Privacy Policy

1. Who we are and our two roles

• addSynapse is a product of WebOrange (Ioannis Sakkoulas, sole proprietor), Petrou Foumi 23, Heraklion, ΑΦΜ 119679877. Contact: the contact form on this site, or hello@addsynapse.com.
• We are the CONTROLLER for the data we need to run our business: accounts, sign-in and security, billing, support and this website.
• We are a PROCESSOR, on behalf of the shop that uses us, for the shop’s data that our AI tools work with — including any personal data of the shop’s customers. For that data the shop is the controller, and our Data Processing Agreement applies. Customers of a shop should first contact the shop.

2. Data we process as controller

• Account data: name, email, password hash, two-factor settings, team memberships and roles, sign-in provider identifiers (Google, GitHub), language, email preferences, which version of our terms you accepted (recorded for accounts created or terms accepted from 14 October 2026 onwards).
• Site data: site address, plugin keys (secrets encrypted or stored only as hashes), modules, plans and usage counters.
• Billing data: handled by Stripe; we keep the Stripe customer id, subscription status, invoice references and usage charges.
• Support and contact: support tickets with attachments, messages sent through the contact form.
• Security data: active sign-in sessions with IP address and browser (deleted when the session expires, 120 minutes without activity), a security log of account actions (IP address stored only as a keyed hash, and the browser’s user agent), and application error logs. Web server access logs (IP address, address requested, time, browser) are kept by our server for a short period.
• Free trials of the Store Assistant: the shop domain and hashed install and network identifiers (to allow one trial per shop) and, if given, an email address (encrypted).

3. What we do with it, and on what legal basis

The table lists every purpose. “Contract” = Art. 6(1)(b) GDPR, “legal obligation” = Art. 6(1)(c), “legitimate interest” = Art. 6(1)(f).

4. Our legitimate interests and your right to object

• Where we rely on legitimate interest, our interests are: keeping our service and our customers’ shops secure, preventing abuse of free trials, keeping evidence of what was agreed, and telling existing customers about our products. We keep the data to what these purposes need (for example IP addresses only as hashes in the security log) and we balanced these interests against yours.
• You can object at any time through the contact form, or hello@addsynapse.com. We stop unless we have compelling legitimate grounds or need the data for legal claims. You can stop product emails directly with the link in every such email or in your profile settings.

5. Shop data and shop customers’ personal data (as processor)

• What our tools read: products, prices, stock, categories, pages, menus, SEO texts, order summaries (number, date, status, total, payment method) and customer reports with anonymous references. No read tool returns your customers’ names, email addresses, phone numbers or postal addresses.
• Where shop customers’ personal data CAN appear: (1) in a draft order or coupon — a customer’s name, email, phone, address and order note, or the email addresses a coupon is limited to; (2) in anything you type yourself in a chat with an AI assistant, for example details of a customer who called you; (3) in a file you upload for import; (4) in storefront chats of the Sales Agent, where shoppers type their own messages.
• Who receives it: in the Store Assistant, the dashboard assistant and the Sales Agent, the chat (including anything you type) is sent to our AI provider (Anthropic, or OpenAI if your site is set to an OpenAI model) to generate the answer. With Store Manager for WooCommerce, it goes to the AI assistant YOU connected (see below). In every case it is passed to your shop to prepare the draft.
• Where we store it and when we delete it: the customer details of a draft order or coupon are replaced by “[redacted]” once the draft is approved, rejected or expires, and at the latest 48 hours after it was prepared — in every copy we keep: the draft itself, the tool records (each call’s parameters and the data your shop returned) and the conversation where the draft was prepared (the assistant’s tool calls and results, the draft card, and the same details where they appear in your messages or the assistant’s replies). The conversation stays and can be continued; it shows “[redacted]” instead. Data exports never contain these details. Anything else typed in a conversation stays until the conversation is deleted (90 days after the last activity) or the site is deleted. Application error logs (deleted automatically after 14 days) and backups (up to 30 days) may hold a copy until they expire. Storefront chats are stored only if the shop turned this on, for 90 days. Backups follow the backup rule in “How long we keep data”.
• So: we do not collect your customers’ personal data from your shop by ourselves, but it is NOT technically excluded everywhere — what you or your customers type, and draft orders and coupons, do contain it.

