Privacy Policy

1. Who we are and our role

Synacuity LLC (“Synacuity”, “we”, “us”) is a Texas limited liability company. We provide software that helps restaurant brands (our “Customers”) understand and respond to guest reviews and messages. This policy covers our website at synacuity.com and the Synacuity service (the “Service”).

We act in two roles:

• For our own account and website data (for example, the people who sign in to the Service or contact us), Synacuity decides how the information is used.
• For guest reviews, messages and business-profile data that a Customer connects to the Service, we process the information on the Customer’s behalf and on its instructions. The Customer decides what to connect and is responsible for having the right to do so. If you are a guest whose review or message appears in the Service, the business you wrote to is the best first contact for questions about that content.

2. Information we collect

Account and contact information

Name, work email address, organization, role and sign-in credentials for the people who use the Service, and any details you send us when you contact us.

Google Business Profile data (only after a Customer authorizes access)

• Business locations: location name, address and store code.
• Reviews: review ID, reviewer display name and profile photo as shown by Google, star rating, review text, timestamps, and any existing owner reply.
• Replies that a Customer’s team chooses to publish through the Service.
• OAuth access and refresh tokens that allow the Service to act for the authorizing account (see Section 4).

Messaging data from Meta platforms (only after a Customer connects an account)

When a Customer connects WhatsApp Business Platform, Instagram or Messenger accounts, we receive the messages and comments sent to that business, along with sender identifiers (such as a phone number, or a platform-scoped user ID and display name), timestamps, attachment metadata, conversation status, and the Customer’s own account identifiers and access tokens.

Technical data

IP address, browser and device type, and request logs generated when you use the Service. The Service uses essential cookies to keep you signed in. Our public website does not use advertising or cross-site tracking cookies.

3. How we use information

• To provide the Service: show reviews and messages in an inbox, analyze them, draft replies, publish replies a Customer approves, and run the automations a Customer configures.
• To authenticate users, keep accounts secure, and prevent abuse or fraud.
• To provide support and communicate with you about the Service.
• To meet legal obligations and enforce our terms.

We do not sell personal information, and we do not use it for advertising or to build advertising profiles.

4. Google user data and Limited Use

Synacuity’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, for information we receive through Google Business Profile APIs:

• What we request. The scope https://www.googleapis.com/auth/business.manage. We use it to read a Customer’s locations and reviews, to set up notifications for new and updated reviews, and to publish replies that the Customer’s team chooses to post.
• How we use it. Only to provide and improve the user-facing features of the Service that the Customer sees, such as the review inbox, review analysis and reply workflow.
• No transfer except as needed. We do not transfer Google user data to others except to provide or improve those features (including to the service providers listed in Section 7), to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to affected users.
• No advertising or sale. We do not use Google user data for advertising, and we do not sell it.
• No AI model training. We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.
• Human access. Our people do not read Google user data except with the Customer’s consent for support, where needed for security or to investigate abuse, to comply with law, or when the data is aggregated and anonymized for internal operations.
• Tokens. OAuth tokens are stored as protected secrets on our servers, are used only to call Google APIs for the Customer who authorized them, and are never exposed to the browser. We delete them when access is disconnected or on request.

5. Meta platform data

Information received through the WhatsApp Business Platform, Instagram and Messenger is used only to deliver the messaging features and automations a Customer has asked for, such as showing conversations to the Customer’s team, sending the replies the Customer configures, and routing conversations. We follow the Meta Platform Terms and Developer Policies and the WhatsApp Business policies that apply to our use. We do not sell this data, use it for advertising, or share it with other Customers. Messages sent through the Service are sent on behalf of, and in the name of, the Customer’s business.

6. AI processing

To analyze reviews and messages and to draft replies, the Service sends the relevant text to an AI model provider through its programming interface (currently Anthropic). The provider processes the text to return results such as sentiment, topic and priority tags, summaries and draft replies, and under its commercial API terms does not use that content to train its models. Results are stored with the related review or message. Replies to Google reviews are published only when a member of the Customer’s team publishes them.

7. Who we share information with

We share information only with service providers that help us run the Service, and as described in Section 4 and below. Our current providers are:

We may also disclose information when required by law or to protect rights and safety, and in connection with a merger, acquisition or sale of assets (we will give notice to affected users). We may share information with your consent.

8. Retention and deletion

We keep a Customer’s data while its account is active. When an account ends, or when we receive a verified deletion request, we delete the related data from our live systems within 30 days unless the law requires us to keep it. Copies in provider backups are overwritten on the provider’s normal rotation schedule. Access tokens are deleted promptly when a connection is removed. See how to request deletion.

9. Security

We protect information with encryption in transit (HTTPS/TLS), encryption at rest provided by our infrastructure providers, database-level isolation between Customers (row-level security), least-privilege access, and server-side-only storage of access tokens. No system is perfectly secure; if a breach affects your information we will notify you as the law requires.

10. Your choices and rights

• Revoke Google access at any time at myaccount.google.com/permissions, or ask us to disconnect it.
• Disconnect Meta accounts in the Customer’s Meta Business settings, or ask us to disconnect them.
• Access, correct or delete your information by emailing contact@synacuity.com or using the steps on our data deletion page.
• Regional rights. Depending on where you live (for example the EEA, the UK, California or Texas) you may have rights to access, correct, delete, port or object to the processing of your personal information. We respond to verified requests within the time the law allows and do not discriminate against anyone for exercising these rights.
• Guests and reviewers. A Google review is public on Google. To change or remove a review you wrote, use Google. For information a business holds about you in the Service, contact that business or us and we will route the request.

11. International processing

Synacuity is based in the United States, and our service providers process data in the United States and other countries. If you use the Service from outside the United States, your information will be transferred to and processed in those countries.

12. Children

The Service is for businesses and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us and we will delete it.

13. Changes to this policy

We will post updates on this page and change the effective date above. For material changes we will also notify account holders by email or in the Service.

14. Contact us