Privacy Policy

1. Who we are

Synseus Inc. ("Synseus", "we") operates synseus.com, a practice-intelligence platform for independent registered investment advisers. We are based in Brampton, Ontario, Canada. Privacy questions: [email protected].

2. What this policy covers

This policy covers our website, the Synseus application and our browser extension. The extension also has its own notice at synseus.com/extension/privacy.

3. What we collect

• Account information: your name, email address, password (stored only as a one-way bcrypt hash), firm name, role and plan.
• Practice information you enter: figures you type into Synseus about your own practice, such as revenue, client counts, fees, team, goals and assumptions. You choose what to enter.
• Billing information: you enter your card details directly with our payment provider, Stripe. We store Stripe's identifiers for your customer record and subscription, your price plan and the end date of your current billing period. We also keep a copy of each billing event Stripe sends us; some of these copies, such as those for a completed checkout or an invoice, include your name, email address and the billing address you give Stripe at checkout. They are kept separately from your account and are not removed when your account is deleted. We do not store card numbers, card brands or the last four digits.
• Support messages: messages you send us, with your name and email address.
• Consent choices: the cookie choices you make, stored in your browser and recorded on our servers.
• Technical and security data: when an administrator acts on an account, we log the action with the administrator's IP address and browser details.
• Browser extension: on Wealthbox and Redtail pages only, the extension reads the page text inside your browser and reduces it to yes/no signals (for example, whether the page mentions succession, a meeting or an AUM amount). It passes the CRM name, the identifier of the record you are viewing and those signals to the Synseus panel. The page text itself is not sent to us.
• Lead forms: if you publish a Synseus lead form, we store what people submit on it — the fields your form asks for — with their IP address, browser details, the page and referring address, and any campaign tags in the link. You decide what your form collects; for these submissions you are responsible for the people who submit them, and we process their information for you.

We do not connect to CRM or calendar systems. Connecting a CRM or calendar is shown in the product as "coming soon" and cannot be started, and no client records are synced from a CRM. If we make CRM or calendar connections available, we will update this policy before they are available and explain exactly what is collected. The "Push to HubSpot" button on regional opportunity cards is switched off and does not appear.

Some tools let you type in information about your own clients, for example names and assets in the client-retention tool. Where a tool keeps that information only in your browser, we never receive it (see section 10). Other tools save what you type to our servers: for example, client names and revenue in the Module 1 client segmentation, and AUM entered for client segments in Module 8.

4. Public regulatory data

Synseus displays information published by the U.S. Securities and Exchange Commission about investment advisory firms, from Form ADV (registered investment advisers and exempt reporting advisers): for example firm names, locations, contact details, assets under management, and client and staff counts. This is public information about firms, shown at the firm level. If you believe information about your firm is wrong, contact us and we will check it against the SEC's current publication. When our monitoring of newly registered firms is switched on, we also use this public information to find newly registered firms that may be interested in Synseus, and record them, with outreach text drafted by our AI provider, in our own customer records at HubSpot.

5. How we use information

• To provide the service: compute analyses from the figures you enter and show public-data comparisons.
• To run AI features: some features send the practice information relevant to your request to our AI provider, Anthropic, to generate text. Every request carries an instruction to use only numbers given in your data and never to invent a figure.
• To bill you, provide support, keep the service secure and fix problems.
• To send you service emails, and only service emails: messages about your account, your trial, your payments and your work in Synseus — for example password resets, payment and cancellation confirmations, notice that your trial is ending or has ended, and the weekly intelligence digest and sprint reminders. We do not send marketing or promotional emails. You can turn the weekly digest and sprint reminders off in Settings → Intelligence. The account and trial messages have no off switch; if you do not want them, tell us at [email protected].
• To deliver your lead forms: we email each submission to you and to any extra recipients you add, send your auto-reply to the person who submitted if you turn it on, and send the submission to any webhook address you set.
• To understand how the website is used, through Google Analytics, only if you allow analytics cookies.

We do not sell your personal information.

6. Who we share it with

Only the service providers that run Synseus for us:

Error reporting (Sentry) is installed in the code but is not switched on: no error data is sent to it today. We will update this policy before it is.

Text messaging (Twilio) is in the code, for phone verification and lead-form alerts, Phone verification is switched off: the route that sends verification texts refuses every request, and no page adds or verifies a phone number. We will update this policy before text messages become part of the product.

We may also disclose information if the law requires it, to protect our rights or users, or to a successor if the business is sold.

7. International transfer

We are based in Canada. Our providers store and process data in the United States, and Stripe, Google and Cloudflare may process data in other countries; for HubSpot, the table above does not state where, and you can ask us. Your information may therefore be subject to the laws of those countries, including access by their authorities.

8. Cookies and analytics

We use the cookies needed to sign you in and keep the service working. When you first visit, we ask about optional cookies. Google Tag Manager and Google Analytics load only if you allow analytics cookies; until you choose, and if you decline, they do not load. We do not use marketing cookies. If you have an account, you can change your choice at any time in Settings → Privacy & Data. If you do not, clearing this site's data in your browser removes your choice, and we ask again on your next visit.

9. How long we keep it

We keep your account and practice information while your account is open. When you ask us to delete your account, we schedule the deletion for 30 days after your request. Once you have confirmed the request, everything held under your account in our database is permanently deleted by a daily job on or after that date. You can cancel at any time before then. Billing records held by Stripe are kept by Stripe as tax and payment law requires. When your account is deleted, any Synseus subscription is cancelled with Stripe at the same time, so you are not charged again after that; until then your subscription continues unless you cancel it.

10. Your rights and choices

Export. In Settings → Privacy & Data you can download everything held under your account in our database, as JSON or CSV. The file is prepared straight away, built from your data at the moment you download it, and the link works for 7 days. We also email you the link. It includes your sign-in accounts and login sessions. The export leaves out passwords, security tokens, verification codes and keys, and the identity, IP address and browser details of any administrator who acted on your account.

Deletion. In Settings → Privacy & Data you can ask us to delete your account. We email you a confirmation link. If you confirm, your account and everything held under it in our database are deleted by a daily job on or after the 30th day after your request, or at the next daily run after you confirm if you confirm later, unless you cancel first.

What deletion and export cannot reach:

• Information kept only in your browser. Several tools save your work in your browser rather than on our servers — your opportunity and alert notes, content calendar, content production tracker, pipelines, saved strategies, custom dashboards, recent tools, client-retention records, process-efficiency data, saved scenarios and A/B tests. We never receive this information, so it is not in your export and deletion cannot remove it. Clear it by clearing this site's data in your browser.
• A support message sent from an email address other than the one on your account. We cannot link it to your account; ask us and we will delete it.
• Anything you have already downloaded, such as an export file or a report.

You can also ask to access or correct your personal information, or ask any privacy question, by emailing [email protected]. If you are in Canada, you may also contact the Office of the Privacy Commissioner of Canada.

11. Security

We use HTTPS for all traffic, store passwords only as bcrypt hashes, encrypt any stored integration credentials with AES-256-GCM, and control access by role. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires. Our Security Overview describes what is in place.

12. Children

Synseus is a professional tool and is not directed at anyone under 18.

13. Changes

We will post changes here with a new "last updated" date, and tell you by email before a material change takes effect.

14. Contact

[email protected] · Synseus Inc., Brampton, Ontario, Canada.