Privacy Policy

Effective 18 October 2026 · Last updated 18 October 2026

This policy explains how Zerix (“we”), the operator of Syncyou, handles personal data. We act as a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and comply with the Information Technology Act, 2000 and its rules.

1. Data we collect

• Account data: your name, email address and profile photo from Google Sign-In; preferences such as your niche and notification settings.
• Connected account data: for each social account you connect, its account ID, display name, profile picture and the access/refresh tokens the platform issues. We never receive your social media passwords.
• Content you create: posts, drafts, schedules, brand profiles (including uploaded brand images), blog posts and blog connection settings.
• Platform data you ask us to fetch: your published posts and their metrics, follower counts, and comments, mentions, replies and direct messages on your connected accounts (used for analytics and lead discovery).
• AI data: the prompts and content you send to AI features, the results (saved in your AI history) and token usage for each request.
• Billing data: plan, credit balance, order and subscription IDs and payment status. Card, UPI and bank details are entered directly with Razorpay and are never stored by us.
• Technical data: IP address and basic request logs used for security and debugging, and data stored in your browser as described in our Cookie Policy. We do not use advertising or third-party analytics trackers.

2. How we use it

• To provide the Service: publishing and scheduling, analytics, lead discovery, AI generation and your history.
• To meter and bill AI credits and subscriptions, and to send service notifications (for example a failed post or low credits).
• To keep the Service secure, prevent abuse and fix problems.
• To meet legal obligations such as tax and accounting record-keeping.

We do not sell your personal data, and we do not use your content or connected-account data for advertising.

3. Legal basis

We process personal data with your consent, given when you sign in and when you connect each account, and for legitimate uses permitted by the DPDP Act such as complying with law. You can withdraw consent at any time by disconnecting accounts or deleting your account; withdrawal does not affect processing already done.

4. Service providers we share data with

We share data only with providers that help us run the Service, under contracts that limit their use of it:

AI requests are processed under the providers’ commercial API terms, which do not allow them to use your inputs or outputs to train their models. We may also disclose data where required by law or to protect rights and safety.

5. Google and YouTube data

Syncyou’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. When you connect YouTube we use the YouTube API Services to upload videos you choose, read your channel statistics and read comments for lead discovery. By connecting YouTube you also agree to the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy. You can revoke our access at any time at Google security settings.

6. Meta, LinkedIn, X, Telegram and Snapchat data

We access these platforms only through their official APIs and only with the permissions you grant when connecting. Data received is used solely to provide the features you request, is not sold or used for advertising, and is deleted as described in Data Deletion. You can also remove access from each platform’s own settings.

7. Data about other people

Lead discovery processes comments, mentions and messages written by other people on your accounts. You decide when to run it and are responsible for contacting those people lawfully. If someone asks us about their data, we will help you respond.

8. Where data is stored

Data is stored with Google Cloud/Firebase and processed by our providers, which may be located outside India. We transfer data only as permitted under the DPDP Act and with appropriate safeguards.

9. How long we keep it

• Account, content, AI history and connected-account data: until you delete them or your account.
• After account deletion: removed from live systems within 30 days; backups expire within a further 30 days.
• Billing and transaction records: as long as Indian tax and accounting law requires (generally 8 years).
• Security logs: up to 90 days.

10. Security

Data is encrypted in transit (HTTPS) and at rest by our cloud providers. Access is limited by per-user database rules; credits, payments and AI history can only be written by our servers. No system is perfectly secure; if a breach affects your personal data we will notify you and the Data Protection Board of India as the law requires.

11. Your rights

Under the DPDP Act you can:

• access a summary of your personal data and how it is processed (Settings → Export my data gives you a full copy);
• correct or update your data;
• erase your data (Settings → Delete my account, or see Data Deletion);
• withdraw consent, and nominate another person to exercise your rights in case of death or incapacity;
• raise a grievance with our Grievance Officer, and then with the Data Protection Board of India.

12. Children

The Service is not for anyone under 18. We do not knowingly collect children’s personal data; if you believe a child has used the Service, contact us and we will delete the account.

13. Changes

We will post updates here with a new “Last updated” date and notify you in the app or by email of material changes.

14. Grievance Officer

Satya Pal, Zerix, India. Email: hello@syncyou.in. We acknowledge grievances within 24 hours and resolve them within 15 days.