Data protection at Synomi (FADP / GDPR)

Version for synomi.ch, valid from 8 October 2026.

1. Two roles — who is responsible for what?

The processing of personal data is governed primarily by the Swiss Federal Act on Data Protection (FADP/DSG, SR 235.1, in force since 1 September 2023). Because Synomi has its registered office in the Netherlands (EU), the General Data Protection Regulation (GDPR) applies in addition. Synomi has two roles here:

• Data Controller — for your account data (name, email, company details, payment details, system logs). We collect, process and encrypt this data so that we can offer you the service at all.
• Data Processor (GDPR: processor) — for everything you enter in Synomi in the course of your business activity (data of your clients, invoices, documents, GPS trips). For this data, you are the Data Controller — we process it solely on your instructions. We store it for you and encrypt it as well, but you are the one who manages it.

The agreement on how we handle your data (data processing agreement) is integrated into the Synomi Web Service Terms and Conditions (section 9) — you do not need to sign a separate document.

2. Where is your data?

• The application and the database run on a server in Switzerland.
• Company data is stored encrypted (“at rest”), with a separate key for every company; connections are secured with TLS.
• Daily backup copies of the database are kept in the Netherlands (EU). The Netherlands is one of the countries with adequate data protection within the meaning of the DSG (list of the Federal Council, Annex 1 to the Data Protection Ordinance, DSV).
• We send emails via our own synomi.ch mail server in Switzerland.
• Regular security updates.
• No advertising, no trackers, no selling of data.

3. Your rights

Under the DSG, you have in particular the right to information about your data, to rectification and deletion, to the delivery or transfer of your data (Art. 28 DSG) and the right to object to processing. Under the GDPR, you additionally have the right to restriction of processing, to data portability and to withdraw any consent you have given at any time.

How do you exercise these rights? Send an email to hello@synomi.ch — that is all it takes. You can also lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the Netherlands with the Autoriteit Persoonsgegevens.

4. Deleting your account

You can delete your account yourself in the application (Profile → “Konto löschen”; in the English interface: “Delete account”). You can also request deletion by email: write to hello@synomi.ch, from the email address linked to your account — before we start the procedure, we confirm your request with a reply.

From that moment, a 30-day grace period runs — during this time you can change your mind simply by logging in again. After 30 days, your data is permanently and irreversibly deleted.

Download your data before deleting (exports as PDF/XML/Excel) — the obligation to retain your business records and accounting vouchers for 10 years (Art. 958f OR) rests with you. Details: Privacy Policy, section 9.

5. Who do we share data with — and which data?

Only with trusted processors, only for features you actually use — and only the data without which the feature in question would not work:

• Mollie B.V. (Netherlands, payments) — when you pay for a subscription: the data needed to process the payment. We do not store card data at all — that is handled exclusively by Mollie.
• Google (USA) — only if you switch it on: with “Sign in with Google” we receive your email address and basic profile details from Google; with synchronisation with Google Calendar we enter Synomi events (payment deadlines, appointments) in your calendar and read events back in order to display them.
• Apple (USA) — only if you switch it on: with “Sign in with Apple” we receive an identifier and — if you choose to share it — your email address (which Apple can anonymise); synchronisation with iCloud Calendar works the same way as with Google.

AI features: for document recognition (OCR), Daisy’s suggestions for bank statements and translations, we pass the necessary data to Anthropic (USA) — only as much as the feature needs, and without training the models on your data. In Switzerland, the chat with Daisy currently runs entirely on our server. Voice-to-Invoice is not yet active.

Transfers to countries without adequate data protection (Google, Apple and Anthropic in the USA) are based on standard contractual clauses (SCC) recognised by the FDPIC. We do not sell data. The full list and details: Privacy Policy, section 6.

6. Cookies

We use only technically necessary cookies (login, security, settings) — no analytics and no advertising cookies. Details: Privacy Policy, section 5.

7. Artificial intelligence at Synomi

Active in Switzerland are document recognition (OCR), Daisy’s suggestions for bank statements and translations. For now, Daisy in the chat shows you how Synomi works (she does not yet answer tax questions here); Voice-to-Invoice will follow. The same principle applies as in the EU version: human in the loop — a human always has the final say. The AI suggests, you decide; no document is created without your conscious confirmation, and you always know that you are dealing with an AI.

8. Information security

• Encryption with a separate key for every company — one key never opens another company’s data.
• TLS for all connections.
• Two-factor authentication (2FA) — mandatory when logging in with a password.
• Regular security updates and daily backup copies.
• No trackers and a short list of processors (section 5).

Questions about security? Write to us: hello@synomi.ch.

9. Contact