AddSync Privacy Policy
What personal data we collect, why we need it, who sees it, and how you can control it. Written to meet the privacy laws of the countries where our customers work.
The short version
AddSync is for companies and their IT teams, not for consumers.
No sale of personal data and no advertising profiles.
We do not train models on your mailbox or calendar content.
People approve AI actions, and a journal records them.
GDPR, UK GDPR, CCPA/CPRA, LGPD, PIPEDA and more.
One address for every privacy request: contact@add-sync.com.
1. Who we are
AddSync provides software that connects AI tools and calendar, contact and task systems with business mail systems such as Exchange, Microsoft 365, Google, Outlook.com and HCL Domino. This policy covers our websites, our products and the way we handle your requests.
Data controller: Hadar Company S.A., a company registered in Panama. Address: Calle 50, Edificio Frontenac, piso 4, oficina 5B, Panama.
Privacy contact: contact@add-sync.com
Representative in the UK (Art. 27 UK GDPR): Mountain Professional LTD, 28-29 The Broadway No. 1, Ealing, London W5 2NP, United Kingdom.
2. Our role: controller or processor
The law treats us differently depending on the data. This matters for who answers your request.
We are the controller
For data about visitors of our website, people who write to us, and the administrators and billing contacts of our customers.
We decide why and how this data is used, and this policy applies directly.
We are the processor
For the mail, calendar, contact and task content that a company handles through AddSync.
The company is the controller. We process the content only on its instructions, under a data processing agreement. If you are an employee, please contact your employer first.
3. What we collect and why
We collect only what we need. We do not ask for sensitive data and we do not build advertising profiles.
| Category | Data | Why we use it | Legal basis | Kept for |
|---|---|---|---|---|
| Website and contact form | Name, email, company, number of accounts, topic, message. Technical details sent with the form: IP address, browser, language, time zone, screen size, the page and the referrer. | Answer your request, prevent abuse and spam, keep the site secure. | Legitimate interests; steps before a contract | Up to 24 months after the last contact |
| Customer account | Administrator name and work email, company, role, licence count, users added by the administrator. | Create and run the account, provide support, send service notices. | Contract | While the account is active, plus the legal retention period |
| Orders and billing | Company and billing details, tax number, invoices, subscription status. Card and bank details are handled by our payment provider, not by us. | Sell the service, invoice, collect tax, keep accounting records. | Contract; legal obligation | As required by accounting and tax law |
| Service data (Sync) | Calendar, contact and task items and the connection settings needed to keep them in step between the systems you choose. | Run synchronisation that you configured. We process it on your behalf. | Processor: instructions of the customer | While the sync is active, then deleted |
| Service data (AddSync AI) | Mailbox and calendar content that your AI tool requests, filter rules, approvals, and the journal of what the AI did. | Pass data to your AI tool within your filters, show the journal, keep the service safe. | Processor: instructions of the customer | Set by the customer's administrator; see the section on AI |
| Logs and security | IP address, timestamps, error and access logs. | Operate, secure and troubleshoot the service. | Legitimate interests | Up to 12 months |
| Support and email | Messages you send us and our replies. | Answer questions and improve our help pages. | Legitimate interests; contract | Up to 24 months after the case is closed |
| Cookies and similar tools | See the section on cookies. | Make the site work; measure use only where allowed. | Legitimate interests; consent where required | See the cookie section |
If you do not give us data we need for a contract, we cannot provide the service. Filling in the contact form is voluntary.
4. AddSync AI and your mailbox
AddSync AI lets an employee's own AI tool work with the mailbox and calendar. AddSync sits between them as a guard, a tunnel and a journal.
- Option A, your AI tool. Content goes from your mailbox through AddSync to the AI tool and account that your company chose. That provider's terms and privacy policy apply to what it does with the content, and your company is responsible for choosing it.
- Option B, the AddSync chat. The chat uses a model hosted in the EU region.
- Data filter. Your administrator sets one company-wide set of rules for folders and categories, senders and domains, keywords and patterns, and message age and attachments. Data outside the rules is not passed on.
- Human approval and journal. People approve actions that change mail or calendars, and the journal records what the AI did.
- No training. AddSync does not use the content of your mailbox or calendar to train AI models.
- Decisions. We make no decisions about individuals based only on automated processing that have legal or similarly significant effects.
5. Legal bases
Where the GDPR or UK GDPR applies, we rely on these bases:
- Contract to provide and bill the service you ordered.