6. Store Manager for WooCommerce (Claude, ChatGPT and other AI assistants)

• With Store Manager for WooCommerce you connect YOUR OWN AI assistant — for example Claude (Anthropic) or ChatGPT (OpenAI) — to your shop. We pass each request from your assistant to your shop, through the addSynapse plugin, and the answer back. No AI model of ours reads these requests or answers.
• The AI assistant is a service you chose and use under your own agreement with its provider. It is not our sub-processor: what you type in it, and the tool results we return to it, are processed by that provider under its terms with you. This is different from the Store Assistant, the dashboard assistant and the Sales Agent, where WE send the request to Anthropic or OpenAI as our sub-processors.
• What can be read and what personal data can appear: see “Shop data and shop customers’ personal data” above.
• What we keep: a technical record of each request and answer — the shop, the tool, its parameters and answer, the time and the email of the addSynapse user who connected — to run, secure and support the service. We delete this record after 30 days. Your connection is stored only as protected (hashed) keys; access tokens expire after one hour and refresh tokens after 30 days, and you can disconnect at any time from your assistant or from the shop page in your addSynapse dashboard.
• We do not sell this data or use it to train AI models. Questions: the contact form on this site, or hello@addsynapse.com.

7. Google user data (AddSynapse Analytics)

• AddSynapse Analytics lets the AI assistant you connect (Claude or ChatGPT) read your Google Analytics 4 reports. It works only after you press “Connect Google Analytics” in your addSynapse dashboard and allow it on Google’s own consent screen. Access is read-only: nothing can be changed in your Google account through it.
• What we receive from Google: read-only access to your Google Analytics data (permission “analytics.readonly”), and the email address and account identifier of the Google account you connected (permissions “openid” and “email”). We ask for nothing else.
• What we use it for: only to answer the questions your own AI assistant asks through AddSynapse Analytics — for example traffic, channels, landing pages, purchases and comparisons between periods — and to show you in your dashboard which Google account and which Analytics properties are connected. If your account also has a connected shop, an answer can combine Google Analytics figures with your shop’s own product data (price, stock, status). We use Google user data for no other purpose.
• Who receives it: the report results go only to the AI assistant you connected (Claude or ChatGPT), at your request, and are processed by its provider under your own agreement with it. We do not send your Google Analytics data to any AI model of ours or to our own sub-processors, and we do not pass it to anyone else, except when the law requires it.
• What we store: the Google account email and identifier, the permissions granted, the list of your Analytics properties (id and name), and the refresh token Google gives us, encrypted in our database and never shown or exported. Short-lived access tokens are kept only in our server’s temporary cache, for up to one hour. We do not store your reports: they are fetched from Google when your assistant asks and passed to it. We keep only a technical record of each call (the tool, your account, the outcome and how long it took), without report content, and a usage counter for your plan.
• What we never do: we do not sell Google user data, use it for advertising, or use it to develop, improve or train AI or machine-learning models — neither ours nor anyone else’s. No person at addSynapse reads your Google Analytics data, unless you ask us for help with it, it is needed for security (for example to investigate abuse), or the law requires it.
• How to stop it: press “Disconnect” on the Google Analytics page of your dashboard — we ask Google to revoke our access and stop using the connection at once. You can also remove our access at any time at myaccount.google.com/permissions. In both cases we delete the connection record (the Google email, the identifier and the token) and the list of your properties; when you delete your addSynapse account, we revoke our Google access and delete them at once.
• addSynapse’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Meta user data (AddSynapse Ads)

• AddSynapse Ads lets the AI assistant you connect (Claude or ChatGPT) read your Meta ad accounts (Facebook and Instagram ads). It works only after you press “Connect Meta Ads” in your addSynapse dashboard and allow it on Meta’s own login screen. Access is read-only (permission “ads_read”): nothing can be changed in your ad accounts through it.
• What we receive from Meta: read-only access to the ad accounts you allow, the name and identifier of the Meta user or business user you connected, and an access token. We ask for nothing else.
• What we use it for: only to answer the questions your own AI assistant asks through AddSynapse Ads — for example spend, campaigns, results and, if your account has a connected shop, a comparison with your shop’s own orders and revenue — and to show you in your dashboard which ad accounts are connected.
• Who receives it: the results go only to the AI assistant you connected (Claude or ChatGPT), at your request, and are processed by its provider under your own agreement with it. We do not send your ad data to any AI model of ours, use it for advertising or retargeting, combine it with other advertisers’ data, or sell it.
• What we store: the Meta user name and identifier, the permissions granted, the list of your ad accounts (id, name, currency, time zone), and the access token, encrypted in our database and never shown or exported. Report results are kept only in our server’s temporary cache for up to 15 minutes, so that the same question does not ask Meta twice; we keep only a technical record of each call (the tool, your account, the outcome and how long it took), without report content, and a usage counter for your plan.
• How to stop it: press “Disconnect” on the Meta Ads page of your dashboard — we ask Meta to remove our access and delete the connection (name, identifier, token) and the list of your ad accounts at once. The same happens when you remove the app in your Facebook settings (Settings → Business integrations), when you send a data deletion request through Meta, when the token stops working, and when you delete your addSynapse account.
• Requests from public authorities: if a court, police or other public authority asks us for your data, we first check that the request is lawful and comes from an authority with power to make it. We challenge requests that are unlawful, unclear or broader than necessary. If we must comply, we disclose only the minimum data the request lawfully requires. We tell you about the request before we disclose anything, unless the law forbids it. We keep a written record of every such request and of our answer. Ad data we hold is limited by design (see "What we store" above), so in most cases there is little or nothing to disclose.

9. Google Ads user data (AddSynapse Ads)

• AddSynapse Ads also lets the AI assistant you connect (Claude or ChatGPT) read your Google Ads accounts. It works only after you press “Connect Google Ads” in your addSynapse dashboard and allow it on Google’s own consent screen. We use this access only to read: we never change campaigns, budgets, bids or anything else in your Google Ads accounts.
• What we receive from Google: access to your Google Ads data (permission “adwords”, which Google offers only as one permission; we use it read-only), and the email address and account identifier of the Google account you connected (permissions “openid” and “email”). We ask for nothing else.
• What we use it for: only to answer the questions your own AI assistant asks through AddSynapse Ads — for example cost, campaigns, keywords, search terms, conversions and, if your account has a connected shop, a comparison with your shop’s own orders and revenue — and to show you in your dashboard which Google Ads accounts are connected. We use Google user data for no other purpose.
• Who receives it: the results go only to the AI assistant you connected (Claude or ChatGPT), at your request, and are processed by its provider under your own agreement with it. We do not send your Google Ads data to any AI model of ours or to our own sub-processors, we do not use it for advertising or retargeting, we do not combine it with other advertisers’ data, and we do not pass it to anyone else, except when the law requires it.
• What we store: the Google account email and identifier, the permissions granted, the list of your Google Ads accounts (id, name, currency, time zone, whether it is a manager account), and the refresh token Google gives us, encrypted in our database and never shown or exported. Short-lived access tokens are kept only in our server’s temporary cache, for up to one hour, and report results for up to 15 minutes, so that the same question does not ask Google twice. We keep only a technical record of each call (the tool, your account, the Google Ads account number, whether the answer came from the cache, the outcome and how long it took), without report content, and a usage counter for your plan. These records are deleted together with your addSynapse account.
• What we never do: we do not sell Google user data, use it for advertising, or use it to develop, improve or train AI or machine-learning models — neither ours nor anyone else’s. No person at addSynapse reads your Google Ads data, unless you ask us for help with it, it is needed for security (for example to investigate abuse), or the law requires it.
• How to stop it: press “Disconnect” on the Google Ads page of your dashboard — we ask Google to revoke our access and delete the connection (Google email, identifier, token) and the list of your Google Ads accounts at once. You can also remove our access at any time at myaccount.google.com/permissions; we then delete the connection the next time it is used. When you delete your addSynapse account, we revoke our Google access and delete them at once.
• addSynapse’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Requests from public authorities: if a court, police or other public authority asks us for your data, we first check that the request is lawful and comes from an authority with power to make it. We challenge requests that are unlawful, unclear or broader than necessary. If we must comply, we disclose only the minimum data the request lawfully requires. We tell you about the request before we disclose anything, unless the law forbids it. We keep a written record of every such request and of our answer. Ad data we hold is limited by design (see "What we store" above), so in most cases there is little or nothing to disclose.

10. Activity records of the AI tools

• What we record: each time an AI tool works with your shop — the Store Assistant in your WordPress admin, the assistant in your addSynapse dashboard, or an AI assistant you connected with Store Manager for WooCommerce — we keep a record of the call: the shop, the tool, the parameters, the data your shop returned, the outcome and how long it took. For the Store Assistant and the dashboard assistant we also keep the conversation: your messages, the AI’s answers and the tool results inside them. We also keep the drafts and who approved, rejected or undid them, and a security log of account actions.
• Why: to deliver the result to you or to the assistant you connected; to keep the service secure and detect abuse; to give you support and fix errors when something fails or you ask us for help; and to measure usage for your plan and billing. We act on your behalf and do not use these records for purposes of our own.
• Who can see them: you, through your assistant’s history and your dashboard. At addSynapse, only the people we authorise under a duty of confidentiality, and only when needed for the purposes above. Our staff screens show usage counts, not the content of requests or conversations.
• What we do not do: we do not sell these records, use them for advertising, or use them to train AI models — neither our own nor our providers’.

