Sinrix

Legal

Privacy Policy

What personal data Sinrix handles, why, who sees it, how long it is kept and the rights you have.

Last updated

On this page

The short version

  • For your account and billing, Sinrix decides how your data is used. For what is inside your brand, your business decides, and we handle it on its behalf.
  • We collect only what it takes to run your account, your brands and your billing. The site runs no analytics or advertising scripts, and we do not sell personal data.
  • Your brand's content is kept in its own database and files, apart from every other brand's, and we never use it to train AI models.
  • We share data only with the providers that run Sinrix, each named on the Subprocessors page.
  • You can see, correct, export or delete your data. Write to privacy@sinrix.com.

1. Who we are and what this covers

Sinrix ("Sinrix", "we", "us") runs sinrix.com, where businesses create brands, each with its own database and files, kept apart from every other brand's, running a co-founder and agent teams. This policy explains what personal data we handle, why, who sees it and the choices you have.

We handle personal data in two roles:

  • As the controller for the data we need to run Sinrix itself: your account, your sign-ins, your billing, our emails to you, and visits to our website. This policy covers that data in full.
  • As a processor for the data inside your brands: the chats, files, knowledge and connected apps your people and agents work with. Your business is the controller of that data and decides what goes in and why; we handle it only to run your brand, under the Data Processing Addendum. Section 3 says how.

2. What we collect

Your account

  • Your name, email address and, if you set one, your password, which we keep only as a one-way hash.
  • The six-digit codes we email you to confirm your address or sign in. We keep them hashed, and each works for ten minutes.
  • If you sign in with Google: your Google account's name, email address and account ID. We receive nothing else from Google for signing in.

Sign-ins and security

  • For each signed-in session, the IP address and the browser it came from, so you can see your sessions on your Account page and end any you do not recognize.
  • Records of sign-in attempts, which we use to limit repeated tries and to spot abuse.

Your brands and billing

  • Each brand's name, address, plan, status and the history of what happened to it (created, paid, paused, updated and so on).
  • Your Stripe customer and subscription, invoices, the credit you buy and your automatic top-up settings. Your card details are held by Stripe; we never see them.
  • How much AI each brand used each day: which model, how many requests, how many tokens and web searches, and what they cost. Not what was asked or answered.

When you contact us, or read our blog

  • Messages you send us, and our replies.
  • If you sign up for our newsletter: your email address, the page you signed up on, and when you confirmed or unsubscribed.
  • We count how many times each blog post is read each day. That count carries no cookie and nothing that identifies you.
  • Our servers keep short-lived logs of requests, including IP addresses, to keep Sinrix running and secure.

3. The data inside your brand

In short: It lives in your brand's own database and files, kept apart from every other brand's. We handle it only to run your brand, for your business, and never to train AI models.

A brand holds what its people and agents work with: chats, files, the knowledge it reads (your website and documents), what it remembers of people's preferences, routines, approvals and the record of what was done, the names, email addresses and roles of the people you invite, and the data agents read from or send to the apps you connect. It is kept in the brand's own database and files, apart from every other brand's. Brands share the machines and the database server they run on, and are separated by each brand's own database, database role, storage volume and containers. A backup is taken every 24 hours and kept for 14 days with the brand, and a copy is stored away from the server the brand runs on. Backups are restored by our team, not from inside the brand.

  • AI requests. To do their work, your brand's agents send what a request needs (the conversation, and any files or pages it uses) to an AI model. On the AI usage we provide, those requests pass through our connection service, which sends them on to our model provider and counts the usage, without keeping what was asked or answered. On your own model key, they go straight to your provider.
  • Connected apps. When someone connects an app, the sign-in is held by Composio for your brand, and your agents read from and act in the app within the access that person granted. For apps that Sinrix itself provides a connection to, we hold the sign-in, encrypted, and your brand never sees it.
  • Our access. We do not look inside brands as a matter of course. We may sign in as a brand's owner for up to 60 minutes to help or to look into a problem, which every page shows to the person signed in and which each of the owner's brands records on its timeline, and we keep an emergency key to restore a brand that cannot be reached any other way.

4. Why we use it, and on what legal basis

Where the GDPR or UK GDPR applies, we rely on these legal bases for the data we control:

  • What we do
    Create and run your account and brands
    Data
    Account, brands, sessions
    Legal basis
    Performing our contract with you
  • What we do
    Take payment, keep invoices and meet tax law
    Data
    Billing, AI usage records
    Legal basis
    Contract, and legal obligation
  • What we do
    Send codes, receipts and notices about your account and brands
    Data
    Email address
    Legal basis
    Contract
  • What we do
    Keep Sinrix secure and prevent abuse and fraud
    Data
    Sessions, sign-in attempts, logs
    Legal basis
    Our legitimate interest in a safe service
  • What we do
    Answer you when you write to us
    Data
    Messages
    Legal basis
    Contract, or our legitimate interest
  • What we do
    Send the newsletter
    Data
    Newsletter address
    Legal basis
    Your consent, which you can withdraw any time
  • What we do
    Understand how Sinrix is used, from totals, to improve it
    Data
    AI usage records, read counts
    Legal basis
    Our legitimate interest in improving Sinrix
  • What we do
    Meet legal requests and protect our rights
    Data
    What a request concerns
    Legal basis
    Legal obligation, or our legitimate interest

We do not make decisions about you by automated means that have legal or similarly significant effects on you.

