Syntra Social ("we", "our", "the app") is a social media management and AI customer support platform. A user ("workspace owner" or "account holder") can connect their own social media, messaging, email, voice, and website chat channels, publish content, manage engagement, and optionally have an AI Agent answer customer questions - grounded in a knowledge base, a product/order catalog, and a bookable services list they configure - from one dashboard. This policy explains what data we collect, why, and what happens to it.
A few kinds of people interact with this data:
When you connect Facebook, Instagram, X, LinkedIn, TikTok, YouTube, or WhatsApp, we store:
If you connect a mailbox, a phone number for SMS, or a phone number for voice calls, we store:
If you embed our website chat widget, we store the messages exchanged with your site's visitors, a randomly generated visitor ID (not directly linked to a real name or email unless the visitor provides one in chat), and any name/contact/email/message they submit through a "Book Now" form (see Services & bookings below).
If you connect a Shopify, WooCommerce, or OpenCart store so your AI Agent can answer product/order questions, we store:
If you upload a services CSV (for bookable, non-catalog services), we store each service's category, name, description, availability text, and the vendor email you specify for it. If you use the booking calendar feature, we also store the specific time slots you've made available and how many bookings each one has (no personal data in a slot itself - just a date, time, and count).
You can also add your own custom fields to your booking form and/or product order form (e.g. to ask for a delivery instruction, a national ID number, or anything else specific to your business) and choose which are required. Whatever a customer enters into those fields is stored against their order or booking, displayed to you the same way as the built-in fields, and - for bookings - included in the vendor-notification email described below. Because you control what these custom fields ask for, please avoid collecting more sensitive personal data through them than your business genuinely needs, and make sure your own use of that data complies with the law that applies to you.
To help you see a single person's full history instead of disconnected per-channel threads, we automatically match and consolidate contact information whenever you learn it - specifically, whenever a lead is captured or a booking is made, we look for an existing record with the same email or phone number in your workspace, and either link to it or create a new one. This means a customer profile may combine information from multiple conversations, channels, or dates once they share the same email or phone number with you more than once. This matching is exact (same email or same phone number) - we don't use fuzzy name-matching or any other inference. You can view, search, and access this consolidated data from the Customers page.
If you choose to send a broadcast email through the Campaigns feature, we use the email addresses already on file from your captured leads and/or unified customer profiles (see above) to send the message you compose. We do not maintain a separate marketing list beyond this, and campaign emails are only sent when you explicitly create and send one - nothing is sent automatically. Recipients did not separately opt in to marketing email beyond providing their contact details to your business through a lead or booking; if a recipient contacts you to stop receiving these, please honor that request going forward.
When a customer submits a booking request (via the website chat widget's "Book Now" form, or by providing their details in conversation on another channel), we store their name, contact number, email, and message, and email that information to the vendor_email address you configured for that service (plus your own notification email, if set, in CC). This is one of the few places in the app where an end user's contact details are, by design, sent to a party outside Syntra Social and outside the platforms they messaged you on - because that's the explicit purpose of the booking form. If the service uses the booking calendar, the specific time slot requested is included too. No booking is automatically confirmed beyond the slot itself being reserved (if one was picked); vendor follow-up for anything else is still expected.
If you subscribe to a paid plan, we store your selected plan, billing cycle, and payment status. For card payments (Stripe) we do not store your card details ourselves - Stripe handles that directly. For bank transfer payments, we store any proof-of-payment file (e.g. a receipt screenshot) you upload.
We do not use your data, or your end users' data, for advertising, and we do not sell it to anyone.
We only share data with the services necessary to provide the features you're using:
| Service | What's shared | Why |
|---|---|---|
| Facebook, Instagram, X, LinkedIn, TikTok, YouTube, WhatsApp (Meta) | Content you choose to publish; API requests to read/reply to your own comments and messages | These are the platforms you've explicitly connected - we act on your behalf, using your own authorization |
| Twilio | Call audio (for speech-to-text) and SMS message content, for numbers you've connected | Powers the Voice and SMS inbox channels |
| Your email provider (via IMAP/SMTP) | Email content, for mailboxes you've connected | Powers the Email inbox channel |
| Shopify, WooCommerce, or OpenCart (your own store) | API/database requests to read your product and order data | Powers product/order lookups in AI replies - this is your own store, not a third party you don't control |
| Anthropic (Claude API) and/or OpenAI | The visitor's message, relevant knowledge-base/product/order/service context, and recent conversation history, to generate an AI reply - only for channels you've turned AI on for | Powers the AI Agent inbox auto-reply feature |
| Google (Gemini API) | Text prompts and, if provided, a reference image you upload, for AI content or image/video generation in Studio | Optional AI content generation |
| A service's configured vendor email address | A customer's name, contact number, email, message, and (if applicable) the specific time slot requested, when they submit a booking request for that service | Booking requests - see "Services & bookings" above |
| Campaign recipients (your own leads/customers) | The subject and message you compose, sent to the email address they already gave your business | Only when you explicitly create and send a campaign - see "Email campaigns" above |
| Any outbound webhook URL you configure (e.g. Zapier, Make, your own server) | Event data for the specific events you subscribe to (e.g. a new lead, a resolved conversation) - signed with a secret only you and that endpoint know | Optional integrations you set up yourself |
| Stripe, JazzCash, or Easypaisa | Payment amount and your billing details, for the payment method you choose | Processing your subscription payment |
None of these third parties are permitted to use the data we send them to build their own user profiles or for advertising, beyond what's necessary to return the result to us (or, for vendor/webhook notifications, beyond what's necessary to fulfill the request you or your customer initiated).
Data obtained via the Facebook, Instagram, and WhatsApp APIs is used solely to provide the features an account holder directly requests within Syntra Social - namely publishing content the account holder authored, and displaying/replying to (including via an AI Agent the account holder has explicitly enabled) that account holder's own comments and messages. It is not used for advertising, profiling, or any purpose beyond operating the app, and is not retained longer than necessary to provide the service (see section 5). If an account holder enables the AI Agent feature for a Facebook/Instagram/WhatsApp channel, the text of an incoming message (and relevant knowledge-base/product context) is sent to Anthropic and/or OpenAI's API to generate a reply - this only happens for channels the account holder has explicitly turned AI on for.
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, contact us at info@vcyberworld.com.
Social account access tokens, email channel credentials (IMAP/SMTP), voice/SMS credentials (Twilio), store connection credentials (Shopify, WooCommerce, OpenCart - including OpenCart's direct-database option), and any AI provider API key you add yourself (Anthropic, Gemini, OpenAI) are all encrypted at rest using AES-256-GCM - never stored in plain text. Passwords are hashed with bcrypt, a one-way process; we cannot recover your actual password even if asked to. All traffic to the app should be served over HTTPS. Outbound webhook deliveries are signed (HMAC-SHA256) so a receiving endpoint can verify they genuinely came from us. No method of storage or transmission is 100% secure, but we take reasonable, industry-standard measures to protect your data, and we review and improve these protections on an ongoing basis.
This app is not directed at, and not knowingly used to collect data from, children under 13 (or the minimum age required by your local law). If you believe a child has provided us data, contact us and we'll delete it.
If this policy changes materially, we'll update the "Last updated" date above. Continued use of the app after a change constitutes acceptance of the updated policy.
V Cyberworld
info@vcyberworld.com
Syntra