Privacy Policy

Updated: October 14, 2026

Draft — not approved for production. Before launch, the operator must supply its legal name, address, privacy contact, any applicable data protection officer, actual service providers, transfer safeguards and retention periods. These required details have not yet been fully published.

Controller and contact

The controller is the operator of Symph. Its required identification and contact details are still missing. Once published, privacy requests can be addressed to that contact. This page does not replace missing operator information.

Website and browser storage

The infrastructure processes connection information such as IP addresses, timestamps and requested resources to deliver the site and prevent abuse. The operator must identify hosting providers, locations, logging scope and deletion periods. Article 6(1)(f) GDPR may support secure operation; actual legitimate interests and balancing assessments must be documented.

Sign-in requires session cookies. Language, appearance and navigation preferences may be saved in the browser. Strictly necessary storage may rely on section 25(2) TDDDG; other access may require prior consent. The operator must confirm the classification of the features actually enabled.

Optional analytics is disabled by default. When a provider requiring consent is enabled, it must start only after consent. Acceptance or rejection is saved for 30 days. “Privacy settings” in the footer allows the decision to be changed or consent withdrawn for future processing. Actual providers, purposes, data, recipients and storage periods must be listed here before activation.

Account, authentication and organizations

Processing includes name, email, verification status, selected sign-in methods, an optional profile image, language, sessions and security information. Passwords are stored as hashes. Private passkey material remains with the device or chosen provider. Two-factor authentication may require additional security information.

Requested account and product functions serve contract performance or pre-contractual steps under Article 6(1)(b) GDPR. Abuse prevention may rely on Article 6(1)(f). Regular sessions last up to 30 days and may be revoked earlier. This is not a general retention period for account data.

Choosing Google or GitHub sign-in exchanges required identifiers and profile data with the selected provider. External profile images may create additional requests to the image provider. The operator must identify enabled providers and their privacy information before launch.

Organization members see shared content and directory information according to their roles. Personal preferences and notifications remain user-specific. Global administrators manage accounts; signing in as another user is disabled.

External services and international transfers

Depending on enabled functions, the application provides these data flows:

  • Email: Resend receives recipient addresses and required message data for verification, password resets and requested notifications.
  • Payments: Stripe processes checkout, subscriptions and customer portal interactions. The application stores associated customer, purchase and subscription identifiers. Manual workspace plan selection currently does not initiate payment.
  • AI chat: Requested chat messages are sent to OpenAI. The history is not saved in the application database. Provider processing and retention require separate verification.
  • Video generation: Requested generation sends product information and selected images to BytePlus. Product imports retrieve the specified public page and images on the server. Result link expiry does not establish comprehensive data deletion.
  • Social accounts: Connecting Instagram or TikTok processes account identifiers, display names, profile images, scopes and expiry information. Access tokens are encrypted in backend storage. Authorized organization managers can disconnect accounts.
  • Storage and workflows: Profile images, logos and reminder workflows may use the infrastructure chosen by the operator.

Only submit confidential information or third-party personal data with appropriate authorization and a lawful basis. Actual providers, contracting entities, locations, subprocessors and processing agreements under Article 28 GDPR must be identified. Transfers outside the EEA require a documented basis under Articles 44 onwards and any necessary supplementary measures. This draft does not promise a particular processing region or sufficient transfer safeguards.

The currently unconnected contact form does not send or store entries and does not claim successful delivery.

Retention, deletion and your rights

Account deletion removes associated application account data, sessions and its assigned uploaded profile image. Shared organization content may remain for other members, with creator references removed where applicable. Organization deletion affects related application data and its assigned uploaded logo. External providers, backups and legal retention obligations require separate treatment.

A complete retention schedule, an access and data provision procedure and processes for external providers and backups must be established before production. Automatic comprehensive deletion at every provider is not claimed.

Subject to applicable conditions, rights include access, correction, erasure, restriction, portability, objection and consent withdrawal. Requests can be sent to the privacy contact that must still be published. You may also complain to a competent supervisory authority; the appropriate authority depends on the operator and its establishment.

Sources: GDPR, BDSG and section 25 TDDDG.