- Legitimate interests to keep our services secure, prevent abuse, answer requests and improve the product. We weigh these against your rights and you can object.
- Legal obligation for tax, accounting and legal requests.
- Consent where the law requires it, for example for some cookies. You can withdraw it at any time, and this does not affect earlier use.
7. International transfers
AddSync is operated from Panama and serves customers worldwide, so data can be processed outside your country. When personal data leaves the EEA, the UK or Switzerland, we use a legal safeguard, such as an adequacy decision, the European Commission's Standard Contractual Clauses with the UK addendum where needed, or another lawful mechanism. You can ask us for a copy of the safeguard.
8. How long we keep data
We keep data only as long as the purpose in the table needs, and then delete or anonymise it. Legal duties, such as tax law, can require longer. Service content is kept as long as the customer's configuration needs it, and the administrator can set how long the journal is kept. When an account ends, we delete the service data within a reasonable time that we state in the customer agreement. Backups age out by their normal cycle.
9. Security
We protect personal data with technical and organisational measures that fit the risk:
- Encrypted connections between your systems, our services and your AI tool.
- Least-privilege access: for Exchange, a dedicated service user with limited permissions, so administrators do not hand over mailbox passwords.
- Filters, human approval and a journal for AI actions.
- Access limited to staff who need it, and logging of access.
- Regular updates, monitoring and tested backups.
No system is perfectly secure. If a breach affects your data, we will tell the affected customers and the authorities within the time the law sets.
10. Your rights, wherever you live
Whatever your country, you can ask us to tell you what we hold about you, correct it, delete it, limit its use, or give it to you in a usable form. You can object to uses based on legitimate interests and withdraw consent at any time. We will not treat you worse for using these rights.
GDPR. Access, correction, erasure, restriction, portability, objection, and withdrawal of consent.
UK GDPR and the Data Protection Act 2018. The same rights as in the EU.
Federal Act on Data Protection (FADP). Access, correction, deletion and objection.
CCPA/CPRA and similar state laws. Know, delete, correct, opt out of sale or sharing, no discrimination. We do not sell or share personal data.
LGPD. Confirmation, access, correction, anonymisation, portability and deletion.
PIPEDA and provincial laws, including Quebec Law 25. Access, correction and withdrawal of consent.
Privacy Act 1988 and Privacy Act 2020. Access and correction.
Law 81 of 2019. Access, rectification, cancellation, opposition and portability.
Japan APPI, Singapore PDPA, South Africa POPIA, India DPDP Act, UAE and others. We honour the rights your local law gives you.
How to use your rights
Write to contact@add-sync.com from the address we hold, or use the contact form. We may ask you to confirm who you are. We reply within one month, or within the shorter time your law sets. If we are only the processor for your data, we pass the request to the controller or tell you who to ask.
Complaints
You can complain to your data protection authority, for example your national authority in the EU, the Information Commissioner's Office in the UK, the California Privacy Protection Agency or Attorney General, the Brazilian ANPD, or the Office of the Privacy Commissioner of Canada. We would like the chance to solve it first.
12. Children
AddSync is a business service and is not meant for children. We do not knowingly collect data from anyone under 16. If you think a child has sent us data, write to us and we will delete it.
13. Changes to this policy
We update this policy when our service or the law changes. The date at the top shows the latest version. For material changes we tell customers by email or in the product before they start.
14. Contact and complaints
For any question about privacy, data requests or a data processing agreement:
Email: contact@add-sync.com
Form: Open the contact form
Privacy questions
Does AddSync sell my data?
No. We do not sell personal data and we do not share it for advertising. We use it only to run the service, to sell and support it, and to meet legal duties.
Is my mailbox content used to train AI models?
No. Content from your mailbox and calendar is not used by AddSync to train AI models. With AddSync AI option A, the content goes only to the AI tool and account your company chooses. With option B, the chat uses a model hosted in the EU.
Who is the data controller?
For website visitors, customers' administrators and billing, AddSync is the controller. For the mail, calendar, contact and task content a company processes through AddSync, the company is the controller and AddSync is its processor.
Can I get a data processing agreement?
Yes. Business customers can ask for a data processing agreement, including Standard Contractual Clauses, by writing to contact@add-sync.com.
How do I ask for my data to be deleted?
Write to contact@add-sync.com from the address we hold. If your employer runs AddSync for you, your company's administrator may need to act, and we will tell you who to ask.
Does AddSync use cookies?
We use cookies that the site needs to work. We ask for consent before any analytics or marketing cookies where the law requires it.
