About this notice
Last updated: 10 November 2026.
Synaps helps people draw floor plans, model buildings and collaborate on design projects. We use personal information to provide the service, keep it reliable, support our users and understand how to make the product better. Optional analytics help us see which features are useful and where people run into difficulties. Advertising measurement has its own purpose and choice, described below.
This notice covers synaps.app and its product assistant, our app at my.synaps.app and other Synaps subdomains, including beta.synaps.app and the classic version at legacy.synaps.app, and related communications. The controller for the account, product analytics and marketing activities described here is synaps GmbH, Seitenstettengasse 5/37, 1010 Vienna, Austria. Contact us at [email protected].
When a business uses Synaps and its projects contain personal information about other people, such as clients or building occupants, we process that project content on the business's behalf. Business customers can ask us for our data processing agreement.
Information needed to provide Synaps
Account and workspace information includes your name, email address, account identifier, profile picture, team and Space membership, roles and permissions, and your onboarding answers, such as your role, the tools you use and how you heard about us. You sign in with your Google account. We receive the name, email address, profile picture and authentication information Google makes available through that sign-in. When you sign in, we also check your email address against our classic version so that we can offer you access to earlier projects.
We process the projects, models, pages, drawings and comments you create, the files you upload, such as plans, PDFs, images, DWG and DXF files, the descriptions and questions you give AI features, and the results they produce. Other team members, and people you invite to a file, can see content according to their role. You are responsible for having permission to include other people's information in your content.
So that you can keep working when your connection drops, your browser stores unsent drawing edits, copied drawing content and copies of project files and images on your device. See synaps.app/cookies for these technologies.
For paid plans, we process subscription, trial, billing and payment-status information, including your country, which decides whether you pay in euros or US dollars. Stripe handles payment details. We receive the card brand, last four digits and expiry date, which we use to remind you before a card expires, and the information needed to manage your subscription, invoices and payment history. When you contact us or book a demo through Cal.com, we process the details you submit to respond and arrange the meeting.
We do not ask you to include sensitive personal information in designs, prompts or support messages. Please avoid including it unless it is necessary for your use of the service.
Site and map data
The Site tool places your project on a map. When you search for an address or place, your browser sends the search text, a nearby map position and your IP address to MapTiler, which also delivers the map you see. When you import the surroundings of a site, our servers send the site's coordinates or area to TopoExport, which returns buildings, parcels, roads, terrain and other context. We store the site location and the imported context as part of your project.
The map and context data comes from third parties, including OpenStreetMap contributors, the Overture Maps Foundation and national mapping agencies.
Understanding and improving the product
We use PostHog to understand how people move through the website and use Synaps. This includes page visits, clicks, time spent on pages, onboarding, feature use, collaboration, imports and exports, AI-feature outcomes, loading performance, trials and subscription changes, including cancellations and failed payments. These signals help us prioritise improvements and identify where users have difficulties.
Whether this starts before you choose depends on where you are. In the EU and the rest of the EEA (including the EU outermost regions and Åland), the UK and Switzerland, when we cannot tell your country, or when your browser sends a Global Privacy Control signal, Analytics and Advertising start only after you allow them. Elsewhere, both run from your first visit until you choose Reject all or turn them off in your settings.
Events can include browser and device information, such as graphics hardware and display characteristics (including device pixel ratio), IP-derived location, page URLs and referrers, account, workspace and project identifiers, your plan and team size, and relevant file or asset names. Collaboration events can also include collaborator identifiers. When you are signed in, PostHog activity is linked to your account ID and email address. A shared browser identifier can connect visits to our website and app. We use the resulting records to understand individual product journeys as well as to produce overall reports.
In the app, when you have actively allowed Analytics, PostHog can record your sessions as replays: what appears on screen, including your drawings, and your clicks and scrolling. Text you type into form fields is masked. We do not record sign-in pages, Apple mobile devices, or sessions where Analytics runs only because of the regional default. The website does not use session replay.
On the website, after you refuse Analytics, PostHog counts visits without cookies or other storage on your device. It uses an identifier calculated on its servers that changes daily and is not linked to your account. We use this only for overall figures.
Selected onboarding and session events may be held temporarily in browser memory while your choice is being resolved, and sent after Analytics is allowed. Declining clears this pending information.
The app also uses PostHog to decide which features and versions you see. For signed-in users, our servers send your account ID and email address to PostHog for this purpose, whatever your Analytics choice, without storing analytics information on your device. A refusal or withdrawal can send a consent-status update. These functions are separate from ordinary product-event collection.
AI features
When you use an AI feature, we send the content needed for that request to the providers that run it. Depending on the feature, this can include plans, PDFs and images you upload, areas you select, your description or question, and the outline of the building or site. It can include personal information contained in that input.
OpenAI traces floor plans, generates buildings from a description and expands images. Google's Gemini service edits images, renders views, creates reference images and identifies objects. fal.ai runs image models from several model makers to remove backgrounds, upscale, expand and segment images; it receives your images directly or through short-lived links to our storage. Modal hosts our own models for detecting and tracing floor plans, and our Odin product assistant. These providers can process information outside the EEA, including in the United States.
