Privacy Policy

This Privacy Policy (“Policy”) describes how DataSynca, the operator of datasynca.com, www.datasynca.com, related marketing pages, license-administration systems, and the DataSynca software and services (together, “DataSynca”, “we”, “us”, or “our”), collects, uses, stores, discloses, and otherwise processes personal data.

For questions about this Policy or our processing of personal data, contact us at [email protected]. That address is the designated contact for privacy, data-protection, and rights requests.

Nothing in this Policy grants any licence, waiver, or right in our software, trademarks, documentation, or other intellectual property. All such rights remain reserved as stated in our Terms of Service.

This Policy covers: (a) the public marketing website and contact channels; (b) cookie and similar-technology choices on that website; (c) licence issuance, activation, renewal, and enforcement (including communications from a licensed DataSynca installation to our licence service); (d) Google Workspace API access that users authorise inside a DataSynca installation (see Section 9); and (e) related sales, support, and security processing.

DataSynca is typically supplied as a dedicated or self-hosted deployment. Business data that a customer processes inside its own DataSynca environment remains under that customer’s control and is not, by default, hosted by us as a public multi-tenant service. For that environment, the customer (or its organisation) is the data controller (or equivalent under applicable law). We process such environment data only if the customer grants access for support, hosting we have expressly contracted to provide, or as otherwise required by law or a signed agreement.

If a signed order, licence, or data-processing agreement applies to a paying customer, that contract governs to the extent of any conflict with this Policy for that commercial relationship. This Policy still applies to the public website and to licence-control processing we perform as an independent controller, unless the signed contract expressly states otherwise.

This Policy is issued solely in English. English is the only official and governing language. Any translation, summary, oral explanation, or machine-generated version is for convenience only and has no legal effect. If you do not understand English, do not submit personal data until you have obtained independent advice.

We collect only what we need to operate the website, respond to enquiries, sell and support the product, enforce licences, and protect our rights. Depending on how you interact with us, this may include:

• Identity and contact data: name, job-related details you choose to provide, company or organisation name, work email address, telephone number.
• Enquiry content: the message and any attachments or facts you send via the contact form, email, or other channel.
• Technical and security data: IP address, approximate location derived from IP, browser and device type, user-agent, requested URLs, timestamps, referring URL, and diagnostic logs.
• Preference data: your cookie or similar-technology choice stored in the browser (currently in local storage under a DataSynca-specific key).
• Licence and installation data: licensed domain or public URL, instance identifiers, activation and refresh events, last-request time, licence status, and optional operator-entered CRM fields (company, contact name, email, phone) associated with a licence record.
• Commercial data: quotes, orders, invoices, payment references, and correspondence relating to a sale or support case.
• Communications metadata: dates, times, and records of emails, calls, or meetings you have with us.

We do not require you to create a public self-service account on the marketing website. We do not knowingly collect special-category data (such as health, biometric, or criminal-offence data) through the marketing site. Do not submit such data to us unless we have expressly requested it in writing for a defined purpose.

• Directly from you: contact form, email, phone, meetings, demos, and documents you send.
• Automatically: server, reverse-proxy, and application logs; security and rate-limiting controls; essential storage needed to run the site and remember cookie choices.
• From licensed software: licence activation, refresh, and related phone-home or heartbeat requests sent by a DataSynca installation to our licence endpoints, as required to validate and enforce the licence.
• From our personnel or partners acting on our instructions: sales notes, support tickets, and processors listed in Section 9.
• From publicly available business sources, where lawful, to confirm company details in a B2B sales context.

We process personal data for the following purposes. Where the EU or UK GDPR applies, the corresponding Article 6 bases are indicated. Where Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) applies, we rely on the corresponding KVKK Article 5/6 conditions (including explicit consent where required, performance of a contract, legal obligation, and our legitimate interests provided they do not override your fundamental rights).

• Responding to enquiries, providing demos, and conducting B2B sales conversations — contract steps or legitimate interests in operating a B2B business; consent where we ask for it (for example a form acknowledgement).
• Operating, securing, and improving the website, including fraud, spam, and abuse prevention and rate limiting — legitimate interests and, where required, legal obligation.
• Remembering cookie and similar-technology choices — legitimate interests for essential storage; consent for any optional analytics or marketing technologies.
• Issuing, activating, renewing, suspending, revoking, and enforcing software licences — contract performance and legitimate interests in protecting intellectual property and revenue.
• Invoicing, accounting, tax, and record-keeping — legal obligation and contract.
• Establishing, exercising, or defending legal claims, and enforcing our Terms of Service — legitimate interests and legal obligation.
• Sending service or transactional messages related to a request or licence you already have with us — contract or legitimate interests. We do not send unsolicited marketing emails unless permitted by applicable law, and you may object as described below.

