Privacy Policy

Who is responsible

ReSynapse is the controller for your account and for running senlo. Contact support@senlo.dev about anything in this policy.

Mail, calendars and files belong to a workspace. For the people who appear in them, such as senders and recipients, the workspace owner decides how that content is used. We process it on the workspace owner's behalf. If you are one of those people, contact the workspace owner first; we will help them answer you.

What we store

• Account details: your name, email address, a hash of your password, two-factor settings, hashed recovery codes and which version of these terms you accepted.
• Sessions: the browser or app you signed in with and its IP address, used to protect your account.
• Workspace content: messages you send and receive, including original copies and attachments, drafts, categories, calendar events, task requests and Drive files.
• Connections: Notion and agent authorizations you approve. Their access tokens are encrypted.
• Domain purchases: registrant contact details. We clear our copy once registration finishes or fails; Cloudflare Registrar and the domain registry keep them while the domain is registered, with public WHOIS redacted.
• Diagnostics: error reports and service logs. They exclude message content, email addresses, passwords and tokens.

Why we use it

• To provide the service you signed up for: deliver, store, search and show your mail, calendar and files, and categorise mail and extract details you can reuse. Legal basis: our contract with you.
• To keep accounts and the service safe: verification, two-factor authentication, rate limits, sending limits, bot checks and abuse handling. Legal basis: our legitimate interest in a secure service that strangers cannot misuse.
• To keep records the law requires and answer lawful requests from authorities. Legal basis: legal obligation.
• To answer you when you contact us. Legal basis: our contract with you, or our legitimate interest in answering.

We do not sell your data, show ads, profile you or use your mail to train AI models.

AI processing

Message subjects and text are sent to Cloudflare Workers AI to choose categories, spot spam and extract details. Categorisation uses a bounded text excerpt and your category names and descriptions. Detail extraction uses complete text only when it fits the input limit. Attachments are not sent. Requests pass through a gateway that keeps no copy of prompts or replies. Results are stored with the message and can be changed by you. Mail judged to be spam moves to Spam, where you can mark it Not spam before it is deleted. No decision with legal or similar effect is made automatically.

Workspace owners and admins can turn AI for mail off in Team. After that, no message text is sent to AI: new mail is not categorised, spam is caught only by blocked-sender and flood rules, detail extraction stops, and forwarding rules that need a category or details send no copy.

Who processes it

• Cloudflare: hosting, database, file storage, email routing and sending, AI models, bot checks and domain registration. Cloudflare processes data for us under its data processing addendum.
• Polar: payments, as merchant of record. We send your workspace name and ID, and your email address for domain orders. Card and billing details go to Polar, not to us, and Polar is responsible for its own handling of payment data.
• Notion: only when you connect it, and only the data needed for the actions you review. Its own privacy terms apply to data you send it.
• AI assistants you connect, such as ChatGPT or Claude: only the mail, calendar and files the permissions you approved cover, when the assistant asks. Their provider's privacy policy covers what they receive. Disconnect them in Agents.
• Forwarding destinations: when workspace admins set up forwarding, complete copies of matching mail go to the addresses they verified.
• Your organisation's single sign-on provider, if your workspace uses one: your email address and sign-in requests.
• People in your workspace: everyone in a workspace can read its mail, calendar and shared files.

We disclose data to authorities only when the law requires it, and only what the request covers.

Where it is stored

The database and stored files are kept in Cloudflare's Western Europe region. Cloudflare serves requests, sends mail and runs AI models across its global network, so some processing can happen outside the European Economic Area. Those transfers are covered by the EU Standard Contractual Clauses in Cloudflare's data processing addendum and its certification under the EU-U.S. Data Privacy Framework.

How long we keep it

• Mail and files: until you delete them or their workspace.
• Trash: deleted forever 30 days after a message is moved there. Spam: deleted forever 30 days after a message arrives there. Drive Trash: deleted forever after 30 days.
• Account: until you delete it. Deleting your account removes workspaces where you are the only member and signs out every session.
• Sessions: deleted 30 days after they expire or at once when you sign out.
• Service logs: deleted after 7 days.
• Sending records: kept so sending limits keep working. Recipients and subject are removed when the message is deleted, and the record goes 7 days after sending once the message is deleted forever.
• Invitations: the invitee's email address is deleted 30 days after an invitation is answered, cancelled or expires, and at once when that account is deleted.
• Imported originals: kept with the import record until the workspace is deleted, so a repeated import does not bring back mail you deleted.
• Backups: deleted data leaves every encrypted backup within 35 days. If we ever restore a backup, anything deleted after it was taken is deleted again.

Security and encryption

Connections use HTTPS. Two-factor authentication is optional and encouraged; once set up, it is required at every sign-in. Messages open without loading remote images or trackers. If you choose Show images on a message, its images load directly from the sender’s servers, which can then see that the message was opened, when, and from which IP address.

Cloudflare encrypts stored data using keys it manages. Mail is not end-to-end encrypted: the service processes readable messages for delivery, search and AI features. Operators with privileged infrastructure access can read stored mail and files.

When browser storage is available, unfinished drafts are kept in this browser tab, and calendar events still being saved are kept in this browser, for recovery. This local copy is not separately encrypted. Signing out or deleting your account clears it from this device.

Cookies

We use only the cookies needed to keep you signed in and protect your session. There are no advertising or analytics cookies.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.

• Download your account, sessions, workspaces and this workspace's calendar, tasks, categories and settings from Account security → Your data. Export your mail from Mail transfer.
• Change your name in Account security.
• Delete messages forever from Trash, or delete your account from Account security.
• Disconnect apps and revoke agents at any time.
• For anything else, contact support@senlo.dev. We answer within one month and may ask you to confirm the request from your signed-in account.

You can also complain to your local data protection authority. We would rather hear from you first, so we can try to fix it.

Changes

We will announce material changes in the app or by email before they take effect.