5. AI and your data

  • We do not use your content, or anything inside your brands, to train AI models, ours or anyone else's.
  • Our model provider receives requests to answer them, and under its commercial terms does not train its models on them. It keeps them only as its terms allow, for example to check for abuse.
  • Agents' web searches go through our model provider. The pages agents read are fetched by your brand itself.

6. Google user data

When you sign in with Google, we receive your name, email address and Google account ID, and use them only to sign you in.

When someone connects a Google app (such as Gmail or Google Calendar) to a brand, that brand's agents use the data only to do the work the brand's people ask of them, within the access shown on Google's consent screen. Sinrix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to develop, improve or train generalized AI or machine learning models, and no person reads it unless the user asks us to, it is needed for security, or the law requires it.

7. Who we share it with

  • The providers that run Sinrix, each limited to its purpose and bound by contract: they are named, with what they do and what they see, on the Subprocessors page. The providers that host our own website and database and deliver our email are bound the same way.
  • Google, when you choose to sign in with it, under Google's own privacy policy.
  • Professional advisers, such as lawyers and accountants, under a duty of confidence.
  • Authorities, when the law requires it, and only what it requires.
  • A buyer or successor, if Sinrix is merged, acquired or sold, under this policy or one at least as protective, and we will tell you.

We do not sell personal data, and we do not share it for advertising across other companies' sites and apps.

8. International transfers

Our providers may handle data in countries other than yours. Where the GDPR or UK GDPR applies and data leaves the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses, the UK addendum to them, or another lawful mechanism, with the protections they require.

9. How long we keep it

  • Data
    Your account
    Kept
    While it is open, and deleted within 30 days of your asking us to close it
  • Data
    A brand and everything in it, backups included
    Kept
    Until 30 days after its subscription ends, then deleted
  • Data
    Sign-in codes
    Kept
    Ten minutes
  • Data
    Signed-in sessions
    Kept
    Until you sign out or they expire, after seven days without use
  • Data
    Invoices, payments and AI usage records
    Kept
    As long as tax and accounting law requires
  • Data
    Newsletter address
    Kept
    Until you unsubscribe, then kept only as unsubscribed, so we never email it again, unless you ask us to delete it
  • Data
    Request logs
    Kept
    Only as long as needed to run and secure Sinrix

10. How we protect it

  • Sinrix, your brand's pages and the service your brand calls us through all use HTTPS.
  • Each brand has its own database, database role, storage volume and containers, kept apart from every other brand's, and holds only its own credentials, never another brand's. Brands share the machines they run on, so this separation is by database, role and container rather than by machine.
  • Passwords and sign-in codes are stored hashed. Secrets we hold for brands, such as app sign-ins, are encrypted with keys kept apart from the data.
  • Access within Sinrix is limited to the people who need it, and support sessions are time-limited and recorded on the brand's timeline, which its owner sees.

No service is perfectly secure. If we learn of a breach affecting your personal data, we tell you without undue delay, as the law requires. Report a security problem to legal@sinrix.com.

11. Your rights

Depending on where you live, you may have the right to see the personal data we hold about you, correct it, delete it, receive a copy to take elsewhere, object to or restrict how we use it, and withdraw consent you gave. Where the GDPR or UK GDPR applies, you may also complain to your data protection authority, though we would like the chance to help first.

Residents of California and other US states with privacy laws have the right to know what we collect and why, to delete and correct it, and to opt out of its sale or sharing for targeted advertising. We do neither. We will not treat you differently for using your rights.

To use any of these rights, write to privacy@sinrix.com. We may need to confirm it is you, and we answer within one month, or sooner where the law requires. For data inside a brand, ask that brand's business, which decides about it; we help it answer.

12. Cookies

We use only the cookies Sinrix needs to work, such as the one that keeps you signed in. No advertising or analytics cookies. The Cookie Policy lists each one.

13. If a brand's agents contacted you

A business that uses Sinrix may have its agents email or message you. That business decides what is sent and why, and is responsible for your data in it; contact it to use your rights. If you cannot reach it, write to privacy@sinrix.com and we will pass your request on.

14. Children

Sinrix is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, write to privacy@sinrix.com and we will delete it.

15. Changes to this policy

When we change this policy, we update the date at the top of this page. For a material change, we also email account owners before it applies.

16. Contact

Questions or requests about privacy: privacy@sinrix.com.

Other policies