As of: 18 October 2026 | Version: 3.3
This privacy notice informs you under Art. 13 GDPR about the processing of your personal data when you use SYNTON. It describes the actual technical state of the service as of the date above, not a planned state.
Kariem Albosta
c/o MDC#1890, Welserstraße 3
87463 Dietmannsried
Germany
Email: synton.app@gmail.com
Requests are usually answered within 30 days (Art. 12(3) GDPR). SYNTON is operated by one individual; for organisation pilots, the information in section 6 also applies.
| Data category | Purpose | Legal basis |
|---|---|---|
| Email address, password hash | Identification, authentication, account creation | Art. 6(1)(b) GDPR (performance of contract) |
| Sign-in time, last_seen_at | Security, session management, recency display in the field | Art. 6(1)(f) GDPR (legitimate interest) |
| Data category | Purpose | Legal basis |
|---|---|---|
| Full name, year of birth, gender | Basic profile display | Art. 6(1)(a) GDPR (consent) |
| Place of residence (city/region), languages spoken | Location and language filtering in matching | Art. 6(1)(a) GDPR |
| Professional field, work experience, skills | Context-based matching, field visualisation | Art. 6(1)(a) GDPR |
| AI-generated user profile (semantic matching profile, embeddings) | Semantic matching (details: section 3) | Art. 6(1)(a) GDPR |
The additional profile data in this section is voluntary. Suggestions can already be made on the basis of a current intention. Voluntary details such as professional field, experience, skills, location or languages may additionally feed into the selection and explanation of suggestions. Depending on the space, a separate space profile may also be used; which details are required or visible there is shown before publication.
SYNTON lets you write short context statements (intentions) describing what you are currently working on or looking for. These texts are stored, converted into AI embeddings (OpenAI, section 5) and weighted over time. The legal basis is your consent (Art. 6(1)(a) GDPR). You can delete intentions at any time.
The recency of an intention decreases automatically over time (energy model, details in section 3). Inactive intentions are not deleted from the database until you delete your account or remove the intention manually.
| Data category | Processing | Legal basis |
|---|---|---|
| Text messages in Spaces and direct chats | Transmission to the recipient(s), storage on the EU database server | Art. 6(1)(b) GDPR |
| Voice messages (audio files) | Storage in Supabase Storage (EU), provision to conversation participants | Art. 6(1)(b) GDPR |
When you send a connection signal, we store the sender, recipient, time and, where applicable, the associated movement. Your optional button wording is stored for your account and can be changed or reset to the app default in your profile. When sending, we store the wording identifier, language, version and surface (field or chat) separately from the received signal. The recipient cannot see these wording details. They do not establish your feelings or enroll you in a study. This does not activate scientific research using these details.
Private contact notes (up to 1,000 characters) are accessible only to their author and are excluded from matching. You can edit or delete them at any time. Your wording preference, your associated sending details and your notes are included in your self-service data export and removed upon account deletion. Notes about a deleted contact account are also removed.
We send transactional emails (e.g. magic-link sign-in, account confirmation, invitation links) through the processor Resend, Inc. (section 5). The sender address used is noreply@mail.synton.net. The legal basis is Art. 6(1)(b) GDPR. The text of an invitation link is cleaned before any AI processing (email addresses, URLs, phone numbers) and is only processed further if AI consent has been given.
If you write to us using the enquiry form on the website, we store your name, email address, your message and the offer from which you are enquiring in order to reply to you. Only administrators see these details. A copy is sent to us by email via Resend (section 5) as a notification. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps). We delete enquiries 12 months after they were last handled.
Intentions you write are checked automatically for potentially harmful content in order to protect other users. For this, if the AI option is activated, an AI language model of the provider Anthropic PBC (Claude Haiku) named in section 5 is used. The result can directly affect visibility: if the rating is very high, a new intention is not saved; if it is elevated, it is only saved privately. In matching, your own intention can be fully isolated, and other people’s intentions above a configured threshold can be removed from the candidate field. This does not block your account, but it may mean no connection suggestion is made. The rating can be wrong. You can request a human review and correction at synton.app@gmail.com. The legal basis for the safety check is Art. 6(1)(f) GDPR (legitimate interest: platform safety); using external AI for your own content additionally requires the AI option to be activated.
If you activate push notifications, your device is reached through the push services of your browser provider (Google, Apple or Mozilla, depending on the browser you use). We only transmit encrypted message content (VAPID protocol, Web Push standard); the push service concerned can see the time and the device identifier, but not the unencrypted content. The legal basis is your consent when activating (Art. 6(1)(a) GDPR). You can deactivate push notifications at any time in your device settings or profile settings.
IP address, timestamps and error messages are processed in server logs for a maximum of 30 days. Legal basis: Art. 6(1)(f) GDPR (operational security).
