Data Processing Agreement
Last updated: September 30, 2026
This is a short agreement because CRM and calendar connections are not offered, so Synseus receives no client records from advisers' CRM or calendar systems. It will be expanded before those connections launch. Synseus does store client information that the Customer chooses to enter into a tool that saves to our servers, such as client names and the revenue figures entered for them, and the AUM figures entered for client segments. It also stores the submissions people make on the Customer's Synseus lead forms.
1. Parties and roles
This DPA forms part of the Terms between the Customer and Synseus Inc. For personal information the Customer enters into Synseus, the Customer decides what is collected and why, and Synseus processes it only to provide the service.
2. Scope
| Today | |
|---|---|
| Data | Account details of the Customer's staff; practice figures the Customer enters; any client information the Customer chooses to type into a tool that saves to our servers; submissions to the Customer's lead forms (the fields the form asks for, with the submitter's IP address, browser details, page, referring address and campaign tags) |
| People | The Customer's staff, any person whose details the Customer chooses to enter, and people who submit the Customer's lead forms |
| Purpose | Providing the Synseus service |
3. Synseus commitments
Synseus will:
- Process personal information only on the Customer's documented instructions, which are the Terms and the Customer's use of the product.
- Ensure staff with access are bound by confidentiality.
- Maintain the security measures in the Security Overview.
- Use only the sub-processors listed in Annex A, and give 30 days' notice before adding one, with a right to object.
- Help the Customer respond to requests from individuals to access, correct or delete their information. The Customer can export or delete its own account data itself from Settings → Privacy & Data.
- Notify the Customer without undue delay after becoming aware of a breach affecting Customer personal information, and within 72 hours, as set out on our compliance page.
- When the Customer asks for its account to be deleted and confirms, delete the Customer personal information held under that account at the first daily deletion run on or after the 30th day after the request or, if confirmation comes later, at the next daily deletion run after confirmation.
- Send lead-form submissions only where the Customer directs: by email to the addresses the Customer sets, as an auto-reply to the submitter if the Customer turns it on, and to webhook addresses the Customer sets.
- Make available the information reasonably needed to demonstrate compliance, including answering a reasonable security questionnaire.
4. Customer commitments
The Customer confirms it has the right to provide the personal information it enters or collects through its lead forms, including any notices or consents its clients and form submitters require.
5. International transfers
Synseus is in Canada; its sub-processors process data in the United States, and Stripe, Google and Cloudflare may process data in other countries. For HubSpot, Annex A does not state where; the Customer can ask us.
6. Liability
As set out in the Terms.
Annex A — Sub-processors
| Provider | What for | What it receives | Where |
|---|---|---|---|
| Vercel | Hosting | All web traffic to synseus.com | United States (Washington, D.C. region) |
| Supabase | Database | Your account and everything you save in Synseus | United States (Oregon region) |
| Anthropic | AI features | The practice information relevant to the AI request you make | United States |
| Stripe | Payments | Your billing and card details, entered directly with Stripe | United States and other countries |
| Resend | Email delivery | Your name, email address and the content of emails we send you, including lead-form submissions; and, if you turn on a lead form's auto-reply, the submitter's email address and your reply | United States |
| Google (Tag Manager / Analytics) | Website analytics, only if you allow analytics cookies | Pages visited, device and browser details, approximate location from your IP address | United States and other countries |
| Cloudflare | Delivering web traffic to and from synseus.com | All web traffic to synseus.com | United States and other countries |
| Google (Maps Geocoding) | Converting the practice address you enter in location settings into map coordinates | The address, or city and state, you enter | United States and other countries |
| HubSpot | Our own customer records | Public SEC information about newly registered firms, with outreach text drafted by our AI provider, only when our monitoring of newly registered firms is switched on | Not stated here; ask us |
Sentry (error reporting) is installed in the code but not switched on, and receives no data today.
Twilio (text messages) is in the code. Phone verification is switched off: the route that sends verification texts refuses every request, and no page in the product adds or verifies a phone number.