We do not use your content, prompts or AI results to train or fine-tune AI models.
To provide support and resolve problems with floor-plan tracing and building generation, our team can access these requests, including the description and files used and the results, together with the account they belong to. We rely on our legitimate interests for this, and keep these records until the account is deleted.
With Analytics consent, we also keep prompt text from selected AI features to understand common requests and unsuccessful results. These records include your account and, where relevant, workspace identifier, the feature used, the time and whether the request succeeded. We replace obvious email addresses and long number sequences before storing this copy. This safeguard is limited. Names, addresses and other personal information may remain. If you withdraw Analytics consent, we delete these records.
Our product-review tools can use Google Gemini to summarise these stored prompts into themes. This is separate from producing the answer you requested. The prompt-analytics events sent to PostHog contain prompt length and outcome rather than the prompt text itself.
The product assistant on our homepage sends your question and the earlier messages of that conversation to Odin, our assistant service hosted on Modal, to answer it. The conversation ends when you reload or leave the page; your browser keeps only an unsent draft, so that it is still there when you return. Please do not enter personal information you do not want to share.
With Analytics consent, we also keep each question you ask the product assistant and its answer, to see which questions are common and where the assistant falls short, and to improve it. These records are stored with Supabase and contain the question, the answer and its type, Odin's conversation identifier, whether the request succeeded and the time. They are not linked to your account. We delete them automatically after 90 days. Because they are not linked to your account, withdrawing Analytics consent stops new records but does not remove ones already kept before they expire. Without Analytics consent, we do not keep them.
Keeping Synaps reliable
We use technical logs and Sentry, through its EU service, to investigate errors, monitor performance and protect the service. Diagnostic information can include browser and device details, page or request context, error messages, account ID and email address, and technical information about the action that failed. Cloudflare also processes service logs and selected performance traces.
This operational processing is separate from optional product analytics and can continue when Analytics or Advertising is declined. We use it to maintain a working, secure service. We limit automatic request details in backend error reports, but diagnostic records may still contain information relevant to an error.
The app loads fonts from Google Fonts and rsms.me when a page opens. These requests send your IP address and browser information to those services.
Measurement and advertising
We use Google Analytics to understand visits and selected actions on the website and in the app, such as viewing pricing, creating an account or starting a trial. Analytics controls Google analytics storage on both. In the app, when Analytics is allowed, Google Analytics receives your account ID as a user identifier. Our servers can also send selected billing events, such as a trial starting or a purchase, to Google Analytics together with your consent status.
Google Consent Mode loads with storage and advertising signals denied in the EU, the EEA, the UK and Switzerland unless you have allowed them; elsewhere they start granted until you choose Reject all. Google can receive cookieless measurement pings before a choice or after refusal. These can include technical information about the visit and its consent status; declining cookies does not mean that no request reaches Google.
With Advertising consent, the website and the app use Meta Pixel to measure visits and pricing interest, and our servers send conversion events to Meta through its Conversions API. These events cover sign-ups, trial starts, checkouts, purchases and the use of AI features, such as tracing a floor plan or generating a design. Meta Platforms Ireland Limited receives visit signals, browser and network information including your IP address, advertising identifiers, and a hashed (scrambled) version of your email address and account ID. Campaign information can include Google and Meta click identifiers. We use advertising-related signals to understand how people find Synaps and improve the relevance and effectiveness of our own campaigns.
Google Ireland Limited and Meta Platforms Ireland Limited process information under their own applicable terms and privacy notices as well as their arrangements with us. Advertising consent controls Google advertising storage, user-data and personalisation signals. Their policies are available at https://policies.google.com/privacy and https://www.facebook.com/privacy/policy/. We do not display third-party advertisements within Synaps.
Emails, support and product communications
We use Brevo to send account, billing, collaboration and other service messages, and to manage onboarding and product communications. When you sign up, your email address, first name, account ID, signup date and plan are added to an onboarding contact list. Service events update that record, for example with your role, onboarding progress, trial and subscription status, credit usage and workspace activity, and with the brand, last four digits and expiry date of your card when a card reminder is due. Collaboration and sharing emails can include the comment text, the name of the person who commented, shared or invited you, the project or workspace name and a link to it. Events about how you use the app reach Brevo only when you have allowed Analytics.
These details help us send useful messages at the relevant point in your use of Synaps. Links in emails may include campaign labels so that we can understand which communications lead people back to the product. Analytics and Advertising cookie choices are separate from email preferences.
You can unsubscribe from promotional emails using the link in the message or by contacting [email protected]. We may still send essential account, security and billing communications. We use consent where required for promotional communications; any applicable existing-customer exception is limited by the relevant law.
Why we process this information
We rely on performance of our contract with you, or steps you ask us to take before a contract, to provide accounts, save and share your work, fulfil AI and map requests, manage trials and subscriptions and respond to service requests (Article 6(1)(b) GDPR). We process records required for accounting, tax and other legal duties under Article 6(1)(c).