To improve matching, we count whether a search in the field produced suggestions and, if not, for which technical reason (for example: nobody else in the room). We store only a reason code, numbers, the room and the full hour — no texts, no names, no identifier of you. This counting does not take place in rooms of a scientific study. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in matching that works).
Based on your profile data and intentions, SYNTON automatically creates a semantic user profile: an AI-generated summary of your current focus. This profile is used to suggest other suitable users to you in the “field”. Semantic embeddings (OpenAI, text-embedding-3-small) and language-model evaluations (Anthropic Claude Haiku) are used for context recognition, explanation texts and profile summaries.
Before texts are sent to an AI provider, an automatic filter replaces the following categories: email addresses, URLs, @-handles (e.g. social media user names) and digit sequences of seven or more digits (e.g. phone numbers). In explanation prompts, names of other people are additionally replaced by the placeholder “Person X”. Internal user IDs are never sent to an AI provider.
The recency of each intention decreases automatically over time. This value determines the visibility of your profile in other users’ fields. It is a purely time-based relevance measure, not a personal rating. It is calculated entirely within the platform; the numerical value is not shown to you.
The automated creation of the resonance fingerprint and AI matching are based on your separate, optional consent (Art. 6(1)(a) GDPR). Ordinary suggestions are non-binding and have no legal or similarly significant effect within the meaning of Art. 22(1) GDPR. The safety filters from section 2.6 can affect visibility and can therefore be reviewed by a human. You can withdraw your AI consent at any time in your profile settings (section 11). Withdrawal stops new AI processing and removes stored profile and intention embeddings and the resonance fingerprint; your content and your account remain unless you delete them yourself.
A small share of suggestions is not based on semantic similarity but on randomised algorithms, to enable unexpected connections. Where your AI profile or AI-evaluated content is used for this, your optional consent under Art. 6(1)(a) GDPR also applies.
The administrator (Kariem Albosta) can access platform content for moderation and support purposes, for example to check reported content or to help with technical problems. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: platform safety and support).
For support cases there is a technical function that allows the administrator to sign in as your account (creating a sign-in link for your account without knowing a password). This function is only used to fix errors or at your express request. Every use is logged immutably: the time, the acting account and the affected account are recorded in an audit log (admin_audit_log) that only administrators can view.
As part of the doctoral study there is also a narrowly limited, read-only role for the academic supervisor (supervisor role). This role has no direct access to raw data, profiles or message content, only to specially set up, heavily restricted evaluation views of study participation. This role only gets access to a sample of intention texts verbatim (at most a quarter, drawn deterministically) if this is expressly named in the study consent and has additionally been enabled individually. Every grant and withdrawal of this access is logged. This role only concerns study participants with their own study consent, never organisation pilots (section 6).
| Processor | Category | Location | Transfer basis | Data processed |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | Storage location: EU (Ireland, eu-west-1). Company headquarters: USA | Servers in the EEA, so no third-country transfer for the data storage itself. As Supabase, Inc. is a US company, access from the USA (e.g. under the US CLOUD Act) cannot be completely ruled out; additionally secured by standard contractual clauses (Art. 46(2)(c) GDPR) and a data processing agreement under Art. 28 GDPR | All user data: profiles, intentions, messages, voice messages, auth data |
| Vercel Inc. | Website and app hosting (synton.net) | USA (DPF-certified) | EU-US Data Privacy Framework (Art. 45 GDPR, adequacy decision) + data processing agreement | Technical access data (IP address, timestamp) when delivering the website/app. No profile or message content. |
| OpenAI, LLC | Semantic embeddings (text-embedding-3-small): converting texts into vectors for matching |
USA | According to its own information, OpenAI is not certified under the EU-US Data Privacy Framework (checked via the official participant list at dataprivacyframework.gov). Transfer based on standard contractual clauses (Art. 46(2)(c) GDPR) + data processing agreement | After PII filtering (section 3.2): intentions, profile descriptions. No email addresses, no complete phone numbers, no internal user IDs. |
| Anthropic PBC | AI language models (Claude Haiku): context analysis, resonance explanations, profile summaries and harm detection with the visibility effects described in section 2.6 | USA | EU-US Data Privacy Framework (Art. 45 GDPR, adequacy decision), additionally secured by standard contractual clauses (Art. 46(2)(c) GDPR) + data processing agreement | After PII filtering (section 3.2): intentions, aggregated Space chat summaries (other participants anonymised as “Person X”), profile descriptions. No email addresses, no complete phone numbers, no internal user IDs. |
| Resend, Inc. | Transactional email delivery | USA (DPF-certified) | EU-US Data Privacy Framework (Art. 45 GDPR, adequacy decision), additionally standard contractual clauses + data processing agreement | Recipient email address, technical delivery metadata. No content of user posts. |
| Cloudflare, Inc. | Bot protection (Turnstile) for email access | USA (DPF-certified) | EU-US Data Privacy Framework (Art. 45 GDPR, adequacy decision) + data processing agreement | Technical browser signals (including IP address, device and connection characteristics) solely to distinguish humans from bots. No profile or message content. |
| Google LLC, Apple Inc., Mozilla Corporation | Delivery of web push notifications (depending on the browser you use) | USA | Depending on the provider, DPF certification and/or standard contractual clauses; delivery is encrypted (details: section 2.7) | Device push identifier, time of delivery. The message content is end-to-end encrypted and cannot be read by the push service. |
A tabular overview that is checked on an ongoing basis, with check dates, is also available on our trust page. All processors named are contractually obliged to process personal data only on our instructions (Art. 28 GDPR). Disclosure to further third parties or use for their own purposes is prohibited.
