Last updated: 2026-10-02 · v2026-10-02

Privacy policy

This policy explains what personal data Sinapti processes, why, on what legal basis, who it is shared with, how long it is kept and what rights you have. It is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD).

Summary

• Your data is processed by Fernando Moro Hernández, a self-employed sole trader who runs Sinapti. For anything at all: privacy [at] sinapti [dot] com.
• We use your data to provide the service. We do not sell it, we show no advertising and we do not train artificial intelligence models on your content.
• Your data lives on OVH servers in the European Union. Email is delivered by Resend, which keeps its records in the United States.
• Analytics only runs if you accept it.
• If you delete your account, we delete it straight away. Some technical logs and the backups last a few more days, and we tell you exactly how long.
• You can access, correct, delete or take away your data, or object to its use, by writing to us.

Who processes your data

The controller is Fernando Moro Hernández, sole trader (self-employed), tax ID (NIF) 02299659G, of Calle Aguacate 41, Portal B4, Planta 3, Local 8, 28054 Madrid (Spain). You can email privacy [at] sinapti [dot] com or call +34 91 777 36 33.

We have not appointed a Data Protection Officer: none of the cases in which article 37 GDPR and article 34 LOPDGDD require one applies.

What data we process

• Account: your email address, your name, your password hashed with bcrypt (we never store it in plain text), your time zone, your preferences and the date of your last visit. If you sign in with Google, also your Google account identifier, the URL of your profile picture and the access codes Google gives us when you sign in.
• Your content: thoughts, tasks, resources, projects, templates, notes, tags, comments and the files you upload.
• Security: the IP address and browser you use when you sign in or out, change your password or email, turn two-step verification on or off or fail its code, create or revoke API keys or delete your account. Also the IP you use when you accept the Terms. We also count sign-in attempts per email and per IP to stop abuse, and our server logs the IP of every request.
• Google Calendar, only if you connect it: the email of that Google account and the events of the calendars you choose (title, description, place, dates and link; not the attendees). Access is read-only.
• Notifications: your preferences and, if you turn on browser notifications, the technical details needed to deliver them.
• Programmatic access, if you use it: your API keys (we keep their fingerprint and first characters so you can recognise them, never the full key) and the authorisations you grant to clients connected over MCP.
• Analytics, only if you accept it: page performance, errors and interface usage, linked to an identifier of your account.
• Payment, once paid subscriptions exist: the status of your subscription and the customer identifiers the payment provider gives us. The provider handles your card or PayPal details; we never see them.
• What you send us: the content of your emails and calls when you contact us.

For semantic search, our servers compute a numeric representation (vector) of the title and text of each item. Its own section below explains how.

Why we use them and on what legal basis

News and newsletter. Today we send neither. When we do, we may write to customers about Sinapti news without asking first, as the law allows, but you will be able to refuse when you subscribe and in every email, through a link. Only people who expressly sign up will get the newsletter. We stop writing when you stop being a customer or unsubscribe.

Where the basis is consent, you can withdraw it at any time without affecting what was done before. Where it is legitimate interest, you can object.

What other people can see

Sinapti is personal: nobody sees your content unless you share it.

• Connections: when you connect with another user, each of you sees the other's name and email, also while the invitation is pending. If you invite someone who has no account yet, we email them your name and your email; we do not keep their address.
• Delegation: whoever receives a task you delegate sees its content and its whole history, including comments you wrote before delegating it. On accepting it they keep a copy of the title, text and files, even if you later withdraw the delegation.
• Public links: anyone with the link can see what you publish. Published resources may show up in search engines such as Google. Published tasks are not indexed, but they show your name next to comments and follow-ups.
• Integrations you connect: the artificial intelligence clients and apps you connect with your API keys or over MCP receive the data you ask them to read. You decide who gets it.

Who else receives data

We rely on these providers, under a data processing agreement and only for the stated purpose:

Analytics is processed by our own system hosted on our server, not by a third party. The technical reference page of our API only loads resources from jsDelivr and Scalar (United States) if you press the button that says so; if you use its test requests there, they may go through Scalar's servers.

