Privacy policy

1. Controller and processor

FRAIM ApS, CVR no. 46713893, Vestbanevej 10, 2. tv., 2500 Valby, Denmark, is the controller for accounts and sign-in, billing and the record of consumer withdrawals, support, security logs, usage statistics and the waiting list. Contact: hej@fraim.dk.

Vault content is different. For pages, comments, attachments, captures and sources, claims, the search indexes and embeddings made from them, and AI requests made on that content, the organization that owns the vault decides what is entered, who can see it and when it is deleted; for a vault in your Personal space, you decide. We process that content on their behalf, as their processor, under the Data-processing terms, and use it for nothing of our own. If your question concerns content in an organization's vault, you can contact the organization or us. We pass requests about vault content to the organization and help it answer.

2. What we collect

• Account data: name, email, profile details you add, a password hash or the sign-in provider you chose (GitHub, Google or your organization's identity provider), and your organization and vault memberships and roles.
• Vault content: what you and others add to vaults, such as pages and their history, comments, attachments, captures and sources and claims, together with the search indexes and embeddings made from them. We process it as processor, as section 1 describes.
• Agent connections: which agents you have connected, when each was first used, the vaults and permissions you granted it, and counts of what it read or was refused. Changes an agent makes are recorded in page history.
• Billing data: Stripe handles card details. We keep whether you buy as a business or as an individual, a business's VAT or tax number, the customer, subscription, invoice and refund references needed to apply your plan, and, for consumers, the request for immediate start and the withdrawal acknowledgement with the version of its wording. We do not store card numbers.
• Technical and support data: sign-in sessions, including the IP address and browser or device type recorded with each session, security and audit records, error logs and the messages you send us for support.
• Usage statistics: counts of how the Service is used per account and organization, as section 7 describes.

3. Why we use it and lawful basis

• Your account and plan. We use your information to set up and run your account, apply your plan and its limits, and handle payments and withdrawals. This processing is necessary to provide what we have agreed with you (GDPR Article 6(1)(b)).
• Vault content. We process vault content only on the instructions of the organization or person who controls it, and only to provide the functions they use, as their processor. We do not use it for our own statistics, product analysis, marketing or AI training.
• Security and improvements. We use security records, error logs and usage statistics to protect the Service, prevent misuse, find errors and improve features. The legal basis is our legitimate interest in running a secure, well-functioning service (GDPR Article 6(1)(f)).
• Messages and support. We send the emails and notifications needed for your account and your use of the Service, such as sign-in codes, invitations, mentions and plan notices, and we respond when you contact us. The legal basis is our agreement with you or our legitimate interest in helping resolve problems, depending on the message (GDPR Article 6(1)(b) or (f)). We do not send marketing without your consent.
• Legal requirements. We also process information when required by law, for example when we must keep accounting records of a payment (GDPR Article 6(1)(c)).

4. Who receives data

We do not sell personal information. People in your organization, and in the vaults you share, can see information according to their permissions. Agents you connect receive what you let them reach.

To run Synapse, we use outside providers for hosting and the database, email, payments, push notifications, file storage and sign-in, and for built-in AI when an organization uses FRAIM's plan. The sub-processor list names each provider, what it does, which data it receives, where it processes that data and on what transfer basis.

• Stripe also acts as an independent controller for the payment information it must process and keep under its own legal obligations.
• Your own choices: if you sign in with GitHub or Google, that provider tells us who you are. An organization's own identity provider and its own AI key are the organization's choice, under its own agreement with that provider.

See the Data-processing terms for the processor terms.

5. Agents and AI

When you connect an agent, you authorize it by signing in with your account. It can then reach what you can reach, narrowed by the vaults and permissions you grant it and by your organization's agent policy. The agent's provider receives the content the agent reads, under your own agreement with that provider. You can see and disconnect your agents on the Agents page (Settings → Agents), and organization admins can limit what agents may do.

Built-in AI is off until an organization turns it on, and then only vaults whose admins opt in send anything: the text a use needs, from one vault per request. On FRAIM's plan, that text goes to the AI providers on the sub-processor list, as our sub-processors. With an organization's own key, it goes to the provider the organization chose, under its agreement with that provider.

We do not use vault content to train AI models. For each AI request we record who made it, in which vault, the model and the amount used, to apply allowances, caps and billing. That record holds none of the text sent or received.

6. Waiting list

When you join the waiting list, we use your information to decide who gets access to Synapse next and to write to you if you are invited. Joining the waiting list does not guarantee an invitation.

