Last updated: 16 October 2026
Who this policy covers
This policy applies to SynQ by Synergy Labs, the SynQ website and customer workspace, related support and APIs, and integrations a workspace owner chooses to connect.
Information we collect
We may collect names, business and contact details, customer enquiries, service and booking information, quotes, invoices, support messages, account details, social-media account identifiers and profile details, and basic device, browser, log and security information needed to operate and protect SynQ.
How we use information
We use information to provide the SynQ customer workspace, respond to enquiries, support client accounts, manage customer communications and bookings, maintain security, improve reliability, meet legal obligations, and provide features a user or workspace owner has enabled.
Google integrations
A workspace owner can optionally connect Google services to SynQ. Depending on the feature selected, SynQ may request basic Google profile information, permission to send email through Gmail, and access to Google Calendar or Google Analytics. SynQ does not access Google account data until a user actively starts the Google connection and approves the permissions shown by Google.
Gmail access is used to send user-initiated or user-approved replies and business documents. Calendar access may be used to check availability and create or update booking events. Google Analytics access may be used to display reporting for a property the user selects. The exact permissions and purpose are explained on our Google integrations page.
Google API Limited Use disclosure
SynQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold or used for advertising.
Meta integrations
A workspace owner can optionally connect a Facebook Page, Instagram professional account, or WhatsApp Business account to SynQ through Meta. SynQ requests only the Meta permissions needed to let the owner select the business asset, receive customer messages in the SynQ Inbox, and send replies initiated or approved by an authorised workspace user. SynQ does not access a Meta account until the user starts the connection and approves the permissions shown by Meta.
For connected messaging, SynQ may process the selected Page or account name and identifier, customer message content and attachments, conversation and message identifiers, and the customer's Meta-scoped identifier, display name, username or profile picture when Meta makes those fields available. We use this information only to identify the conversation, display it to authorised workspace users, prevent duplicate delivery, and deliver the reply the user requested. Meta data is not sold, used for advertising, or used to train general-purpose artificial-intelligence or machine-learning models.
How we protect connected and sensitive data
SynQ uses HTTPS/TLS to encrypt connected-service data while it travels between a user's browser, SynQ, Google or Meta. OAuth access and refresh tokens are processed only by SynQ's server-side systems. Before a token is stored, SynQ encrypts it with authenticated AES-256-GCM encryption. The encryption secret is kept separately from the database in the secured application environment. OAuth tokens are not stored in browser local storage or displayed in the SynQ interface.
Authenticated, role-based and workspace-scoped access controls restrict connected-service data to authorised users of the business that connected the account. SynQ requests the minimum permissions required for the feature a workspace owner selects. Production logs are designed to redact credentials, email addresses, message content and provider identifiers; OAuth tokens and connected-service payloads are not intentionally written to application logs. Access to production systems and encryption secrets is limited to authorised operators who need it to operate, secure or support SynQ.
Storage and service providers
SynQ may store the customer records, sent-message details, event details and reporting data required to provide an enabled feature. We review access, update dependencies and investigate suspected security incidents as part of operating the service.
Who we share connected-service data with
We share or transfer Google or Meta user data only to the service providers needed to operate the connected feature: Render for application hosting and Supabase for database and secure data storage. These providers process data on our behalf to deliver and protect SynQ. We may disclose connected-service data to legal authorities where required by law, or to another recipient only when the user gives explicit consent. We do not share this data with advertisers, data brokers, or unrelated third parties, and we do not use it to train general-purpose artificial intelligence or machine-learning models.
Disconnecting Google and deleting data
Workspace owners can disconnect a Google integration in SynQ and can also revoke SynQ access from their Google Account permissions. Users may request access, correction or deletion of stored personal information or connected-service data by emailing hello@synergylabs.com.au. We may retain limited records where required for security, dispute resolution, financial recordkeeping or other legal obligations.
Disconnecting Meta and deleting data
Workspace owners can disconnect a Facebook, Instagram or WhatsApp integration in SynQ and can also remove SynQ from their Meta business integrations. Disconnecting stops new Meta messages and profile data from being collected for that workspace and removes the stored connection credentials. A Meta user can also use Meta's app-removal or data-deletion flow, or email hello@synergylabs.com.au, to request deletion of data associated with their Meta-scoped account identifier. We delete or de-identify the associated integration and conversation data unless limited retention is required for security, dispute resolution or another legal obligation.
Data retention
We keep personal information and connected-service data only for as long as reasonably needed to provide SynQ, maintain security and business records, meet legal obligations, and resolve disputes. Information is deleted or de-identified when it is no longer reasonably required, subject to lawful retention requirements.
Contact
Privacy, Google-data, Meta-data and deletion requests can be sent to hello@synergylabs.com.au. SynQ is a Synergy Labs product based in Canberra, ACT, Australia.