SYNTON offers organisations (e.g. universities, companies, NGOs) time-limited, separate pilot projects (“cohorts”). If you join such an organisation cohort as a member, the separate document “Privacy information for pilot participants”, which is made available to you before joining, applies in addition to this privacy notice. It sets out in particular what the commissioning organisation sees (aggregated figures from a minimum group size of five people, k-anonymity with k=5, never individual texts or individual people) and who acts as the controller under data protection law in the specific pilot.
Within an organisation pilot, the following may also be collected: a self-chosen assignment to a department/location, answers to short, non-psychological surveys before and after the pilot, and reactions to so-called “field moments” (pulses). This data is deleted after the agreed end of the pilot (section 7).
Independently of the organisation pilots, the operator conducts a scientific study on psychological processes in the initiation of social contacts as part of their own doctoral project. Participation in this study is technically and organisationally separate from organisation pilots: enrolment in the doctoral study is not possible from an organisation cohort. Study participation requires its own separate consent with its own study code and its own demographic details; details are set out in the study consent form presented there.
Your data is stored as long as your user account is active. Intentions are stored without a time limit but lose visibility over time (energy model).
When you delete your account (profile settings → Delete account), a multi-step technical process starts: first your audio files are removed from file storage, then the data belonging to your profile is deleted or anonymised in an atomic database operation, and finally your authentication account is deleted. The following data is covered:
Technical server logs (IP, timestamp) are deleted automatically after 30 days at the latest.
Logs of the use of AI features (time, model used, type of processing) are stored without content for 12 months and then deleted automatically.
Observation data used to calibrate the energy model (section 3.3) is deleted by an automated process after 90 days at the latest.
The matching counts (section 2.8) are deleted by a monthly automated process once they are older than 180 days.
Enquiries via the website contact form are deleted automatically 12 months after they were last handled.
Data from organisation pilots (section 6.1) is deleted after the period agreed in the pilot contract concerned, but at the latest when your user account is deleted.
You can download a machine-readable export of your data in JSON format at any time via the profile settings (“Download my data”) (Art. 15, Art. 20 GDPR). To protect other people (Art. 15(4) GDPR), it does not contain reports or assessments by others about you or internal moderation notes. You can obtain information about these on written request, unless the rights of third parties prevent this.
Resend stores technical delivery metadata in accordance with its own privacy policy (available at resend.com/privacy).
New registrations on SYNTON are only intended for people aged 18 and over. In addition to data protection risks, this also reduces unresolved questions of limited legal capacity. For existing accounts of people under 18, no ID copy is requested; affected people or their legal guardians can contact synton.app@gmail.com. A future offer for minors would require its own reviewed representation and youth protection process.
SYNTON stores certain session data in the local storage of your browser/app:
On shared devices, other people with access to the same browser profile may be able to see this local content. When you sign out, switch accounts or after a successful account deletion, the app removes the account-related drafts, notes and caches it knows about. It cannot control copies outside this app storage, such as browser or device backups. On an unfamiliar or shared device, you should therefore also delete the website data in your browser if needed. We do not use marketing cookies. Whether local storage access is exempt from consent under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) depends on whether it is specifically necessary; the mere absence of tracking is not enough.
You have the following rights against the controller:
To exercise your rights, contact: synton.app@gmail.com
Where processing is based on your consent (Art. 6(1)(a) GDPR), you can withdraw it at any time with effect for the future:
Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before the withdrawal.
You have the right to lodge a complaint at any time with the data protection supervisory authority responsible for you (Art. 77 GDPR). The responsible authority depends on your place of residence or work in Germany. A list of all state authorities is available at: bfdi.bund.de
Responsible authority for the controller (where based in Germany): the state data protection authority responsible for Kariem Albosta’s place of residence. Federal point of contact: Federal Commissioner for Data Protection and Freedom of Information (BfDI).
Kariem Albosta
c/o MDC#1890, Welserstraße 3
87463 Dietmannsried
Germany
Email: synton.app@gmail.com
Response time: usually within 30 days (Art. 12(3) GDPR)
We reserve the right to update this privacy notice if legal bases, purposes of processing or the services used change. In the event of material changes, signed-in users are informed by an in-app notice or email. The “As of” date above shows the current version.