If we ask for consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Withdrawal does not require us to continue providing a service that depends on the data, and does not affect processing we may continue on another lawful basis (for example legal claims or licence enforcement).

We use essential cookies and similar technologies (including local storage) to operate the website, provide security, and remember your privacy choice. These are necessary for the site to function as requested.

Optional analytics or similar measurement technologies, if used, are activated only after you accept via the consent bar. If you reject, we do not enable those optional technologies. You may change your choice at any time using “Cookie preferences” in the footer. As of the date of this Policy, the consent preference itself is stored locally in your browser; we do not treat that preference as a marketing profile.

You may also restrict cookies in your browser. Blocking essential technologies may prevent the site from working correctly. Browser settings do not by themselves cancel a licence, a contract, or our right to process data collected through other channels.

Licensed DataSynca installations may contact our licence service to activate, refresh, and prove that the installation remains entitled to run. That contact may include technical identifiers and the licensed public URL or domain. It is not used to harvest the contents of the customer’s business flows, databases, or files from inside the dedicated environment.

We may retain licence records, including optional contact fields entered by our operators, for the life of the commercial relationship and thereafter as needed to prove licence history, prevent abuse, and defend our rights. Revocation, expiry, or non-renewal of a licence does not create a right to immediate erasure of records we must keep for those purposes.

DataSynca may allow users of a licensed DataSynca installation to connect their own Google accounts (for example Gmail, Google Drive, Google Docs, or Google Sheets) through Google’s OAuth consent flow, so that user-configured automation workflows can access Google Workspace data the user authorises. Those connections are established by the customer or end user inside their DataSynca environment. Google account credentials and tokens remain under that environment’s control; we do not use Google Workspace user data from customer environments to operate the public marketing website.

Limited Use compliance statement: The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

In particular, with respect to Google user data obtained via Google APIs (including Gmail, Drive, Docs, and Sheets):

• We use Google user data only to provide or improve user-facing features that are prominent in DataSynca’s interface and that the user explicitly configures (for example reading or writing a spreadsheet row, creating or updating a Doc, listing or moving a Drive file, or sending an email as part of a workflow the user built).
• We do not sell Google user data.
• We do not use Google user data for serving advertisements, including retargeting, personalised, or interest-based advertising.
• We do not allow humans to read Google user data unless: (a) we have the user’s affirmative agreement for specific messages; (b) it is necessary for security purposes such as investigating abuse; (c) it is necessary to comply with applicable law; or (d) the use is limited to internal operations and the data (including derivations) have been aggregated and anonymised.
• We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features visible in DataSynca, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users where required.
• We do not use, transfer, or sell Google user data—including raw, aggregated, anonymised, or derived data—to create, train, fine-tune, or improve a foundational, generalised, or non-user-facing machine learning or artificial intelligence model. If a customer connects a third-party AI provider inside their own DataSynca environment, that use is controlled by the customer and that provider’s terms; it is not DataSynca using Google Workspace API data to train our own or a generalised model.

Google’s policies apply in addition to this Policy. See the Google API Services User Data Policy (including Limited Use) at https://developers.google.com/terms/api-services-user-data-policy. Our OAuth application’s authorised scopes are limited to those required for the Google integrations offered in DataSynca (for example Drive, Docs, Sheets, and Gmail scopes the user grants). Users can revoke access at any time in their Google Account permissions.

For dedicated or self-hosted deployments, the customer organisation is the controller of Google Workspace data processed inside its environment. DataSynca processes such data only if the customer grants access for contracted support or hosting, or as otherwise required by law or a signed agreement, and still subject to the Limited Use restrictions above when Google API data is involved.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We disclose personal data only as follows:

• Service providers acting on our instructions (for example hosting, email delivery, security, and the internal workflow that receives contact-form leads). They may process data only for our documented purposes.
• Professional advisers (legal, accounting, insurance) under confidentiality duties, where needed to protect or exercise our rights.
• A buyer or successor in a merger, acquisition, financing, or sale of assets, subject to this Policy or equivalent protection, and without any waiver of our intellectual-property rights.
• Public authorities, courts, or other parties when we believe in good faith that disclosure is required by law, necessary to protect our rights, users, or the public, or necessary to detect, prevent, or address fraud, security, or technical issues.
• Other persons you ask us to involve (for example a colleague you copy on an email).

We remain responsible for selecting processors with appropriate security and for imposing contractual limits. Listing a category of recipient does not grant that recipient any licence to our software or brand. Sharing of Google user data, if any, remains subject to Section 9 (Google Workspace APIs and Limited Use).