We do not sell your data or hand it to anyone for commercial purposes. We would only disclose it to an authority that lawfully requires it.

Transfers outside the European Economic Area

Resend, Google and Stripe may process data in the United States. Those transfers rely on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and, in addition, on the standard contractual clauses approved by the Commission. OVH's remote access from Canada and the United Kingdom relies on the adequacy decisions for those countries.

How long we keep them

When data must only be kept to deal with possible liabilities, we block it: nobody uses it and it would only be handed to a judge or an authority.

What happens when you delete your account

You can delete your account in Settings → Account. If you only sign in with Google and have no password, ask us at privacy [at] sinapti [dot] com or first set a password in Settings.

When you delete it, your account and all your content are erased straight away and for good. The files you uploaded are then deleted by an automatic process.

What remains for a while:

• The security log of the deletion and of your latest sign-ins (email, IP and browser) for 90 days.
• The backups for about 30 days.
• The server technical logs for 15 days, and up to 30 more days in the backups.
• Comments you left on other people's items stay there, without your name.
• Tasks you delegated stay in the account of whoever received them.
• Notifications other people received about your activity (for example, that you accepted a task delegated to you) keep your name.
• The copies your browser keeps for offline work are not removed when you sign out or delete the account: you can clear them in your browser settings.

If you connected Google Calendar, we then also revoke the permission you granted Sinapti and stop receiving notifications from your calendars. If that same Google account is still connected to another Sinapti account, the permission is not revoked: Google shares it between the two, and revoking it would stop the other account's sync. You can withdraw it yourself at https://myaccount.google.com/permissions.

Your rights

You can ask us at any time for:

• Access: knowing what data of yours we process and getting a copy.
• Rectification: correcting data that is inaccurate.
• Erasure: deleting data that is no longer needed.
• Restriction: pausing its use while a doubt is resolved.
• Portability: receiving your data in a structured, commonly used format to take it to another service.
• Objection: stopping processing based on legitimate interest, or stopping commercial messages.
• Withdrawing your consent, without affecting what was done before.

Email privacy [at] sinapti [dot] com saying which right you want to exercise. If it is not clear that the request comes from you, we will ask you to prove it. We reply within one month; if the request is complex we may extend that by two more months, telling you within the first.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

How we protect your data

• Every connection is encrypted with HTTPS.
• Passwords are stored hashed with bcrypt.
• The permissions you give us for Google Calendar are stored encrypted.
• Each person can only access their own data.
• If your account has a password, you can turn on two-step verification by email in Settings.
• We make daily backups on our own server and keep them for about 30 days.

Google

If you sign in with Google or connect Google Calendar, Google Ireland Limited processes your data as an independent controller, under its own privacy policy.

Sinapti's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only ask for what we need: your identity to sign in and, if you connect Calendar, read-only access to your calendars and events.
• We only use that data so you can see, search and organise your events in Sinapti like the rest of your content, including through the API or MCP if you connect those integrations.
• We do not sell it, use it for advertising or use it to train artificial intelligence models.
• You can disconnect Google Calendar in Settings: we stop syncing and revoke the permission, unless that same Google account is still connected to another Sinapti account (Google shares the permission between the two, and revoking it would stop the other account's sync). Events already imported stay in your account until you delete them, and are deleted with it. You can also withdraw the permission at https://myaccount.google.com/permissions.

Semantic search

So that search can find items by their meaning and not only by their exact words, our servers compute a vector from the title and text of each item. The model runs on our own infrastructure: your content is never sent to any outside artificial intelligence service.

A vector could allow part of the original text to be rebuilt, so we protect it just like your content. It is never shown to anyone and never leaves through our API.

You can delete your vectors in Settings → Advanced. Keyword search keeps working, but while you have content the vectors are computed again whenever you create or edit something and in the nightly run.

We do not use your content to train any model.

Minors, automated decisions and changes

Sinapti is only for people aged 18 or over, who confirm it when they sign up. If we learn that an account belongs to a minor, we delete it.

We make no automated decisions that produce legal effects on you or affect you in a similarly significant way.

We may change this policy when the service or the law changes. The version and date are shown above. If a change is significant, we will tell you before it applies.