Syntrace
Privacy Policy
In this privacy policy (the “Policy”) we, Syntrace AB, describe how we collect, use, and share personal data when you use our web application and related software (the “Service”), when you visit our website at https://syntrace.com (the “Website”), when you communicate with us, and when you take part in events or other activities we arrange.
“Personal data” means any information that, directly or indirectly, identifies a natural person — for example a name, an email address, an IP address, or a person’s voice captured in a meeting recording.
We are committed to protecting personal data and to ensuring that our processing complies with the EU General Data Protection Regulation (2016/679) (the “GDPR”) and other applicable laws.
1. The two roles in which we process data
Syntrace provides a platform for meeting intelligence and decision traceability for the investment management industry. It is important to understand that we process personal data in two distinct roles, and that this Policy primarily covers the first.
1.1 Where we are the controller
We act as a data controller for personal data relating to the people who interact with us directly — the users who administer or log in to the Service, the business contacts of our customers, partners and suppliers, visitors to our Website, and people who contact us. This Policy describes that processing.
1.2 Where we are the processor
When a customer (the “Subscriber”) uses the Service to record, import, transcribe, summarise, analyse or store meetings, the meeting content and any personal data contained in it (for example the voices, names, statements and decisions of meeting participants) constitute Customer Data. For that Customer Data the Subscriber is the controller and we act only as a data processor on the Subscriber’s documented instructions. Our processing of Customer Data is governed by our Data Processing Agreement (the “DPA”), not by this Policy.
If you are a meeting participant and have questions about how your data is used in a Subscriber’s account, please contact that organisation, which is the controller of that data.
2. Who is responsible for your personal data
Syntrace AB, reg. no. 559576-3904, is the controller for the processing described in this Policy. Our contact details are in section 11.
3. Which personal data we collect
We collect only the personal data we need. Depending on how you interact with us, this may include:
- Identity data — such as your name and the role or title you hold.
- Contact data — such as your work email address, telephone number and the address of the organisation you work for.
- Account data — credentials, authentication identifiers and settings associated with your user account.
- Usage data — information about how you use the Service and Website, such as logins, clicks, features used and pages visited.
- Technical data — IP address, device type, browser and operating system version, and similar technical identifiers.
- Communications — the content of your correspondence with us, for example emails, support tickets and survey responses.
- Billing data — the information needed to administer a Subscription and invoice the Subscriber (note: card or bank details are handled by our payment provider).
Note on meeting content. Audio, video, transcripts, notes, summaries, action items and the decision trail generated within the Service are processed as Customer Data on behalf of the Subscriber (see section 1.2) and are not covered by this Policy.
4. Where we collect personal data from
- From you — when you register, log in, use the Service or Website, or communicate with us.
- From the Subscriber — when your employer or organisation sets up an account and provides your details so a user account can be created for you.
- From service providers and partners — for example authentication providers (such as “Sign in with Google” or single sign-on), and analytics or event partners we work with.
- From publicly available sources — for example company websites and public records, in connection with sales and marketing to business contacts.
5. Why we use personal data and our legal bases
Below we explain the main purposes for which we use personal data, the legal basis we rely on, and how long we keep it. Not all purposes apply to every person.
| Purpose | Legal basis | Retention |
|---|---|---|
| Provide and administer the Service and user accounts | Performance of a contract (with the Subscriber); our legitimate interest in providing the Service to authorised users | While the account is active; deleted or anonymised within a reasonable period after the account is closed |
| Communicate about the Service (e.g. notices, updates, support) | Performance of a contract; legitimate interest in supporting users | While the account is active |
| Analyse and improve the Service and develop new features | Legitimate interest in operating and improving our business | Aggregated/anonymised statistics retained indefinitely; identifiable data kept no longer than necessary |
| Detect, prevent and investigate misuse, fraud and security incidents | Legitimate interest in the security of the Service and our users; legal obligation where applicable | Security logs typically retained up to 13 months |
| Manage relationships with customers, suppliers and partners | Performance of a contract; legitimate interest in managing business relationships | Duration of the relationship plus a period to defend legal claims |
| Marketing and communications about Syntrace | Legitimate interest; consent where required (e.g. newsletter) | Until you object or unsubscribe |
| Comply with legal obligations (e.g. accounting, bookkeeping) | Compliance with a legal obligation | As required by law (e.g. Swedish bookkeeping rules) |
| Establish, exercise or defend legal claims | Legitimate interest; legal obligation | For the period a relevant claim may be brought |
Where we rely on consent (for example for certain cookies or the newsletter), you may withdraw it at any time. Where we rely on legitimate interest, you may object — see section 7.