We and our processors may process personal data in Türkiye and in other countries. Where a transfer from the EEA, UK, or another region with transfer rules is required, we use an approved mechanism (such as an adequacy decision or standard contractual clauses) or another lawful ground. By submitting data through the website or a licence process, you understand that your data may be processed in jurisdictions whose laws differ from those of your country, always subject to this Policy and applicable transfer rules.

We keep personal data only as long as needed for the purposes in this Policy, including:

• Enquiry and sales records: for the sales cycle and a subsequent period sufficient to handle follow-up and legal claims (typically up to several years, longer if a dispute is pending).
• Licence, billing, and tax records: for the statutory retention period and the life of the licence relationship, whichever is longer.
• Security and server logs: for a period appropriate to detect abuse and investigate incidents.
• Cookie preference in your browser: until you clear storage or change the preference.

When data is no longer required, we delete or irreversibly anonymise it, except for copies in encrypted backups that rotate out in the ordinary course, or where law requires longer retention. We are not obliged to destroy backups on an individual schedule if doing so would impair backup integrity; such copies remain isolated until overwritten.

We implement technical and organisational measures appropriate to the risk, including access control, encryption in transit where we control the channel, and least-privilege administration of licence data. No method of transmission or storage is completely secure. We do not warrant that the website, email, or any system is invulnerable. You send information over the internet at your own risk. A security incident does not, by itself, constitute a waiver of our rights or an admission of liability beyond what mandatory law requires.

Subject to applicable law (including GDPR, UK GDPR, and KVKK) and to the limits below, you may have the right to: request access to personal data we hold about you; request correction of inaccurate data; request deletion; request restriction of processing; object to processing based on legitimate interests; withdraw consent where processing is based on consent; request portability of data you provided; and lodge a complaint with a supervisory authority.

In Türkiye, you may also submit KVKK Article 11 requests to us and, if unresolved, apply to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu). In the EEA/UK, you may contact your local supervisory authority.

We may refuse, limit, or charge for a request where the law allows, including where the request is unfounded, excessive, repetitive, requires disproportionate effort, would adversely affect others, would reveal trade secrets or confidential commercial information, would interfere with licence enforcement or legal claims, or where we cannot verify your identity. We will not delete data we must keep for a contract, a legal obligation, or the establishment, exercise, or defence of legal claims.

To exercise rights, email [email protected] with enough detail to identify you and the request. We may require additional information to verify that you are the data subject or an authorised representative.

If a US state privacy law applies, we do not sell personal information and do not share it for cross-context behavioural advertising as those terms are defined in such laws. We do not use sensitive personal information to infer characteristics about website visitors. To submit a request, use [email protected]. We will not discriminate against you for exercising a right the law grants. Authorised-agent requests must include proof of authority that we can reasonably verify.

The website and our services are directed at businesses and persons 18 years of age or older. We do not knowingly collect personal data from children. If you believe we have received data from a child, contact [email protected] and we will delete it where we are not required to retain it by law.

We do not make solely automated decisions that produce legal or similarly significant effects about website visitors. Licence status (including expiry, revocation, or denial of activation) may be applied automatically according to the licence record and our Terms of Service; that is contract enforcement, not profiling of a consumer for advertising.

The website may link to third-party sites or services we do not control. Their privacy practices are their own. Linking is not an endorsement and does not make us responsible for their content or processing. Our trademarks and software remain ours regardless of any third-party page you visit.

We may amend this Policy at any time by posting a new version on this page and updating the “Last updated” date. The revised Policy applies from the moment it is posted, unless a later effective date is stated. Continued use of the website or continued licence communications after the update constitutes acknowledgement of the revised Policy. If a change is material and we are required by law to give additional notice, we will do so by a suitable means (for example a website notice or email where we have a working address). We do not need your separate signature for Policy updates relating to the public website.

Please contact [email protected] first so we can try to resolve the matter. You also have the right to complain to the competent data-protection authority in your jurisdiction, including the Kişisel Verileri Koruma Kurulu in Türkiye and the relevant EEA/UK supervisory authority where applicable. Filing a complaint does not waive our rights under our Terms of Service or applicable law.

All rights not expressly granted in this Policy are reserved. This Policy does not create any licence to the DataSynca software, APIs, documentation, logos, or content. It does not limit any right we have under copyright, trademark, trade-secret, patent, contract, or other law. Failure to enforce a provision is not a waiver. If a provision is held unenforceable, it will be modified to the minimum extent required, and the remainder will continue in full force.