Privacy Policy

This Privacy Policy explains how Praxivox Limited (“Praxivox”, “we”, “us”, “our”) collects, uses and protects personal data when you use the Synura platform (“Service”). Praxivox Limited is a company registered in England and Wales (company number 16988015) with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We are the data controller for your account data and a data processor for health data you transmit through the Service. For questions about this policy, contact us at hello@synura.io.

What We Collect

We collect the following categories of personal data:

• Account data — name, email address, company name, role, and account preferences provided during registration and use of the Service.
• Authentication data — credentials and session data required to secure your account.
• Billing data — payment card type, last four digits, and billing address received from Stripe. We do not receive or store full payment card details.
• Usage data — audit logs, message metadata (source, destination, timestamp, delivery status), API access logs, and dashboard activity.
• Health data — messages transmitted through the Service may contain personal data, including special category health data. We process this data solely for the purpose of transport and translation on your behalf.

How We Use Your Data

We use your personal data to:

• Provide and maintain the Service
• Process your subscription and billing
• Send transactional communications (account verification, service notifications)
• Maintain audit logs for security and compliance
• Provide customer support
• Comply with legal obligations

Communications and Payment Processing

When you create an account, we require email verification to confirm your identity. We send transactional emails from noreply@synura.io, including account verification, team invitations and service notifications. We do not send marketing emails unless you have separately opted in.

Payment processing is handled by Stripe, Inc. When you subscribe to a paid tier, your payment details are collected and processed directly by Stripe. We do not receive or store your full payment card details. We receive from Stripe: confirmation of payment, the last four digits of your card, card type and billing address. Stripe’s privacy policy is available at stripe.com/privacy.

Lawful Basis

We process your data on the following bases under UK GDPR:

• Contract — processing necessary to provide the Service you have subscribed to (Article 6(1)(b)).
• Legitimate interest — security monitoring, fraud prevention, and service improvement (Article 6(1)(f)).
• Legal obligation — compliance with applicable laws and regulations (Article 6(1)(c)).

Where you use the Service to transmit special category health data, you are the data controller and are responsible for ensuring a valid lawful basis under Article 9 of UK GDPR.

Data Retention

Messages transmitted through the Service are retained for a period determined by your subscription tier: 7 days for Transport accounts, 30 days for Translate accounts, and 90 days for Orchestrate accounts (or longer where agreed in writing). After the applicable retention period, messages are automatically and permanently deleted. Audit log entries (metadata recording that a message was sent, its source, destination, timestamp and delivery status) are retained for the duration of your account plus 30 days after account closure.

Account data is retained for the duration of your account. On account closure, we retain data for 30 days to allow data export, after which it is permanently deleted.

Data Sharing

We do not sell your personal data. We share data only with:

• Stripe, Inc. — payment processing
• Amazon Web Services — infrastructure hosting (United Kingdom)
• Google LLC — transactional email delivery via SMTP

We may also disclose data where required by law or to protect our legal rights.

International Data Transfers

Your data is primarily processed and stored in the United Kingdom (AWS eu-west-2, London).

Certain third-party processors transfer data outside the UK:

• Stripe, Inc. (payment processing) — processes payment data in the United States and Ireland. Stripe participates in the EU-US Data Privacy Framework and relies on Standard Contractual Clauses for transfers from the UK.
• Google LLC (transactional email delivery) — transactional emails sent via Google SMTP infrastructure may be processed in the United States. Google relies on Standard Contractual Clauses for international transfers.

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including adequacy decisions, Standard Contractual Clauses or binding corporate rules as applicable.

Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate personal data
• Erase your personal data (subject to legal retention requirements)
• Restrict processing of your personal data
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest

To exercise any of these rights, contact us at hello@synura.io. We will respond within one month as required by UK GDPR.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security assessments. For details of our security practices, contact us at hello@synura.io.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Platform before the changes take effect.

Contact

Praxivox Limited
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email: hello@synura.io
ICO Registration: ZC110347