Data-processing terms

1. Roles

You decide which content is entered into your vaults, who can access it, which functions and agents are used and when content is deleted. You are the controller. We process the content on your behalf as your processor and use it for nothing of our own. You are responsible for your lawful basis and for giving the people concerned the information they are entitled to.

An agent connected to Synapse acts for the person who connected it, within the access you allow. The provider of such an agent, and the AI provider behind an organization's own key, are your choice and are not our sub-processors. Our own providers' roles depend on the purpose, so not every provider we use is a sub-processor for your content.

2. Subject matter and duration

We process the personal data contained in your vault content to provide Synapse to you. We do so for as long as you use the Service, until the content is deleted as described in section 9.

3. Nature, purpose and instructions

We store, organize, index, search, retrieve, display, transmit, export and delete vault content to provide the functions you use: pages and their history, comments, attachments, captures and sources, claims, search and embeddings, notifications, agent access over MCP, and the optional AI features you turn on.

We process the content only on your documented instructions, including on transfers outside the EU/EEA. Your instructions are these terms and anything you write to us at the contact address below. What you do in the Service is also an instruction, for example when you add pages, connect agents, change settings or delete content. If EU or Member State law requires us to process the content differently, we tell you before we do, unless that law prohibits it. We tell you immediately if we believe an instruction breaks data-protection law.

4. Categories of data and data subjects

• Data subjects: your people and the members you invite, and anyone mentioned in your content, such as colleagues, customers, partners and their contact persons.
• Data: whatever personal data your content contains, typically names, contact details, roles, and work-related notes, decisions, documents and files. You decide what is entered. Do not ask us to process special categories of personal data or data about criminal offenses unless that is necessary and you have a lawful basis for it.

5. Sub-processors

The sub-processor list names each sub-processor with its purpose, the data it receives, where it processes data and on what transfer basis.

AI providers are our sub-processors only for built-in AI on FRAIM's plan, and only once your organization has turned it on. With your organization's own key, the provider is your choice.

You give general written authorization for the sub-processors on the list. We only choose providers that give sufficient guarantees for security and data protection. We impose on them by contract the same data-protection obligations we have under these terms, and we remain fully liable to you for their compliance. We email your organization's owners, or you for a Personal space, at least 30 days before we add or replace a sub-processor, so you can object. We also give notice the same way when these terms change. If we cannot find a reasonable solution to your objection, you can stop the affected processing or end the Service and ask for your data to be returned or deleted. This authorization does not make an otherwise unlawful transfer lawful.

Stripe, and GitHub and Google as sign-in providers, are not sub-processors for your vault content. We use them for payments and for the sign-in a person chooses, as described in the Privacy policy.

6. Security measures

We protect the content with measures appropriate to the risk. All traffic between your browser, app or agent and the Service is encrypted with HTTPS. Access follows organization and vault membership and roles, and agents reach only what their connection allows. Stored secrets, such as an organization's AI key, are encrypted and can never be read back by agents. Attachments are served only after an access check. Administrative access to production systems and backups is limited to the people who need it, and everyone at FRAIM with access to your content is bound by confidentiality. We review the measures regularly and test that we can restore from backups. We may change the measures, but not in a way that lowers the protection. You can ask for the information you need to assess security, as long as sharing it does not harm other customers or the security of the system.

7. Data-subject requests

You can handle most requests yourself in the Service: you can find content with search, correct and delete pages, export a vault as Markdown, remove members and delete vaults. If a request cannot be handled with these functions, we help you find the data and provide or delete it.

If we receive a request about your vault content, we pass it to your organization's owners, or to you for a Personal space, without undue delay. We do not answer it ourselves unless you ask us to or the law requires it. We also give you the information about the processing and its security that you need for an impact assessment or a prior consultation with the Danish Data Protection Agency (GDPR Articles 35–36). Section 8 describes what we do in case of a personal data breach.

8. Breach notification

If we become aware of a personal data breach affecting your vault content, we email your organization's owners, or you for a Personal space, without undue delay. We do not wait until we know every detail. As we learn more, we tell you what happened, which data and people are affected, the likely consequences, what we are doing to deal with it and who you can contact. That lets you assess your own duties.

We help you meet your own duties to notify the Danish Data Protection Agency (Datatilsynet) or another supervisory authority, and the people affected (GDPR Articles 33–34).

9. Return and deletion

Vault owners can delete pages and whole vaults at any time. When a vault is deleted, its pages, history, attachments and search data are deleted with it. You can export a vault as Markdown with its attachments before you delete it.

When you stop using the Service, you decide whether your content should be returned before it is deleted or simply deleted. You can export your vaults yourself, and we help with the rest. To have an organization or an account deleted, write to the contact address below. When we delete data at your request, we confirm it by email. We handle backups as described in the Privacy policy. If we restore a backup, we delete again what was already deleted before the data is used. If EU or Member State law requires us to keep something, we keep only what is necessary for as long as necessary, and we tell you.

10. International transfers

We transfer your content outside the EU/EEA only on your instructions in these terms and with a valid transfer basis. The sub-processor list says where each sub-processor processes data and on which basis. If a basis ceases to apply, we find another or stop the transfer, and we tell you. A provider's own terms do not change our obligations under these terms.

11. Information and audit

You can get the information needed to show that we comply with these terms. You, or an auditor you choose, can also carry out audits, including inspections, and we contribute to them. We agree scope, timing, confidentiality and security with you in advance, but this does not limit your rights or a supervisory authority's powers. If an audit reveals shortcomings, we fix them. For our sub-processors, we give you their own audit reports or certifications where available. Write to us to arrange this.

12. Governing law

These terms are governed by Danish law. The section on governing law and courts in the Terms of service also applies to these terms.

13. Contact

Write to hej@fraim.dk if you have questions about these terms or want to give us instructions, for example about deletion, return of data or audits.