
• Audit logging — security-sensitive actions are recorded with tenant, user, and timestamp context

For more information, see our Security page.

We retain data according to the following schedule:

When you delete your account, we remove your data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., billing records).

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Portability — receive your data in a structured, commonly used, machine-readable format
• Restriction — request that we limit processing of your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Legal Bases for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the Service you requested
• Legitimate interests — processing for security monitoring, fraud prevention, and service improvement
• Legal obligations — processing required by applicable law
• Consent — where we rely on your consent, you may withdraw it at any time

Data Protection Officer

For data protection inquiries, contact our DPO at [email protected].

Data Processing Addendum

A GDPR-compliant Data Processing Addendum (DPA) is available upon request for customers who need one.

Your GDPR Rights

In addition to the general rights listed in Section 12, EU/EEA residents have rights under GDPR Articles 15-22, including the right not to be subject to solely automated decision-making. We do not make automated decisions with legal effects about you.

Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal data violates applicable law.

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have additional rights:

• Right to Know — you may request disclosure of the categories and specific pieces of personal information we collect, use, and disclose
• Right to Delete — you may request deletion of your personal information, subject to legal exceptions
• Right to Correct — you may request correction of inaccurate personal information
• Right to Opt-Out — we do not sell your personal information. We do not share your personal information for cross-context behavioral advertising
• Non-Discrimination — we will not discriminate against you for exercising your CCPA/CPRA rights

To exercise these rights, contact us at [email protected].

If you are a resident of the United Kingdom, your personal data is protected under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You have the same rights as described in Section 13 for EU/EEA residents.

If you are unsatisfied with our response to a privacy concern, you have the right to file a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

The Service is not directed at individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, contact us at [email protected] and we will promptly delete the information.

The Service may contain links to third-party websites and services that are not operated by us. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any third-party services you access through our platform.

For detailed information about the cookies and local storage we use, please see our Cookie Policy.

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice by email to the address associated with your account and by updating the "Last updated" date at the top of this page. Your continued use of the Service after the effective date of the revised policy constitutes acceptance. We encourage you to review this page periodically.

If you have questions about this Privacy Policy or our data practices, contact us at:

• Privacy inquiries: [email protected]
• Security matters: [email protected]