• Data: the email, name and note you give, the day you joined and the version of the notice you were shown. If you get an account, we also record the dates you first create a vault, connect an agent and make an agent call, never what you write.
• Basis. We process the entry to take the steps you ask for before a possible agreement (GDPR Article 6(1)(b)). We record the first-use dates on the basis of our legitimate interest in knowing whether the people we invite get started (GDPR Article 6(1)(f)).
• Retention: entries we decline are deleted 12 months after they were declined. Other entries are kept until you ask us to remove them. If you create an account, the rest of this policy applies to the account.
• Removal. You can write to hej@fraim.dk at any time, and we delete your entry. Removing your entry does not delete an account you have created.

7. Usage statistics, site counts and logs

Usage statistics. We count how the Service is used per account and organization, for example agent calls, writes, storage and AI use. We use the counts to apply plan limits and allowances, to bill correctly and to understand which features are used. They hold no page content.

Website and address counts. We count visits to the public pages per page and day, and requests per web address and day. These counts are not linked to any person: we read no cookie, IP address, browser details or referrer for them, and we set nothing in your browser.

The information is recorded on our own servers from requests the Service already receives. We use no outside analytics tools or advertising identifiers.

For plan limits and billing, the legal basis is our agreement with you (GDPR Article 6(1)(b)). For understanding and improving the Service, it is our legitimate interest (GDPR Article 6(1)(f)), and you can object to that processing by writing to hej@fraim.dk.

Logs. Our servers record technical errors and security events, such as failed sign-ins and rate limits, to find faults and protect the Service. We keep them only as long as needed for that purpose.

8. International transfers

Some of our providers may process data outside the EU/EEA. The sub-processor list says, for each provider, where it processes data and on which transfer basis.

Transfers outside the EU/EEA must have a valid legal transfer mechanism. This may be an adequacy decision by the European Commission or the European Commission's standard contractual clauses together with the necessary safeguards. For companies in the United States, the EU–US Data Privacy Framework can only be used if the specific recipient has a valid certification covering the processing.

Write to hej@fraim.dk if you would like information about where your information is processed, the transfer mechanism used, or a copy of the relevant safeguards.

9. Retention

We keep your account data while your account exists. When an account is deleted, we delete its personal data, except what we must keep by law.

Vault content is kept while the vault exists, unless it is deleted sooner. Vault owners can delete pages and whole vaults; when a vault is deleted, its pages, history, attachments and search data are deleted with it. An organization's content is deleted at the organization's request, as described in the Data-processing terms.

• Usage statistics: kept while the account or organization exists, and for as long as needed to settle billing for the periods they cover.
• Sign-in sessions: end when you sign out or when they expire. Their records are deleted with the account.
• Billing records: kept for five years from the end of the financial year they belong to, as Danish bookkeeping law requires.

The waiting list follows the periods in section 6. Information we are legally required to retain may be kept longer.

Information deleted from the Service may still remain in backups until those backups expire or are deleted. Only authorized people can access these copies, which are used for security and recovery.

If we restore a backup, previously completed deletions must be carried out again before the information is put back into ordinary use. You can write to hej@fraim.dk for information about how the relevant backups are retained.

10. Your rights

Under the GDPR, you have a number of rights:

• You can access the personal information processed about you and have incorrect information corrected.
• In certain circumstances, you can have information deleted or limit how it is used.
• You can object to processing based on a legitimate interest.
• When the conditions for data portability are met, you can receive information you have provided in a commonly used, machine-readable format and have it transferred to another provider where technically possible.
• If processing is based on your consent, you can withdraw that consent at any time.
• You can complain to the Danish Data Protection Agency (Datatilsynet).

Write to hej@fraim.dk to exercise your rights. We respond as soon as possible and no later than one month after receiving your request. Where necessary because your request is complex or we have received many requests, this period may be extended by up to two further months. We will tell you within the first month if the period is extended and why.

If we have reasonable doubts about your identity, we may ask for the additional information needed to confirm it. Withdrawing consent does not change the lawfulness of earlier processing based on that consent.

If your request concerns content in an organization's vault, you can also contact the organization. If you write to us, we pass your request to the organization and help it answer.

11. Cookies

See the Cookie policy for the sign-in cookies and the preferences Synapse stores. We do not use advertising cookies or outside analytics.

12. Children

You must be at least 18 to create a Synapse account. The Service is not intended for children.

Contact us at hej@fraim.dk if information about a child needs to be corrected or deleted. If the information is in an organization's vault, we help pass the request to the organization.

13. Changes

We will post any updates here with a new "last updated" date and notify you of material changes.