11. Sub-processors and international transfers

We use these providers. Where data leaves the European Economic Area, the transfer is covered by the mechanism shown for each provider. We checked each provider’s own documents and, for the EU-US Data Privacy Framework, the official list at dataprivacyframework.gov (October 2026). We name the Data Privacy Framework only for providers that are certified on that list.

Where the mechanism is the EU Standard Contractual Clauses, they are the clauses adopted by Commission Implementing Decision (EU) 2021/914, included in the provider’s data processing terms. We rely on the provider’s clauses together with supplementary measures on our side: encryption in transit (HTTPS/TLS) for every transfer; minimisation — our read tools return no shop customers’ names or contact details, so these reach an AI provider only if someone types them or they are part of a draft order or coupon; and redaction of shop customers’ details in draft orders and coupons, their tool records and the conversation where the draft was prepared at the latest 48 hours after the draft was prepared.

No training: Anthropic’s Commercial Terms state that Anthropic may not train models on customer content from its services; OpenAI’s Services Agreement states that OpenAI will not use customer content to develop or improve its services unless the customer explicitly agrees, which we have not done. Both providers keep API data for a limited period for abuse monitoring and then delete it: Anthropic within 30 days (longer, up to 2 years, only for content its safety systems flag as a Usage Policy violation); OpenAI up to 30 days.

Not our sub-processors: the AI assistant you connect to Store Manager (Claude, ChatGPT…), which you use under your own agreement; Google or GitHub, if you choose to sign in with them (they confirm your identity to us). We use no third-party font service: our fonts are served from our own servers — see the Cookie Policy.

12. How long we keep data

Deleting something removes it from our live systems at once (or at the time shown). Copies in backups are not edited: each backup is kept for up to 30 days and is then deleted automatically (replaced by newer backups), so the data is gone from backups at the latest 30 days later. Backups are stored in Google Drive. Backup archives are encrypted.

Deleted data is never brought back into normal operation from a backup. If we ever have to restore a backup, we re-apply all deletions made since that backup was taken before the restored data is used again.

Closing your account and deleting a site are different: deleting a site removes that site’s data only; deleting the account removes every site of the account, the support tickets and — unless you belong to another account — your user profile.

Deleting a site or your account, step by step (the same in our Terms and DPA): (1) access and the service end at once; for 30 days we can, at your request, restore it or provide the export; then it is deleted permanently from our live systems. (2) Erasure sooner: if you ask us in writing (support ticket or email), we delete it from our live systems by hand within 7 days of your request, without waiting for the 30 days (we will tell you if something must be kept by law). (3) Backups: copies expire at the latest 30 days after the data left our live systems, and deletions are re-applied before any restored backup is used. Billing records and invoices are kept for 5 years, as tax law requires.

13. Your rights and how to use them

• You have the right to access, correct, export (portability), erase and restrict your data and to object to processing (Art. 15–21 GDPR), and to complain to the Hellenic Data Protection Authority (dpa.gr) or to the authority where you live.
• Self-service: export your account data in Settings → Privacy → Export, correct it in your profile, and delete your account (owner) in Settings → Privacy.
• Other requests: through the contact form, or hello@addsynapse.com. To protect you, we answer only to the email address of the account, or after you sign in; we may ask for more information if we cannot confirm your identity.
• We answer within one month. For complex or many requests we can extend this by two more months; we tell you within the first month and explain why. Requests are free unless they are manifestly unfounded or excessive.
• If you are a customer of a shop that uses addSynapse, the shop is the controller of your data: we forward your request to the shop without undue delay and help it to answer, and we tell you that we did so.

14. Personal data breaches

• As controller (accounts, billing, security data): we assess every incident, notify the Hellenic Data Protection Authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk to people, and inform you directly without undue delay if the risk is high.
• As processor (shop data): we inform the shop without undue delay — we aim for 48 hours — with what we know about the breach, the data and people concerned, the likely consequences and the measures taken, and we help the shop meet its own duties to notify. The shop decides whether to notify the authority and its customers.

15. Security

Encryption in transit, encryption of secrets at rest, hashed tokens, signed requests between your shop and us, two-factor authentication, least-privilege access and audit logs. The full list is in Annex 1 of our Data Processing Agreement; see also our security page.

16. Cookies

We use only cookies that are strictly necessary. See our Cookie Policy.

17. Changes to this policy

We update this policy when our processing changes. The version and effective date are at the top; previous versions remain available there. We tell account users about material changes by email.