Privacy policy

1. Who is responsible for your data

Zyntra (zyntra.app, app.zyntra.app, api.zyntra.app, docs.zyntra.app and the mail domain zyntramail.com) is run by Yan Lypnytskyi, whose details are at the end of this page (“we”). We are the controller of the account data described below. For anything about your data, write to support@zyntra.app.

2. Two kinds of data

Account data is what we need to run your account: who you are, your team, your plan and how you use the service. We decide how it is used, and this policy explains how.

Email content is the mail that arrives in your team's inboxes. You decide what is sent to those addresses; we store it and show it to your team only to provide the service. Where that mail contains personal data, we process it on your behalf and on your instructions. Zyntra is built for test messages: please do not route real people's personal data to it beyond what your tests need.

3. What we collect

Account: your email address and, when you sign in with Google or GitHub, the name, profile picture and account identifier that provider passes on. Your team, plan, API keys, and the monthly counters of emails received and API requests made.

Billing: Stripe passes us your customer and subscription identifiers and the status of payments. We never see or store your card details.

Email content: for every email delivered to your team's addresses, the sender, recipients, subject, text and HTML body, headers, the links found in it, and its attachments.

Technical: IP addresses and request logs on our servers, needed for security and to diagnose problems.

Analytics: this website (zyntra.app) and the dashboard at app.zyntra.app load Google Tag Manager, which records which pages you open, where you came from, your browser and device, and roughly where you are. In the dashboard we also record sign-up and purchase events against your account identifier, to see how people move from sign-up to a paid plan.

4. What we use it for, and on what basis

Running your account, delivering mail to your inboxes and serving it over the API, the dashboard and the MCP server: performance of our contract with you (Art. 6(1)(b) GDPR).

Billing, invoices and tax records: our legal obligations (Art. 6(1)(c)).

Security, abuse prevention, service emails about your account, and understanding how the website and the dashboard are used: our legitimate interest in running a secure, working service (Art. 6(1)(f)).

Email content is processed only to provide the service to you, as described in section 2.

5. Who we share it with

Google (Firebase Authentication) — sign-in. GitHub — sign-in, if you choose it. Stripe — payments and subscriptions. SendPulse — sending service emails; we pass your email address, name and sign-in method. Google (Tag Manager, Analytics) — website and dashboard analytics. Cloudflare — network and security in front of our domains. Our hosting provider — servers in the European Union that store the service's data, including email content.

Each of them processes data on our instructions, or as an independent controller within its own service. We do not sell personal data. We disclose data to public authorities only when the law requires it.

6. Where your data is stored

The service's database and email content are stored on servers in the European Union. Google, GitHub, Stripe, SendPulse and Cloudflare may process the data passed to them outside the European Economic Area. Those transfers rely on the European Commission's adequacy decisions, including the EU–US Data Privacy Framework, or on its Standard Contractual Clauses.

7. How long we keep it

Email content is deleted automatically: mail to a temporary inbox after 1 day, mail to a permanent inbox after 7 days on Free, 30 days on Starter, 90 days on Pro. You can delete any email earlier through the API.

Account data: until your account is deleted. Billing records: for as long as tax law requires (in Poland, as a rule, five years). Server logs: for a short period, for diagnostics and security.

8. Your rights

You have the right to access your data and get a copy of it, to have it corrected or erased, to restrict or object to its processing, and to move it to another provider. To use any of these rights, or to delete your account, write to the address below; we answer within one month.

If you believe we process your data unlawfully, you can lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa), or the authority where you live or work.

9. Cookies

This website sets Google Tag Manager's analytics cookies and no others. The dashboard uses a cookie to keep you signed in, and the same analytics cookies. Clearing your browser's site data removes them and signs you out.

10. Security

All traffic to our domains is encrypted (HTTPS). Mail in your inboxes can be read only with an API key issued to your team or by signing in to your team's dashboard. If a breach affects your personal data, we will tell you and the supervisory authority as the law requires.

11. Children

Zyntra is a tool for software teams and is not meant for anyone under 16.

12. Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the dashboard before the change takes effect. The date at the top of the page shows the last update.

13. Contact

For anything about your data, write to support@zyntra.app: