Zynthoro is operated by Casa Haya International BV (KvK 99196581, "Zynthoro", "we", "us"), a private limited company registered in the Netherlands. This Privacy Policy explains what personal data we collect when you use the Zynthoro platform (zynthoro.ai), how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG). All personal data is hosted on EU-based infrastructure, primarily in the Republic of Ireland (eu-west).
1.Data Controller
Casa Haya International BV (KvK 99196581) is the data controller for personal data processed through Zynthoro. You can reach us at info@zynthoro.ai.
2.Personal data we collect
We collect only what we need to run the platform:
- Account data: full name, work email, company name, role, hashed password, 2FA secret.
- Subscription data: plan tier, billing email, Stripe customer ID.
- Kickstart lifetime purchase records: tier purchased, amount, purchase timestamp, and the herroepingsrecht waiver consent event (timestamp, IP, session ID) — retained for 10 years for tax/legal audit as required under Dutch bookkeeping law (Art. 52 AWR).
- Business verification data: PDF business-registration documents you upload (KvK, LLC, Companies House, etc.) and the AI-extracted metadata (company name, registration number, registration date).
- Usage data: page views, feature events, AI assistant prompts and responses, uploaded files for AI context (auto-purged after 24 hours).
- Technical data: IP address, browser, device, language, session cookies.
3.Why we process it
- To create and secure your Zynthoro account (Art. 6(1)(b) GDPR — contract).
- To run the AI Assistants (Zynthoro Assist, Zyntha, Thoro, Zyona) on your behalf (Art. 6(1)(b)).
- To bill you via Stripe and prevent payment fraud (Art. 6(1)(c) — legal obligation).
- To improve product quality and security (Art. 6(1)(f) — legitimate interest).
- To send service emails about your account (transactional, never marketing without consent).
4.AI processing
When you chat with a Zynthoro AI Assistant, your prompts are forwarded to Anthropic (Claude Sonnet 4.6 / Opus 4) and/or Google (Gemini 2.5 Flash) under our zero-retention enterprise contracts. Neither provider uses your prompts to train their foundation models. AI session logs are stored inside your workspace database and you can delete them at any time from Settings → AI history.
6.Retention
- Active account data: kept while your subscription is active.
- After cancellation: 90-day grace period for export, then permanent deletion.
- Billing records: retained 7 years (Dutch tax law).
- AI chat sessions: retained until you delete them; default purge after 24 months of inactivity.
- Backups: rolling 30-day encrypted backups.
7.Your rights under GDPR
You have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data directly from Settings or by email.
- Erase your data ('right to be forgotten') after subscription end.
- Restrict or object to certain processing activities.
- Data portability — export your workspace as JSON/CSV.
- Withdraw consent for any optional processing at any time.
- Lodge a complaint with the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
8.Security
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Passwords are hashed with bcrypt (cost 12). Two-factor authentication is available on all plans. We run quarterly penetration tests and maintain a public security.txt.
9.Changes to this policy
We will notify you by email at least 14 days before any material change. Continued use of Zynthoro after that date constitutes acceptance of the updated policy.
10.Contact
Casa Haya International BV (KvK 99196581)
Amsterdam, The Netherlands
info@zynthoro.ai