Privacy Policy

This policy explains what personal data we process when you use syntransfer.ro, why, how long we keep it and what rights you have under Regulation (EU) 2016/679 (GDPR).

1. Data controller

SYNAPTIC SYSTEMS SRL, with its registered office at Str. Puțul cu Plopi nr. 18, Sector 1, Bucharest, Romania, and its place of business at Str. Colonel Corneliu Popeia nr. 37, Sector 5, Bucharest, Trade Register no. J2008004760405, tax ID RO 23504970, is the controller of the data processed through syntransfer.ro.

For any question or request about your data: office@syntransfer.ro.

2. In short

• All data, including files, is stored on our own servers in Romania. Emails are sent through our own mail servers.
• We do not sell data, we do not show ads and we do not use tracking or analytics cookies.
• End-to-end encrypted transfers cannot be read by us.
• Files are deleted automatically when they expire, and you can delete your account yourself at any time from your account page.

3. What data we process

• Account data: name, email address, password (stored only in an irreversible cryptographic form), preferred language, security settings (two-step verification) and, if you sign in with Google or Microsoft, the identifier of that account.
• Order and billing data: name, address, phone number, country; for companies: company name, tax ID, Trade Register number and, optionally, IBAN; the chosen plan, the amounts and the subscription history.
• Payment data: card payments are processed by Stripe; we only receive the payment confirmation and the Stripe customer and subscription identifiers, not your card details.
• Transfers: the files, their names and size, the sender’s email, the recipients’ emails, the message and any voice message, the transfer settings (expiry, password stored in cryptographic form, download limit) and download statistics (date, IP address).
• SynBox, shop and file requests: stored files and the activity log (uploads, downloads, deletions), shop profile and product data, and the name and email of people who send you files through requests.
• Teams: the names and emails of members invited by the subscription holder.
• Security and technical data: IP address, browser, operating system and device type when you sign in; the IP address for transfers without an account (for visitor limits) and for messages sent through the contact form.
• Messages to us: the content of messages sent through the contact form or by email.

About transfer recipients. When you send files to someone, you give us their email address. We use it only to send them the notification about the files. Please send files only to people who expect to receive them.

4. End-to-end encryption

In end-to-end mode (E2EE), files are encrypted in your browser before upload and the key never reaches us. We cannot see the content of these files. We only see the technical data needed for the service to work: size, date and expiry. Features that need the content (previews, watermarking) use regular transfers, which are encrypted in transit (HTTPS) but can be processed by our servers to generate the previews.

5. Why we process data and on what legal basis

• Providing the service – the account, transfers, SynBox, the shop, teams, subscriptions and the related emails (for example confirmations, authentication codes, payment reminders): performance of the contract, Art. 6(1)(b) GDPR.
• Invoicing and accounting records: legal obligation, Art. 6(1)(c) GDPR.
• Security and abuse prevention – the sign-in log, visitor limits, investigating reports of illegal content: our legitimate interest in protecting the service and its users, Art. 6(1)(f) GDPR.
• Replying to your messages: legitimate interest or, where applicable, performance of the contract.
• Defending our rights in any disputes: legitimate interest.

We do not send newsletters and we do not use data for marketing. We do not take decisions based solely on automated processing that produce legal effects concerning you. The only automated actions are those provided for in the terms of service, for example suspending an account for non-payment, of which you are notified in advance.

6. How long we keep data

• Transfers: until the chosen expiry date, after which they are deleted automatically.
• Account, SynBox and shop: for as long as the account exists. When the account is deleted, they are deleted immediately. When a subscription ends or is not paid, data exceeding the Free plan is deleted after the periods set out in the Terms and conditions.
• Billing documents: for the period required by accounting and tax law (generally between 5 and 10 years).
• Security data (sign-in log, IP addresses): no longer than 12 months.
• Messages sent through the contact form: as long as needed to reply, then no longer than 12 months.

7. Who we share data with

Data is stored on our own servers in Romania. We only share it in the following situations:

• Stripe (Stripe Payments Europe Ltd., Ireland), for card payments. Stripe processes payment data as an independent controller, under its own privacy policy.
• Google and Microsoft, only if you choose to sign in with their account. In that case we receive your name, email address and account identifier from them.
• Public registers: when you order as a company, we check the tax ID with the Romanian tax authority (ANAF) or, for companies in other EU Member States, in the European Commission’s VIES system.
• Public authorities (for example tax authorities, criminal investigation bodies, courts), only when the law requires us to.
• Transfer recipients receive your name or email, the message and the files you choose to send them.

We do not sell or rent your data.

8. Transfers outside the EU

Stripe, Google and Microsoft may transfer certain data to the United States. These transfers are based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the Commission.

9. Cookies

We only use cookies that are necessary for the site to work. We do not use analytics, advertising or tracking cookies, which is why we do not ask for your consent through a banner.

Cookie	Purpose	Duration
session cookie (PHPSESSID)	keeps you signed in and protects forms	until the browser is closed
remember_token	keeps you signed in, only if you tick “remember me”	30 days
lang	remembers the language chosen for the site	1 year

10. How we protect data

We use encrypted connections (HTTPS/TLS), passwords stored with irreversible cryptographic algorithms, two-step verification, optional end-to-end encryption, restricted access to servers and our own infrastructure in Romania. No measure can guarantee absolute security, but if a personal data breach occurs that puts your rights at risk, we will notify you as required by law.

11. Your rights

You have the right:

• to find out what data we process about you and to receive a copy (right of access);
• to correct inaccurate data (right to rectification); you can change your name and language directly in your account;
• to request deletion of your data (right to be forgotten); you can delete your account directly from your account page;
• to request restriction of processing;
• to receive your data in a structured format and transmit it to another controller (right to data portability);
• to object to processing based on our legitimate interest.

To exercise your rights, write to us at office@syntransfer.ro. We reply within one month; in complex cases this may be extended by two further months, in which case we will let you know. For your safety, we may ask you to confirm your identity.

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or with the data protection authority of the country where you live.

12. Children

The service is not intended for persons under 16 and we do not knowingly process their data. If you become aware that a child under 16 has created an account, please write to us and we will delete it.

13. Changes

We may update this policy. We will inform you of important changes by email or by a visible notice on the site. The date of the last update is shown at the top of the page.

14. Language

This policy is available in several languages. This is a translation; in case of any discrepancy, the Romanian version prevails.