What this is
This addendum sits beside our Terms of Service and Privacy Policy and describes how we process personal data on your behalf. To have it signed between your organisation and SynthBoard, request a signed copy — we return it countersigned, with this version number and date.
SynthBoard is a personal business based in Israel. Contact for this addendum: legal@synthboard.ai; for requests about personal data: privacy@synthboard.ai.
Who is responsible for what
| Data | Controller | Processor |
|---|---|---|
| What you bring: your questions, rooms, files, the facts in your World, what your connected tools return | You (or your organisation) | SynthBoard |
| Your account, billing and security logs | SynthBoard | — |
| Product analytics (only with your consent) | SynthBoard | — |
As processor, we use what you bring only to provide the service you use — to answer, remember, connect and check back as you ask — and as the law requires. We do not sell it, do not use it to train models, and do not make decisions about you or anyone else from it.
You are responsible for having the right to share what you bring, including anything about other people.
Subprocessors
The companies that process personal data for us are listed, generated from our code, at Subprocessors, with what each handles and where. We add a dated line there before a new one starts. With a signed copy of this addendum you can ask to be told by email and object to a new subprocessor; if we cannot address the objection, you can end the service and delete your account.
Security measures in the code
- Isolation in the database. Row-level security is on for every table in the public schema — 259 of 259, 356 policies, counted on production on 18 October 2026. A query made as another user returns no rows of yours.
- Privileged functions run with a fixed search path, and execution is revoked from anonymous and signed-in roles; only our server calls them, with your own id.
- Scoped API keys. Keys for our MCP server and API carry scopes, an optional expiry, an optional IP allowlist, a daily credit cap and a rotation grace window; each is checked on every call. Assistant connections cannot write to your tools.
- Append-only logs. The log of every action taken in your tools is append-only, enforced by a database trigger, with personal data scrubbed from payloads before it is written. Positions on the record are append-only the same way: a change is a new row, never an overwrite.
- Encrypted connector tokens. A token for a system you connect directly is sealed with AES-GCM under a key that exists only for that purpose, bound to its own row, never logged, and deleted when you disconnect. Tokens for tools connected through our integration provider are held by that provider, not by us.
- Encryption in transit (TLS 1.3) and at rest (AES-256), as provided by our hosting and database providers.
- Hostile content. Uploaded, pasted and connector text is treated as data, sanitised and screened for prompt injection before a model reads it.
- Self-serve deletion (below) re-checks who is asking before anything is erased.
We hold no SOC 2 or ISO certification of our own. Our database and hosting providers hold theirs. We answer security questionnaires by email.
Where data is processed
| What | Where |
|---|---|
| Stored: the database, sign-in and files | European Union (Ireland, eu-west-1) |
| Processed: the app’s server code | United States (Washington, D.C., iad1) |
| Processed: AI model providers | United States, and the European Union for Mistral AI — per provider on Subprocessors |
So your data is stored in the EU and processed in the US. Transfers rely on the safeguards described in §6 of the Privacy Policy.
How long things are kept
| Record | Kept for |
|---|---|
| Rooms, memos, positions on the record, your World | While your account exists, until you delete them |
| A room you ran and then removed | Archived, not deleted, until the account is deleted — it carries a financial record. A draft you never ran is deleted at once. |
| Log of actions in your tools | 90 days (connect and disconnect events: the life of the account) |
| Model-call audit log | 90 days |
| API and MCP call log | 12 months |
| Database backups | 90 days, rolling — a deletion leaves backups as they roll |
| Payments and the credit ledger | As tax law requires, anonymised after account deletion |
Getting it back, and deleting it
- Export: Settings → Preferences → download a complete JSON bundle of your data, once an hour.
- Delete your account yourself: Settings → Plan and credits. You type DELETE and confirm with your password, or a sign-in in the last 30 minutes. While a paid subscription is live you cancel it first, so billing cannot continue on a deleted account.
- What deletion does: every connected tool is revoked at its provider first; then your account is deleted, which removes every row that belongs to you. Audit rows that cannot be deleted are cut loose from you (your id and network identity removed). Your files are erased from storage. Only the payment records tax law requires remain, anonymised.
- Off the record: a room you run off the record has its memory rows deleted by a database trigger the moment it is marked, and is never read back into another answer.
A deletion is always subject to a binding legal order to preserve data. When we may share data at all is listed in §4.2 of the Privacy Policy.
Requests, incidents and help
Requests from people whose data you brought (access, correction, deletion) reach us at privacy@synthboard.ai; we answer within 30 days and help you answer yours. If personal data is breached, we notify you as the Privacy Policy describes in §12, with what happened, what data was affected and what we are doing about it.
What we don’t offer today
- Single sign-on (SAML) and a shared team workspace.
- A SOC 2 report, a penetration-test letter or a HIPAA business associate agreement.
- A choice of processing region.
We would rather say no plainly than promise a date. Ask at legal@synthboard.ai.
Change log
- 18 October 2026 — version 1.0, first published.