Privacy Policy

1. Introduction

Synergy AI SRL, enterprise number 1034.271.705, with registered office at Boulevard Saint-Michel 125, 1040 Brussels, Belgium ("Synergy", "we", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you use our M&A intelligence platform ("Platform").

We are the data controller for personal data processed through our Platform. We comply with the General Data Protection Regulation (GDPR) and Belgian data protection law.

2. Data We Collect

2.1 Account Data

• Name and email address
• Organization name
• Password (encrypted)
• Role and permissions

2.2 Usage Data

• Platform activity logs
• Feature usage patterns
• Device and browser information
• IP address

2.3 Content Data

• Documents you upload for CIM generation
• Search queries and mandates
• Generated reports and analyses
• Notes and comments

2.4 Payment Data

Payment information is processed by our payment provider (Mollie) and is not stored on our servers. We receive only transaction confirmations and subscription status.

3. Legal Basis for Processing

4. How We Use Your Data

• Service delivery: Processing documents, generating CIMs, target discovery
• Account management: Authentication, permissions, billing
• Communication: Service notifications, support responses
• Improvement: Analyzing usage to improve features
• Security: Detecting and preventing fraud or abuse

5. AI Processing

Our Platform uses artificial intelligence to analyze documents and generate content. When you upload documents:

• Content is processed by AI models to extract information
• No human reviews your documents unless you contact support
• AI outputs are generated solely for your use
• We do not use your documents to train our models

6. Data Sharing

6.1 Service Providers

We share data with trusted providers who help us operate:

• Cloud hosting: Hetzner (EU data centers)
• AI processing: Google (Gemini API)
• Payments: Mollie (Netherlands)
• Email and marketing automation: Brevo (France) — see section 6.4 below

6.4 Marketing Automation (Brevo)

If you opt in to marketing communications at signup, we share the following data with Brevo SAS (Paris, France), our marketing automation provider, to send you relevant product guidance and activation emails:

• Identity: Name, email, organization name, country, role
• Subscription: Plan name, subscription status, trial status
• Usage summary: Features used in the last 30 days, credits remaining, login activity

This data is synchronized periodically and is used solely for segmenting and personalizing product-related email communications. Brevo acts as a data processor under a Data Processing Agreement (DPA) and processes data within the European Union.

Opting out: You can withdraw your consent at any time by updating your email preferences in your account settings or by contacting us at support@masynergy.eu. Once consent is withdrawn, your data will no longer be synchronized to Brevo. You may also request deletion of your Brevo contact record at any time.

6.2 Legal Requirements

We may disclose data if required by law, court order, or to protect our legal rights.

6.3 No Sale of Data

We do not sell your personal data. We do not share your data with third parties for their marketing purposes.

7. International Transfers

Your data is primarily processed within the European Economic Area (EEA). When we use service providers outside the EEA, we ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses
• Adequacy decisions by the European Commission

8. Data Retention

9. Your Rights (GDPR Articles 15-22)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interest
• Withdraw consent: Revoke consent at any time

To exercise these rights, contact us at support@masynergy.eu.

10. Security Measures

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Regular security audits and penetration testing
• Access controls and authentication
• Employee training and confidentiality agreements
• Incident response procedures

11. Cookies and Analytics

We use two categories of cookies and tracking technologies:

11.1 Essential cookies (always active)

• Session management and authentication
• Security (CSRF protection)
• User preferences (language, UI mode)

These are necessary for the Platform to function and cannot be disabled.

11.2 Basic analytics (legitimate interest — no cookies)

We use Google Tag Manager and Google Analytics 4 in cookieless mode to collect basic, anonymous usage data about our public marketing pages (landing page, blog, reports, about, contact, and similar pages). This processing is based on our legitimate interest in understanding how our service is used so we can improve it (GDPR Art. 6(1)(f)).

In this mode, no cookies are set, no persistent identifiers are stored on your device, and no cross-site or cross-session tracking occurs. The data collected is limited to:

• Pages visited and navigation paths
• Approximate country derived from anonymized IP address
• Device type, browser family, and screen size
• Referrer (the page that linked you here)

This data cannot identify you personally and is used solely for aggregate reporting. We do not use it for advertising, profiling, or cross-site tracking. You may object to this processing at any time via the Cookie Settings link in the page footer — selecting "Decline" will stop all analytics measurement entirely.

11.3 Enhanced analytics cookies (consent-based)

When you accept analytics cookies via our cookie banner, Google Analytics may additionally set cookies that store a pseudonymous identifier and session-level browsing information (session duration, return visits, navigation flow). This extended processing is based on your consent (GDPR Art. 6(1)(a)) and enables us to understand longer-term usage patterns and improve the user experience.

We do not use these identifiers for advertising and we do not share them with third parties beyond what Google requires to provide the analytics service. We do not run any advertising cookies.

You can withdraw your consent at any time via the Cookie Settings link in the page footer, or by installing the Google Analytics Opt-out Browser Add-on.

12. Children's Privacy

Our Platform is not intended for users under 18 years of age. We do not knowingly collect data from minors.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or Platform notification. Continued use after changes constitutes acceptance.

14. Contact Us

15. Supervisory Authority

You have the right to lodge a complaint with the Belgian Data Protection Authority: