Privacy notice
This notice explains what personal information Syrozen collects through syrozen.com and through our software, Syrozen CRM, Syrozen Mail and Syrozen Sign (together, "the Service"), why, who else handles it, how long we keep it, and your rights. We collect as little as we can and never sell personal information.
Who we are
Syrozen is a trading name of [full legal name], a sole proprietor at [physical address], Centurion, Gauteng, South Africa. Our Information Officer is [full legal name]. For anything in this notice, email [email protected].
We are the responsible party (under South Africa's Protection of Personal Information Act, POPIA) and the controller (under the EU and UK GDPR) for information about visitors, people who contact us, and the people who use and pay for the Service. For information our customers put into the Service about their own customers and contacts, the customer is the responsible party and we are their operator (processor): we handle it only to provide the Service, as set out in section 6 of our terms.
What we collect
When you visit syrozen.com
Our hosting provider receives the technical information needed to deliver pages and protect the site, such as your IP address, browser type and the pages requested. The public website sets no cookies and runs no analytics, advertising trackers or third-party embeds.
When you send a project brief
Your name, email address, optional company name, the type of project and your message. Please don't include passwords, confidential business information or sensitive personal information.
When you use the Service
- Your account: your name and email address, and if you add them, a job title and profile photo. Which boards you can open and your role on each.
- Signing in: your email address and a one-time code we email you. Signing in sets one cookie that keeps you signed in. It is strictly necessary and is not used for tracking. The apps also remember a few preferences in your browser, such as the board you last opened.
- What you and your team put in: tickets, customers, contacts, deals, notes and automations, which can include names, email addresses and phone numbers of your customers.
- Email: messages sent to your company's @syrozen.com addresses, or to a Gmail or Outlook mailbox you connect, including attachments, and messages you send from the Service.
- Email signatures: the details shown in signatures (name, job title, phone and company details) and any logo or profile photo uploaded for them. Pictures are made smaller and saved again before upload, which removes hidden details such as where a photo was taken. Logos and photos can be opened by anyone who has their link, because the people receiving your email must be able to see them.
- Connected mailboxes: if you connect Gmail or Outlook, a sign-in token that lets the Service read and send email for that mailbox. It stays on our servers and is never sent to your browser.
- Billing: the account owner's name and email, the company name, plan, number of seats, amounts paid and payment references. Card details go directly to Paystack; we never see or store your full card number.
Why we use it
- To provide the Service you signed up for, take payment and send service messages such as sign-in codes and billing notices (performance of a contract: POPIA section 11(1)(b); GDPR article 6(1)(b)).
- To reply to enquiries and prepare proposals you asked for (the same basis).
- To keep the site and the Service secure, prevent fraud and fix problems (legitimate interest: POPIA section 11(1)(f); GDPR article 6(1)(f)).
- To keep financial records as tax law requires (legal obligation: POPIA section 11(1)(c); GDPR article 6(1)(c)).
We will not send you marketing unless you ask for it. We do not use the content of your email or records for advertising or to train AI models. Nobody at Syrozen reads it unless you ask us to for support, it is needed to investigate a security problem, or the law requires it.
Syrozen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The same applies to information from Microsoft.
Who else handles it
We use these service providers (operators or sub-processors). Each handles information only on our instructions and under data protection terms:
- Cloudflare, Inc. (United States, global network): hosts the website and the Service, stores its database and file attachments, handles sign-in and one-time codes, and receives email for @syrozen.com addresses.
- Paystack (a Stripe company): processes subscription payments and stores card details.
- Web3Forms (India, using Amazon Web Services, Cloudflare and Hetzner): receives the website contact form. To filter spam, it may pass the sender's IP address and email to CleanTalk or Akismet.
- Email delivery: when sending from @syrozen.com addresses is switched on, outgoing email goes through Cloudflare or another email delivery provider we use.
- Google LLC and Microsoft Corporation: only when you connect a Gmail or Outlook mailbox, under your own agreement with them.
We may also disclose information where the law requires it.
Transfers outside South Africa
Most of these providers store or process information outside South Africa. We only use providers bound by data protection terms that give protection comparable to POPIA (and, for the EU and UK, Standard Contractual Clauses). The transfers are also necessary to provide the Service you signed up for (POPIA section 72).
How long we keep it
- Enquiries that don't lead to work: deleted within 12 months of our last contact.
- Service data and email: kept while the account is active, and until you or your team delete it. When an account ends, it stays available for export for 30 days and is then deleted within a further 30 days.
- Database recovery copies: our database provider keeps point-in-time recovery copies for up to 30 days, after which deleted data is gone for good.
- Signature photos: deleted as soon as you remove them. A replaced photo is deleted 90 days after it was replaced, so emails already sent can still show it.
- Billing records: kept for 5 years, as South African tax law requires.
- Hosting and security logs: kept by Cloudflare for short periods and not used by us to identify visitors.
How we protect it
- Everything is served over HTTPS only, with strict browser security rules.
- Signing in needs a one-time code sent to your email. The server checks every request and only returns the boards each person has been given.
- The database and file storage are encrypted at rest by our hosting provider.
- Mailbox tokens and payment keys stay on the server, and payment notices are checked for a valid signature before they change anything.
- Our own admin accounts use multi-factor authentication, and access is limited to the people who need it.
If a security compromise affects your information, we will notify you and the Information Regulator as POPIA section 22 requires. If it affects information we hold for a customer as their operator, we will notify that customer so they can act.
Your rights
You can ask us to confirm what personal information we hold about you, give you a copy, correct it, delete it, or stop using it, and you can object to how we use it. Email [email protected] and we will respond within 30 days. We may need to confirm your identity first. If your information was added to the Service by one of our customers (for example, you emailed a company that uses Syrozen CRM), we will pass your request to that customer, as they decide how it is used.
If you're unhappy with how we handled your information, you can complain to South Africa's Information Regulator (inforegulator.org.za). In the EU or UK, you can also contact your local data protection authority.
Health information
The Service is not designed for health records or other special personal information, and is not certified under the US HIPAA law. Please don't store that kind of information in it.
Children
The site and the Service are for businesses and adults. We do not knowingly collect information from anyone under 18. If you believe a child has sent us information, contact us and we will delete it.
Changes
If we change this notice, we will update the date at the top. We will email account owners about significant changes before they take effect.