Privacy Policy

Effective date: 2026-10-31

This Privacy Policy explains how SoftQuantus innovative OÜ ("SoftQuantus", "we", "us") collects, uses, shares, and protects personal data when you use SynapseX — the chat at chat.synapsex.ai, the API platform at platform.synapsex.ai, the desktop and command-line applications, the quantum lab, and this website (together, the "Services"). It also explains the choices and rights you have.

It applies to consumers and to individual users of business accounts. Where a business customer has a separate data-processing agreement with us, that agreement governs the data we process on its behalf.

1. Who is responsible for your data

The data controller is SoftQuantus innovative OÜ, a private limited company registered in Estonia (registry code 17048927, VAT EE102767458), Narva mnt 5, Kesklinna linnaosa, Tallinn 10117, Harju maakond, Estonia. For data-protection matters, including to reach our Data Protection Officer, write to info@softquantus.com.

2. What we collect

Information you give us

• Account data — your email address, name if you provide one, password (stored only as a salted hash), and the settings and preferences you choose. If you sign in with Google, we receive the profile fields Google shares (email, name, avatar).
• Inputs and Outputs — the prompts, messages, code, circuits, files, and other content you submit, and the responses, results, and artefacts the Services produce for you.
• Payment data — when you buy a plan or credits, our payment processor collects your payment-card details directly. We never see or store full card numbers; we receive the payment method type, last four digits, billing name and country, and transaction records.
• Connected services — if you choose to connect a third-party account (for example an email or storage provider), we store the access token and the data you ask the Services to fetch from it, for as long as the connection is active.
• Communications — the content of support requests, feedback, and other messages you send us.
• Browser extension data — if you install the SynapseX Browser Operator extension, the content of the pages it works on for you. Section 13 describes exactly what it collects, how it is used, stored and shared, and how to stop it.

Information collected automatically

• Usage and metering records — for every billable run: what ran, when, on which backend, how many tokens, shots, or seconds it consumed, and what it cost. This is what makes estimates, reserves, settlement, and your own spend audit work.
• Technical data — IP address, browser and device type, operating system, language, time zone, referring pages, request timestamps, and error logs.
• Cookies and similar technologies — see Section 8.

3. Why we use it, and on what legal basis

• To provide the Services (contract): to run your jobs, store your history, meter and bill usage, authenticate you, and show your results back to you.
• To keep the Services safe and reliable (legitimate interests, legal obligation): to detect abuse, fraud, and security incidents, enforce our Terms and Responsible Use Policy, and debug failures.
• To improve the Services (legitimate interests): aggregate, de-identified usage statistics tell us which features are used and where they fail.
• To train or fine-tune models (consent): only if you explicitly opt in. See Section 4.
• To communicate with you (contract, legitimate interests, consent for marketing): service notices, security alerts, billing receipts, and replies to your requests. Marketing email is sent only with your consent and always has an unsubscribe link.
• To comply with the law (legal obligation): tax, accounting, sanctions, and responses to lawful requests from authorities.

4. Model training — opt-in only

We do not use your Inputs or Outputs to train or fine-tune models unless you explicitly opt in. When an opt-in is offered, the product tells you what would be used and for what; you can withdraw at any time through the same control or by writing to us, and withdrawal stops future use. Content you submit to help us investigate a Trust & Safety report, or that we are required to retain by law, may be used to enforce our policies regardless of your training choice.

5. Who we share it with

We do not sell your personal data. We share it only with:

• Infrastructure and model providers — the cloud providers that host the Services and execute your workloads, and the third-party model and quantum-hardware providers that a run is routed to. They process your Content on our instructions, under contracts that restrict them to providing the service to us, and gain no independent rights over it. Section 14 names the AI services that answer you in SynapseX and how you control what is sent to them.
• Payment processor — to process payments, prevent fraud, and issue invoices.
• Email delivery provider — to send sign-in links, receipts, and service notices.
• Services you connect — when you link a third-party account, data flows to and from that provider under its own privacy policy.
• Professional advisers and authorities — where required to comply with the law, enforce our Terms, or protect the rights, property, or safety of SoftQuantus, our users, or the public.
• A successor — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

6. International transfers

We are established in the European Union. Some of our processors operate outside the European Economic Area. Where personal data leaves the EEA, we rely on an adequacy decision of the European Commission or on the Standard Contractual Clauses, with supplementary measures where needed. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

• Account data — for as long as your account is active.
• Inputs, Outputs, and run history — for as long as your account is active, so you can audit your spend and reproduce past runs. You can delete individual conversations and runs from the product at any time.
• Usage, metering, and billing records — for the period required by tax and accounting law after the transaction, regardless of account status.
• Technical logs — for a limited period sufficient to detect abuse and diagnose failures, then deleted or aggregated.

When your account is deleted (from inside the app, or on your request to info@softquantus.com; see Delete your account), we delete or anonymise your personal data within a reasonable period, except records we must keep for billing, accounting, legal, or security obligations, and residual copies in backups that are overwritten on their normal rotation.

