This Privacy Policy explains how Syntroply, operated by Jason van Alphen (sole trader), Rua 5 de Outubro, 19, 7630-452 São Luís, Odemira, Portugal, NIF 325171548 ("we", "us"), collects and uses your personal data when you use syntroply.com (the "Service"). We are the data controller for the purposes of the EU General Data Protection Regulation (GDPR).
1. Data we collect
- Account data: your email address, and, if you sign in with Google, the basic profile information Google shares (name, email). We use passwordless sign-in (magic link) and/or Google sign-in.
- Design and site data: the planting designs you create and site details you enter (e.g. approximate location, soil, climate, orientation) to generate recommendations.
- Usage data: basic analytics about how you use the Service (pages, actions, device/browser), to improve it.
- Payment data: when you subscribe, payment is handled by our Merchant of Record, Paddle. We do not collect or store your card details — Paddle does. We receive limited transaction data (e.g. plan, status, country) from Paddle.
- Communications: messages you send us (e.g. support emails).
2. Why we use your data and our legal bases
- To provide the Service (create your account, save designs, generate recommendations, deliver plans) — performance of a contract.
- To process subscriptions via Paddle — performance of a contract.
- To send service and management emails (e.g. magic links, seasonal management reminders) — performance of a contract / legitimate interests.
- To send marketing emails, only if you opt in — consent (you can withdraw at any time).
- To improve and secure the Service — legitimate interests.
- To comply with legal obligations (e.g. tax, accounting).
3. Who we share data with (processors and partners)
We use trusted third parties to run the Service, each acting as a processor or independent controller as applicable:
- Paddle — payments, billing and tax (Merchant of Record).
- Supabase — database and authentication (account and design data).
- Vercel — application hosting.
- Resend — transactional and (opt-in) marketing email delivery.
- Google — sign-in, if you choose Google authentication, and analytics if you accept analytics cookies.
We do not sell your personal data.
4. International transfers
Some processors may process data outside the EU/EEA. Where they do, appropriate safeguards (such as the EU Standard Contractual Clauses) are in place.
5. Data retention
We keep your data for as long as your account is active and as needed to provide the Service, then delete or anonymise it, except where we must retain records to meet legal obligations (e.g. invoicing/tax). You can request deletion at any time.
6. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to certain processing. Where we rely on consent, you can withdraw it at any time. To exercise any right, contact us at mail@jasonvanalphen.com. You also have the right to lodge a complaint with your supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados).
7. Cookies
We use essential cookies to run the Service (e.g. keeping you signed in) and, where you accept them, analytics cookies from Google Analytics and Reddit. Non-essential cookies are used only with your consent, which you can manage via the cookie notice (Cookies in the footer).
8. Security
We take reasonable technical and organisational measures to protect your data. No system is perfectly secure, but we work with reputable providers and limit access to your data.
9. Children
The Service is not directed to children under 18, and we do not knowingly collect their data.
10. Changes
We may update this Policy. Material changes will be notified via the Service or by email.
11. Contact
Jason van Alphen — mail@jasonvanalphen.com — Rua 5 de Outubro, 19, 7630-452 São Luís, Odemira, Portugal
This Privacy Policy is a working draft and should be reviewed for GDPR compliance by a qualified professional before relying on it.