Privacy Policy

1. General Information and Roles of the Parties

This Privacy Policy describes how Synomi processes and protects personal data in the Synomi web service at synomi.ch. A mobile application for synomi.ch is in preparation; the web service works in the browser, including on mobile phones.

The primary governing law is the Swiss Federal Act on Data Protection (FADP/DSG, SR 235.1, in force since 1 September 2023). As Synomi has its registered office in the Netherlands (EU), Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) applies in addition.

Synomi is a service for businesses (B2B) and is not directed at persons under 18; we do not knowingly collect data from minors.

Depending on the type of data, Synomi has two different roles:

• As a Data Controller (Art. 5 let. j DSG, Art. 4(7) GDPR) — for the data of your Synomi account (first name, last name, email address, phone number, correspondence address, company data, payment data, technical logs), i.e. for data that we collect directly in order to provide the Synomi service and operate your account.
• As a Data Processor (Art. 5 let. k and Art. 9 DSG, Art. 4(8) and Art. 28 GDPR) — for the data that you enter or generate in Synomi in the course of your business activity (client data, invoice contents, receipts and accounting documents, trips in the mileage log). You, as a User of Synomi, are the Data Controller for this data; Synomi processes it solely on your documented instructions. The details of the processing on your behalf are set out in point 9 of the Synomi Web Service Terms and Conditions.

Synomi contact details:
Synomi
's-Gravelandseweg 397, 3125 BJ Schiedam, Netherlands
KvK: 64597237
Email: hello@synomi.ch

2. What Data We Process

As part of our services, we process the following personal data:

• Identification data: first name, last name, company name
• Contact data: email address, phone number, correspondence address
• Company data: business identification number (UID), VAT (MWST) number
• Usage data: logs, IP address, browser type
• Payment data: when you pay for a subscription, Mollie processes the payment (we do not store card data)

2a. Mobile Application and AI Features

A mobile application (iOS / Android) for synomi.ch is in preparation. Before it becomes available, we will supplement this Privacy Policy with information on device permissions (e.g. microphone, location, camera).

Active in Switzerland: document recognition (OCR) for expenses, Daisy’s suggestions for bank statements (matching payments to open invoices and expenses, draft invoices from incoming payments — if you use the AI module) and translation of texts at your request (e.g. product names). For these, we use AI models from Anthropic (see section 6). In Switzerland, the chat with Daisy currently shows you how Synomi works and runs entirely on our server — Daisy does not yet answer questions about taxes and regulations here. Voice-to-Invoice™ is not yet active in Switzerland; before we activate it, we will update this Privacy Policy.

3. Purposes of Processing

We process personal data for the following purposes:

• Providing invoicing and business management services
• Managing user accounts
• Processing payments and billing
• Communicating with you
• Ensuring the security of the service
• Analysing and improving our services
• Fulfilling legal and tax obligations

4. Legal Basis

We process personal data in accordance with the principles of the DSG (Art. 6 DSG: lawfulness, good faith, proportionality, purpose limitation and accuracy). Where the GDPR applies, we base the processing on:

• your consent (Art. 6(1)(a) GDPR)
• the performance of a contract (Art. 6(1)(b) GDPR)
• compliance with legal obligations (Art. 6(1)(c) GDPR)
• the legitimate interests of the controller (Art. 6(1)(f) GDPR)

5. Cookies

5.1. What are cookies?

Cookies are small text files that are stored on your device when you visit websites. They are used to remember your settings and preferences.

The provisions of this section apply to the website and the web service synomi.ch.

5.2. Why won’t Synomi work without cookies?

Synomi needs technical cookies to function properly, for the following reasons:

• Login — session cookies enable logging in and access to your account
• CSRF protection — protection against cross-site request forgery attacks requires tokens in cookies
• Language setting — remembering the interface language you have chosen
• Session — remembering the state of the application between HTTP requests

5.3. What cookies do we use?

Essential (technical) cookies

These cookies are necessary for the service to function and cannot be disabled:

• synomi_session — identifier of your session
• XSRF-TOKEN — security token against CSRF attacks
• synomi_cookie_consent — your acknowledgement of the cookie notice (LocalStorage)

Analytics and advertising cookies

Synomi does not use analytics, advertising or tracking cookies (no Google Analytics, no advertising SDKs, no data brokers).

5.4. How long do we store cookies?

• Session cookies — deleted when you close the browser
• Persistent cookies — stored for up to 30 days (cookie notice)
• “Remember me” cookies — up to 1 year (if you enable this option when logging in)

5.5. How can you manage cookies?

You can manage cookies as follows:

• Browser settings — you can block or delete cookies
• Information banner — on your first visit to synomi.ch we display a notice about the use of necessary technical cookies (“Got it” button). Since we use only necessary cookies, the banner is informational and does not require a choice

5.6. External cookies (payments)

When you pay for a subscription, you are redirected to the website of the payment provider Mollie B.V., which may use its own cookies in accordance with its privacy policy (mollie.com/privacy). Synomi has no influence over the cookies set by Mollie.

6. Recipients and Processors

The Synomi application and database run on a server in Switzerland. We send emails via our own mail server in Switzerland. Daily backup copies of the database are kept in the Netherlands (EU); according to the list of the Federal Council (Annex 1 to the Data Protection Ordinance, DSV), the Netherlands ensures an adequate level of data protection.

For individual features, we use trusted external providers. Data is only passed on to the extent necessary for the feature in question:

• Mollie B.V. (Netherlands) — online payment provider, when you pay for a subscription. See mollie.com/privacy
• Google LLC (USA) — in two independent cases:
  • “Sign in with Google” — if you log in via Google, Google sends us your email address and basic profile data to the extent of your consent.
  • Synchronisation with Google Calendar — if you actively connect your Google Calendar account (OAuth2), Synomi writes events generated in the system to your calendar (invoice payment deadlines, scheduled appointments, expense reminders) and reads events from the calendar in order to display them in the Synomi panel. You can disconnect at any time and withdraw your consent in your Google account settings (myaccount.google.com/permissions).
  See policies.google.com/privacy
• Apple Inc. (USA) — in two independent cases:
  • “Sign in with Apple” — if you log in via Apple, Apple sends us only an identifier and — at your request — an email address (optionally anonymised, forwarded by Apple).
  • Synchronisation with iCloud Calendar (CalDAV) — if you actively connect your iCloud calendar using an app-specific password, Synomi communicates with Apple’s servers (caldav.icloud.com) to write and read events (payment deadlines, appointments, reminders). You can disconnect at any time by revoking the app-specific password at appleid.apple.com.
  See apple.com/legal/privacy
• Anthropic PBC (USA) — provider of the AI models for the features in section 2a (document recognition, Daisy’s suggestions for bank statements, translations). Anthropic receives only the data needed for the feature in question (e.g. the image of a document, the transactions of a bank statement together with the open items, the text to be translated). Anthropic is bound by a data processing agreement and does not use the data to train its models. See anthropic.com/legal/privacy
• Authorities — where required by law (e.g. a court order, tax obligations).

The transfer of data to the USA (Google, Apple, Anthropic) takes place on the basis of standard contractual clauses (SCC) recognised by the Federal Data Protection and Information Commissioner (FDPIC).

We do not sell your personal data to third parties. We do not work with advertising networks or data brokers.

7. Your Rights

Under the DSG, you have in particular the right to:

• information about your personal data (Art. 25 DSG)
• rectification of inaccurate data (Art. 32 DSG)
• deletion of your data (Art. 32 DSG)
• delivery or transfer of your data (Art. 28 DSG)
• object to the processing (Art. 30 and 32 DSG)
• lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch)

Where the GDPR applies, you additionally have the right of access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, objection, withdrawal of consent at any time, and the right to lodge a complaint with a supervisory authority — in the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

To exercise your rights, write to us at: hello@synomi.ch

8. Data Security

We protect your data with appropriate technical and organisational measures:

• Encryption of company data at rest with a separate key for every company
• Encrypted connections (TLS / HTTPS)
• Two-factor authentication (2FA), mandatory when logging in with a password
• Regular security updates
• Restricted access to personal data
• Daily backup copies of the database (kept in the Netherlands, see point 6)
• Server in Switzerland

9. Data Retention and Account Deletion

We retain your data:

• for the term of the contract and the provision of the service
• after the subscription expires — in read-only mode, for a maximum of 24 months of uninterrupted inactivity (deletion after prior notice by email with a 30-day period)
• for a maximum of 30 days after the account is deleted (grace period)

9.1. Deleting your account

You can delete your account yourself in the application: Profile → “Konto löschen” (in the English interface: “Delete account”). You can also request the deletion of your account and your data by email to hello@synomi.ch.

After the request, a 30-day grace period applies to the account — during this time you can cancel the deletion by logging in again. After 30 days, the data is permanently and irreversibly deleted from our servers.

We recommend that you export your data before deletion (exports as PDF/XML/Excel) — no recovery is possible after deletion. The obligation to retain your own business records and accounting vouchers for 10 years (Art. 958f OR) rests with you.

What remains: We retain the invoices issued by Synomi (for the subscription) in our accounting records for the statutory retention period (up to 10 years) — we are legally obliged to do so (Art. 6(1)(c) GDPR); in this respect Synomi acts as the Data Controller.

10. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy. We will inform you of changes by publishing a new version on the website and — in the case of material changes — by email.

11. Contact

If you have any questions about the processing of personal data or about this Privacy Policy, please contact us: