Data Processing Agreement
Last updated: September 27, 2026
This is a short agreement because Synseus does not process advisers' client records: CRM and calendar connections are not offered. It will be expanded before those connections launch.
1. Parties and roles
This DPA forms part of the Terms between the Customer and Synseus Inc. For personal information the Customer enters into Synseus, the Customer decides what is collected and why, and Synseus processes it only to provide the service.
2. Scope
| Today | |
|---|---|
| Data | Account details of the Customer's staff; practice figures the Customer enters; any client information the Customer chooses to type into a tool that saves to our servers |
| People | The Customer's staff, and any person whose details the Customer chooses to enter |
| Purpose | Providing the Synseus service |
3. Synseus commitments
Synseus will:
- Process personal information only on the Customer's documented instructions, which are the Terms and the Customer's use of the product.
- Ensure staff with access are bound by confidentiality.
- Maintain the security measures in the Security Overview.
- Use only the sub-processors listed in Annex A, and give 30 days' notice before adding one, with a right to object.
- Help the Customer respond to requests from individuals to access, correct or delete their information. The Customer can export or delete its own account data itself from Settings → Privacy & Data.
- Notify the Customer without undue delay after becoming aware of a breach affecting Customer personal information, and within 72 hours, as set out on our compliance page.
- When the Customer asks for its account to be deleted and confirms, delete the Customer personal information held under that account 30 days after confirmation.
- Make available the information reasonably needed to demonstrate compliance, including answering a reasonable security questionnaire.
4. Customer commitments
The Customer confirms it has the right to provide the personal information it enters, including any notices or consents its clients require.
5. International transfers
Synseus is in Canada; its sub-processors process data in the United States, and Stripe and Google may process data in other countries.
6. Liability
As set out in the Terms.
Annex A — Sub-processors
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Vercel | Hosting | All web traffic to synseus.com | United States (Washington, D.C. region) |
| Supabase | Database | Your account and everything you save in Synseus | United States (Oregon region) |
| Anthropic | AI features | The practice information relevant to the AI request you make | United States |
| Stripe | Payments | Your billing and card details, entered directly with Stripe | United States and other countries |
| Resend | Email delivery | Your name, email address and the content of emails we send you | United States |
| Google (Tag Manager / Analytics) | Website analytics, only if you allow analytics cookies | Pages visited, device and browser details, approximate location from your IP address | United States and other countries |
Sentry (error reporting) is installed in the code but not switched on, and receives no data today.