Synter Privacy Policy

Last updated: October 18, 2026

This Privacy Policy explains how Synter ("Synter," "we," "us," or "our") collects, uses, discloses, and protects information in connection with our software-as-a-service platform located at https://synterai.com and related services (the "Service"). The Service helps users manage cross‑platform advertising campaigns, including integrations with Google Ads, Reddit Ads, X Ads, LinkedIn Ads, Meta Ads, and Microsoft Ads.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

If you have questions or would like to exercise privacy rights, contact us at privacy@synterai.com.

Summary (at a glance)

• We collect account info, OAuth tokens (encrypted), campaign data, and performance metrics to provide and improve the Service.
• We use third parties to operate the Service (hosting, payments via Stripe or Shopify as applicable, analytics via PostHog, and AI features via OpenAI).
• OAuth tokens and API keys are encrypted at rest using AES‑256‑CBC; we never store your ad account passwords.
• You can access, correct, export, or delete your data, and disconnect ad accounts at any time.
• We do not sell personal information.

Who we are and roles

• Controller: For your account, billing, and product analytics, Synter is the "controller" (GDPR).
• Processor: For advertising campaign data we ingest from ad platforms at your direction, Synter acts as a "processor" on your behalf.

Information we collect

1. Account and contact information

• Name, company name, email address, password (hashed)
• Billing contact details, subscription tier, subscription usage
• Support communications and feedback

2. Authentication and connections

• OAuth tokens and refresh tokens for ad platforms you connect
• OAuth token metadata (scopes, expiry)
• We do NOT store ad platform passwords

3. Campaign and performance data

• Account, campaign, ad group, ads, keywords, audiences, budgets
• Performance metrics (impressions, clicks, cost, conversions, ROAS)
• Labeling, notes, and structures you create

4. Payment and transactional data

• Subscription status, invoices, plan changes
• Payment details handled by Stripe, or by Shopify for Shopify App Store installs (we do not store full card numbers)

5. Usage and device data

• Log data (IP address, device/browser, timestamps, pages viewed)
• Product analytics events via PostHog
• Cookie identifiers

6. AI features content

• Prompts and inputs you submit to AI features
• Generated outputs and campaign suggestions

AI assistants and connectors

When you connect Synter from an AI assistant such as ChatGPT, Claude, or Cursor through the Model Context Protocol (MCP), we receive account identifiers, OAuth tokens, tool-call inputs and outputs, and the ad-account and analytics data you ask us to access. We use this data only to perform the actions you request.

The hosting and infrastructure providers listed below process this data on our behalf: Vercel for frontend hosting and Railway for backend hosting, with PostgreSQL database storage.

Tool-call logs are retained for 30–90 days, consistent with the log retention period below. You can request deletion of connector data by contacting support at support@syntermedia.ai.

We do not use data received through AI assistant connectors or plugins to train artificial intelligence or machine learning models.

Shopify integration

When a merchant installs the Synter Shopify app, we request only the Shopify permissions needed to provide the merchant-selected advertising and measurement features:

• Product and inventory read access to use selected catalog items, prices, product URLs, and availability as campaign inputs
• Order read access to summarize store revenue and compare it with connected advertising performance
• Customer read permission is granted during installation, but customer contact fields are fetched only when the merchant requests an order query, customer lookup, audience sizing or segmentation, or an audience export. Order queries can include the customer name and email attached to each requested order. Customer lookups return aggregate cohort statistics, and audience exports return only SHA-256-hashed identifiers. Raw customer export is not available through the generic script runner
• Web Pixel write and customer-event read access to activate and verify the Synter Web Pixel

Products, inventory, orders, and customers are fetched on demand for the feature requested by the merchant and are not retained as Shopify resource mirrors. Protected Shopify customer, order, abandoned-cart, and audience tool inputs and outputs are not retained in agent, widget, Slack, audit, or script-run histories. We retain the store domain, encrypted Shopify access token, connection status, granted scopes, and billing identifiers needed to operate the integration.

Storefront conversion events may contain an email address, phone number, Shopify customer identifier, or order identifier. We use these fields only for attribution and merchant-configured delivery to advertising platforms. Access is restricted, and matching event records are deleted when Shopify sends a customer-redaction request. To prevent an event request that started before deletion from restoring that data afterward, we briefly retain keyed, one-way digests of the identifiers covered by the request and its completion cutoff. Expired suppression records are pruned, and shop redaction deletes any that remain. We process Shopify's required customer data request, customer redaction, and shop redaction webhooks. Uninstall revokes the store connection and starts the applicable cleanup process. We do not sell Shopify merchant or customer personal information.

How we use information

We use information to:

• Provide and operate the Service (account creation, ad platform connections, campaign sync, reporting)
• Secure the Service (authentication, abuse prevention)
• Process payments and manage subscriptions through Stripe, or through Shopify-managed billing for Shopify App Store installs
• Analyze and improve product performance (via PostHog)
• Provide support and communicate updates
• Comply with legal obligations

Service improvement

• Anonymized and aggregated data. We may use anonymized and aggregated data derived from service usage to operate, secure, analyze, and improve the Service. Anonymized data has been processed to remove or obscure identifying information so that no individual or entity can reasonably be identified. Aggregated data combines information from multiple customers or users in statistical form and does not identify any specific individual or entity. Data received through AI assistant connectors or plugins is used only as described in the "AI assistants and connectors" section above.
• Not personal data or customer content. Anonymized and aggregated data is distinct from personal data (governed by this Privacy Policy and applicable data processing agreements) and from customer content (campaign data, creatives, and audience lists you submit, which we process solely to provide the Service). We do not use your personal data or customer content to train our models except as explicitly authorized by you in writing.
• No false anonymization claims. We will not describe data as anonymized if it remains reasonably re-identifiable. If data labeled as anonymized could reasonably be used to identify an individual, we will treat it as personal data under this Privacy Policy.

Security and encryption

• Credential encryption: All OAuth tokens, API keys, and service account credentials are encrypted at rest using AES‑256‑CBC encryption
• Key management: Encryption keys stored separately in secure secret management system with restricted access
• Transport security: All data transmitted over TLS 1.3+ (HTTPS only)
• Database security: Database connections encrypted, credentials rotated regularly, and access logged
• OAuth scopes: We request minimum OAuth scopes needed for functionality
• Token lifecycle: Tokens refreshed automatically and revoked when you disconnect
• Passwords: We never store ad platform passwords; only hashed user passwords for Synter login
• Access controls: Role-based access control (RBAC) ensures users only access their own data
• Audit logging: All credential access and modifications are logged for security monitoring

Third‑party services

We share information with service providers:

• Hosting: Vercel (frontend), Railway/cloud services (backend), PostgreSQL database
• Payments: Stripe and Shopify (payment processing and subscription management, as applicable)
• Analytics: PostHog (product analytics)
• AI features: OpenAI (AI agent campaign suggestions)

We do not sell personal information.

Your use of connected ad platforms is governed by their respective privacy policies.

Text messages (SMS)

We do not sell or share mobile phone numbers or SMS opt-in data and consent with third parties or affiliates for marketing or promotional purposes. Reply STOP to opt out at any time, or HELP for help. Message and data rates may apply. Message frequency varies.

Cookies and similar technologies

We use cookies for:

• Essential: Login, security, session management
• Functional: Remember preferences
• Analytics: Understand usage and improve the Service

You can control cookies through your browser settings or our cookie banner (where required).

Data retention

• Account data: While account is active; deleted upon request
• OAuth tokens: While connection is active; removed upon disconnect
• Campaign data: Deleted or anonymized 30–60 days after account closure
• Analytics: Retained up to 12 months
• Logs: Retained 30–90 days
• Billing records: Retained up to 7 years (tax/accounting)

International data transfers

We process data primarily in the United States. When transferring personal data from the EEA/UK, we use appropriate safeguards such as Standard Contractual Clauses.

Your rights

EEA/UK individuals (GDPR):

• Access: Obtain a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion ("right to be forgotten")
• Restrict/Object: Restrict or object to processing
• Portability: Receive data in machine-readable format
• Withdraw consent: Withdraw consent for cookie/analytics

California residents (CCPA/CPRA):

• Know/Access: Request details about personal information collected
• Correct: Request correction of inaccurate information
• Delete: Request deletion (subject to exceptions)
• Opt‑out: Opt out of sale (we do not sell personal information)
• Non‑discrimination: We will not discriminate for exercising rights

How to exercise rights:

• Email: privacy@synterai.com
• In‑app: Use data export or account deletion features
• Response time: We aim to respond within 30 days

Managing ad platform connections

• Connect or disconnect ad platforms anytime in Settings
• Review OAuth scopes before connecting
• After disconnect, we stop syncing and delete stored tokens

Security

We use safeguards to protect information:

• Encryption: AES‑256‑GCM at rest, HTTPS/TLS in transit
• Access controls: Role-based access, least privilege
• Secret management: Keys stored separately with rotation
• Monitoring: Security monitoring and vulnerability management

No method is 100% secure. If we learn of a breach, we will notify you as required by law.

AI features

• AI features use OpenAI to generate campaign suggestions
• Only inputs you provide are sent to OpenAI
• We do NOT send OAuth tokens or passwords to AI providers
• OpenAI does not use our API data to train models (by default)

Children's privacy

The Service is not intended for individuals under 16. We do not knowingly collect personal information from children. If you believe a child provided information, contact privacy@synterai.com.

Google API Services User Data Policy

Synter's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Synter uses Google Drive, Google Docs, and Google Sheets APIs solely to allow users to export and import their own campaign documents and reports. We do not transfer, sell, or use Google user data for any purpose other than providing and improving these features within the Service.

Changes to this policy

We may update this Privacy Policy from time to time. We will post updates on this page and update the "Last updated" date. Material changes will be communicated via email or in-app notice where required.

Contact us

Synter

Email: privacy@synterai.com

Support: support@syntermedia.ai

If you are in the EEA/UK, you may also contact your local data protection authority with questions or complaints.