6. Who we share personal data with
We share personal data only as necessary for the purposes above, and we require recipients to protect it. Recipients may include:
- Service providers (processors) — vendors that process data on our behalf, such as our cloud hosting provider, Google Cloud Platform EU (europe-west1), and providers of analytics, communications, support, conferencing/calendar integrations and AI/transcription services. They act on our instructions and may not use the data for their own purposes.
- Sub-processors used to deliver core features — for example AI/machine-learning providers used for transcription and summarisation: Google Cloud Vertex AI — Gemini 2.5 Flash (summarisation and analysis) and text-embedding-005 (search embeddings), region europe-west1 (EU/EEA); and Recall.ai (meeting transcription), region eu-central-1 (EU/EEA).
- Professional advisers and authorities — lawyers, auditors, accountants, courts and public authorities, where necessary to comply with the law or to establish or defend legal claims.
- Acquirers — in connection with a merger, financing or sale of all or part of our business, subject to appropriate confidentiality.
7. Your rights
Under the GDPR you have the right to: request access to and a copy of your personal data; have inaccurate data rectified; request erasure; request restriction of processing; object to processing based on legitimate interest (and, at any time, to direct marketing); receive data you provided in a portable format; and, where we rely on consent, withdraw that consent at any time. To exercise your rights, contact us using the details in section 11.
We normally respond within one month. We may need to verify your identity before acting on a request, and in complex cases we may extend the period by up to two further months and will tell you if so. If you are not satisfied with our handling of your data, you may lodge a complaint with your supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY, www.imy.se).
We do not carry out automated decision-making that produces legal or similarly significant effects on you.
8. Cookies and similar technologies
We use cookies and similar technologies on our Website, for example to enable basic functionality, remember your settings and understand how the Website is used. You can manage your preferences through our cookie banner or your browser settings.
9. Where we process personal data and international transfers
We store personal data within the EU/EEA where practicable. Some of our service providers, or their sub-contractors, may be located outside the EU/EEA. Where personal data is transferred to a country that does not provide an adequate level of protection, we rely on appropriate safeguards — in particular the European Commission’s Standard Contractual Clauses (Decision 2021/914) together with any necessary supplementary measures — to ensure an essentially equivalent level of protection. For more information about transfers and safeguards, contact us using the details in section 11.
Note: if we use AI providers established outside the EU/EEA to process Customer Data on a Subscriber’s behalf, the relevant transfer mechanism is set out in our DPA.
10. Security
We maintain administrative, technical and organisational measures designed to protect personal data, including access controls, encryption in transit and at rest, logging and monitoring, and regular review of our security practices. No system is completely secure, but we work to protect data against unauthorised access, loss and misuse.
11. Updates to this Policy
We may update this Policy from time to time, for example if we change how we process data. We will publish the latest version on our Website and, where the changes are material, notify you by appropriate means in advance. The date of the latest version is stated at the top of this Policy.
12. Contact us
If you have questions about this Policy, our processing of your personal data, or if you wish to exercise your rights, please contact us:
Syntrace AB
Reg. no.: 559576-3904
Address: Östra Hamngatan 52, 411 09 Gothenburg, Sweden
Email: privacy@syntrace.com