Your data
What we do with your data
A short, plain summary. The full details are in our Privacy Notice, Cloud Service Terms and Data Processing Agreement. If anything here differs from them, those documents apply.
The short version
- Your files are yours. We store them for you and don’t use them for anything else.
- We don’t sell personal data, and we don’t use it for advertising.
- We don’t open your files unless you share them with us, for example in a support ticket, or the law requires it.
- You can download your files at any time, including when you leave: a whole cloud at once, with a checklist of every file. See Leaving SynCore.
What we hold, why, and for how long
| What | Why | How long |
|---|---|---|
| Your files | To store them and give them back to you, and to the people you share them with. | Until you delete them. Deleted files stay in the trash for 30 days. When a cloud closes, it stays read-only for at least 30 days so you can download everything; after that we may delete it, and we tell you first. |
| Private vault files | Stored encrypted, to give them back to you. We hold only the encrypted files and names, and locked keys we can’t open without your passphrase or recovery key. | Same as your other files: until you delete them, then 30 days in the vault trash. |
| Your account | Name, email address, password (only as a one-way hash), two-step sign-in settings and preferences, to run your account. | While your account is open, and up to 2 years after it closes. |
| Billing records | Invoices, payments, billing address and tax details, because the law requires us to keep accounts. | 7 years after the end of the financial year they belong to. |
| Identity and eligibility checks | Where we ask for them: details that confirm who you are and where you are based, and sanctions screening results, so we only serve people we’re allowed to serve. | We keep these records after an account closes, because the law requires checks to be kept. We’ll publish the exact period once our advisers have confirmed it. |
| Support conversations | Tickets and messages you send us, to help you. | While your account is open, and up to 2 years after it closes. |
| Security and activity records | Sign-ins, IP addresses and a record of actions in your account, to keep it secure. | 7 years. Ended sessions and used sign-in links: about 30 days. |
| Assistant chats | Questions you ask the SynCore assistant, to answer them. | Deleted after 90 days without activity. |
Where it is kept
Your files are kept in the European Union, or in the United States if you choose, using our storage provider’s data-location controls. You choose when you order a cloud, and it can’t be moved by mistake later. Clouds opened before this choice existed stay in our earlier storage in Western Europe, and each cloud’s page shows where its files are kept. Our application and database run on servers in the European Economic Area. The companies that help us run the service, and where they work, are listed on our Subprocessors page.
Who can see it
- You, and the people you invite to your account or share files with.
- The people who deliver our services, only as far as their work needs. Every staff action is written to a record that can’t be edited or deleted.
- The companies on our Subprocessors page, only to run the service for us, under contracts that protect the data.
- Authorities, only where the law requires it (see below).
Requests from authorities
We only hand over customer data when we are legally required to. We check every request, and we tell the customer before we act unless the law doesn’t allow us to. We will count these requests in our twice-yearly transparency report.
Your choices and rights
- Download your files and folders at any time from your account, or everything at once with “Download everything”.
- Ask for a copy of your personal data, or to correct or delete it, by writing to privacy@syncoretech.net. We reply within one month. Some records, such as invoices, must be kept by law.
- You can complain to the data protection authority of the country where we are incorporated (named in our Privacy Notice), or to the data protection authority where you live.