Optional product analytics, session replay, prompt-content analysis and consent-based advertising use your consent (Article 6(1)(a)). You can withdraw that consent. Where Analytics and Advertising run by regional default, we rely on our legitimate interest in understanding and improving the product, and you can object at any time by choosing Reject all. Acceptance of our terms is not consent to optional tracking.
Our legitimate interests under Article 6(1)(f) include operating and securing the service, delivering feature settings, diagnosing faults, providing support for AI features, handling enquiries and maintaining consent records. We balance those interests against your rights. Consent is still required where applicable rules require it for device storage or access; calling a technology cookieless does not itself create an exemption.
Google's denied-consent measurement is described above so you can distinguish it from consented storage. Its technical consent signals do not replace the legal requirements that apply to our processing.
The providers that help us
We use service providers for hosting, sign-in, storage, payments, communications, AI, maps and measurement:
- Cloudflare: hosting, storage, file processing (including DWG, DXF and PDF conversion) and service logs.
- Supabase: sign-in and account services, and the product assistant records kept with Analytics consent.
- Google: sign-in, the Gemini AI features, Google Analytics and advertising measurement, and fonts.
- OpenAI, fal.ai and Modal: AI features and the product assistant.
- MapTiler and TopoExport: maps, place search and site context.
- Stripe: payments, tax and invoices.
- PostHog (EU): product analytics, session replay and feature settings.
- Sentry (EU): error diagnostics.
- Brevo: email.
- Cal.com: demo scheduling.
- Meta: advertising measurement.
Providers receive information relevant to the functions they perform. Some act on our instructions; others, including certain payment and advertising services, also process information for their own purposes under their privacy notices. We may also disclose information where required by law, to protect legal rights or in connection with a business transfer, subject to applicable safeguards.
Our PostHog and Sentry integrations use their EU services. This does not mean that all processing or access is limited to Europe. Cloudflare operates a global network, and OpenAI, fal.ai, Modal and some other providers process information in the United States. Where personal information is transferred outside the EEA, the applicable safeguard may be an adequacy decision or contractual safeguards such as the European Commission's standard contractual clauses. You can contact us for details of the arrangements relevant to your information and how to obtain a copy of the safeguards.
How long information is kept
We keep account and project information for the period needed to provide the service and manage your relationship with us. Drawing version history is kept for as long as the project exists. When you delete a project, we keep it so that support can restore it on request, and remove it when the account that owns its team is deleted.
When you delete your account, we cancel any subscription and delete your sign-in, your account records, including stored prompts and AI run records, the files of teams you own and your email contact record. Shared workspace information may also relate to other members, and legal, security and backup requirements can affect when removal is complete. Stripe keeps billing records under its own obligations.
For product events, session replays, diagnostic records and communication history, retention depends on the purpose, whether the information is still needed to investigate an issue or understand product use, and the retention settings of the provider involved. Product assistant questions and answers kept with Analytics consent are deleted after 90 days. Records already held by analytics, advertising and diagnostics providers are deleted on request rather than automatically when you delete your account. We retain billing and legal records for the periods required by applicable law, and may retain information necessary to establish or defend a legal claim.
Browser-cookie expiry does not delete information already received by a provider. Withdrawing consent limits future consent-based processing; apart from the account-linked prompt records described above, it does not automatically erase information already collected. You can separately request deletion. Contact us for the retention criteria or deletion process relevant to your information.
Your choices and rights
Open Cookie settings in the website footer or Settings, then Privacy, in the app to manage optional measurement choices. Choices can be stored in your browser and, when signed in, on your account. You may be asked again if a notice changes, your browser storage is cleared or a choice is not available on another device. See synaps.app/cookies for the technologies and controls.
Under applicable data-protection law, you can request access, correction, deletion, restriction and, where applicable, portability of your personal information. You can withdraw consent at any time without affecting processing that was lawful before withdrawal. You can object to processing based on legitimate interests, including the regional analytics default and support access to AI requests, and to direct marketing.
Email [email protected] to exercise these rights or ask a question. We may need information to verify your identity. Some requests are subject to legal exceptions, including obligations to keep billing records. You can complain to the Austrian Data Protection Authority at https://www.dsb.gv.at/ or to the supervisory authority where you live or work.
We treat a Global Privacy Control signal as a reason to ask before Analytics starts. We do not use browser Do Not Track signals as a substitute for the choices in our consent controls. You can also manage cookies through your browser, although disabling necessary storage may affect sign-in or other service functions.
Security, age and changes
We use technical and organisational measures designed to protect personal information, including access controls and safeguards appropriate to the services involved. No online service can guarantee complete security. Please protect your account and take care when sharing invite links or inviting collaborators.
Synaps is intended for adults aged 18 and over. If you believe a child has provided personal information to us, please contact [email protected].
We update this notice as the service and its processing change. The date above identifies this version. Where a change requires fresh consent, we must obtain it separately. Publishing a new notice does not grant it.
