Synnamon.aiHome
Draft: these documents are not finalised. Add your business details in apps/web/src/lib/core/company.ts to complete them before launch.

Privacy Policy

Last updated: 2026-09-23

This notice explains how ColibriLUXE (“Synnamon.ai”, “we”, “us”) collects and uses personal data. It is written for UK GDPR and the Data Protection Act 2018, and for the Privacy and Electronic Communications Regulations (PECR) where those rules apply to cookies and electronic messages. If you are in the EEA, the same information is provided for the EU GDPR.

1. Who we are

ColibriLUXE is the controller for account, billing, and website data. For conversations your AI employee has with your own visitors or callers, you are the controller and we are your processor. Our contact for privacy requests is [email protected]. We have not appointed a statutory data protection officer. The UK regulator is the Information Commissioner's Office (ico.org.uk).

2. What we collect

  • Account data: name, email, hashed password, and workspace details you give us when you sign up.
  • Billing data: plan and payment status. Card numbers are handled by Stripe. We do not store them.
  • Content you provide: knowledge-base files, website text you ask us to read, employee settings, and prompts.
  • Conversation data: chat messages, call transcripts, and audio when a voice call is connected. We do not use voice to identify someone biometrically.
  • Details captured in a conversation: a name, phone number, email, or booking the person chooses to give.
  • Technical data: IP address, browser or device type, and product logs needed to run and protect the service.

3. Why we use it, and the legal basis

  • To provide the service you asked for — contract (UK GDPR Article 6(1)(b)).
  • To run, secure, and fix the service — legitimate interests (Article 6(1)(f)). We do not use this basis where your interests override ours.
  • To record or transcribe a conversation — the business that placed the widget or phone number needs a lawful basis of its own, usually a told-in-advance notice. The widget says, before and during the conversation, that it is an AI assistant and that the conversation may be recorded.
  • Non-essential cookies and optional emails — consent, which you can withdraw (Article 6(1)(a) and PECR).
  • Tax, accounting, and legal claims — legal obligation (Article 6(1)(c)).

You are told when you are speaking or typing to an AI employee rather than a person. We do not make decisions that produce legal or similarly significant effects about you solely by automated means.

4. Your visitors and callers

When your AI employee talks to someone on your site or phone line, you decide why that data is collected. We process it only to provide the service, on your instructions. You need your own lawful basis and a privacy notice for those people. A data processing agreement is available from [email protected].

5. Who we share it with

We do not sell personal data. We use these processors to run the service:

  • OpenAI — language and live voice processing.
  • Supabase — database, sign-in, and file storage.
  • Stripe — payments.

Some of these providers process data outside the UK. Where we transfer personal data from the UK or EEA, we use an adequacy regulation or the UK International Data Transfer Agreement / EU Standard Contractual Clauses, plus a transfer assessment where the law requires one.

6. How long we keep it

Account and conversation data are kept while the workspace is open. When you delete a workspace or ask us to erase data, we delete it unless we have to keep a record for tax, fraud prevention, or a legal claim. Those leftovers are limited to what the law requires and are not used for anything else. Server logs are kept for a short operational period and then deleted or aggregated.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict it, or stop processing based on legitimate interests. You can ask for data you provided to be sent to you or another service where the right to portability applies. You can withdraw consent at any time without affecting processing that already happened. You can also complain to the ICO (ico.org.uk) or, if you are in the EEA, your local authority.

Email [email protected]. We will respond within one month. Workspace owners can also export or delete account data from settings.

8. Security

We protect data with encryption in transit, access controls, and separation between customer workspaces. No service can promise perfect security. If a breach creates a risk to people, we will tell the ICO and, where required, the people affected.

9. Cookies

Essential cookies are used to sign you in and keep the service secure. Anything else is described in our Cookie Policy and is only set with consent where PECR requires it.

10. Children

Synnamon.ai is a business service. It is not directed at anyone under 16, and we do not knowingly collect their personal data. Contact us if you believe a child has given us data and we will delete it.

11. Changes

If we change this notice, we will post the new version here and update the date above. If a change affects how we use account data in a way you would not expect, we will also tell account owners by email.

12. Contact

ColibriLUXE — [email protected]. Governing law for this notice, where a choice is needed, is England & Wales.