8. Cookies

The Services use only essential cookies and local storage: the session cookie that keeps you signed in, a CSRF token, and your interface preferences (such as theme). We set no advertising cookies and no cross-site tracking cookies, and we do not load third-party analytics scripts. You can block cookies in your browser, but the signed-in Services will not work without the session cookie.

9. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls with least privilege, salted password hashing, audit logging, and separation of production data from development. No system is perfectly secure; if we become aware of a personal-data breach that is likely to result in a risk to you, we will notify you and the competent supervisory authority as the law requires.

10. Your rights

Under the General Data Protection Regulation and, where it applies, the law of the country where you live, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, subject to the retention obligations above;
• restrict or object to processing based on our legitimate interests;
• receive the data you gave us in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing that happened before;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you;
• lodge a complaint with a supervisory authority — in our case the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) — or with the authority of the country where you live.

To exercise a right, use your account settings where the option exists, or write to info@softquantus.com. We will verify your identity and respond within one month, extendable where the law allows for complex requests. Exercising your rights is free unless a request is manifestly unfounded or excessive.

11. Children and users under 18

The Services are not directed at, and may not be used by, children under 13. We do not knowingly collect personal data from children under 13. If we learn that we have, we delete it and close the account.

Users aged 13 to 17 (or under the age of majority where they live, if higher) may use the Services only with the permission of a parent or legal guardian. Where processing relies on consent (Section 3) and the user is below the age at which their country allows them to give that consent themselves (between 13 and 16 in the EU and EEA, under Article 8 GDPR), the consent must be given or authorised by the parent or legal guardian.

A parent or legal guardian who believes that their child has provided us with personal data without permission can write to info@softquantus.com, and we will delete it.

12. Changes to this policy

We may update this policy as the Services or the law change. If a change is material, we will give notice by email or in the product before it takes effect. The effective date at the top always reflects the current version, and earlier versions are available on request.

13. SynapseX Browser Operator browser extension

The SynapseX Browser Operator is an optional extension for Chrome and other Chromium browsers. It lets the SynapseX agent carry out a task you asked for in the chat inside your own browser, in a separate window the extension opens, on the websites you named when you authorized that task. This section applies in addition to the rest of this policy and, for data handled by the extension, takes precedence over it.

What the extension collects

• Device key — when you pair the extension with your SynapseX account, we issue a key that identifies that browser to your account. It is stored in the extension's local storage and on our servers, together with the extension version and the time the browser last checked in.
• Session authorization — for each task you approve: the websites you allowed, how long the approval lasts, and when it started and ended.
• Website content — only from pages in the window the extension opened, and only while a session you authorized is active: the page address and title, the visible text, and the list of interactive elements (links, buttons, form fields and their labels) the agent needs to perform the step.
• Screenshots — images of the session window, taken while a session is active, so you can watch and review what the agent did.
• Actions and results — each command the agent sent (for example open a page, click, or type), what text it typed, and whether the step succeeded.

The extension does not collect your browsing history, the content of your other tabs and windows, your cookies, or your saved passwords. It refuses to read or fill password, payment-card and one-time-code fields, and it cannot be authorized on sign-in pages or password managers. It does not track you across websites and contains no advertising or analytics code.

How we use it

Only to perform the task you asked for and to show you its progress: the website content and screenshots are given to the SynapseX agent so it can decide the next step, and are shown back to you in the chat. We do not use this data for advertising, we do not sell it, we do not use it to determine creditworthiness or for lending, and we do not use it to train or fine-tune models (Section 4 applies). We use the device key and session records to authenticate the extension, enforce the limits you set, and keep the service secure.

How it is stored and for how long

• In your browser, the extension keeps only the device key and the current session's authorization, in its local storage. Removing the extension deletes them.
• On our side, the data is stored in our database hosted by Microsoft Azure in the European Union (West Europe region), encrypted in transit and at rest.
• For each session we keep its authorization record, the commands and their results, and at most the 60 most recent screenshots; older screenshots are deleted as new ones are taken. These records are kept so you can review what was done on your behalf. They are deleted when you delete the conversation the session belongs to, and in any case 30 days after the session ends. Deleting your account deletes them too (see Section 7). You can ask us to delete them sooner by writing to info@softquantus.com.
• Pages that the agent reads during a task also become part of that conversation, like any other Input and Output.

Who it is shared with

We do not sell this data and do not share it with advertisers or data brokers. It is shared only with:

• Microsoft Azure (Microsoft Ireland Operations Limited) — our hosting and database provider, and the model-inference provider that runs the SynapseX agent. It processes the data on our instructions only.
• A model provider you choose — if you select a third-party model or use your own API key for one, the website content and screenshots of that task are sent to that provider to generate the agent's response, under its terms.
• The websites you authorize — the extension acts on those sites in your browser, using your existing signed-in session, so those sites receive the clicks and text the agent enters there, as they would if you did it yourself.
• Professional advisers and authorities — only where the law requires it, as described in Section 5.

Your control

Nothing is collected until you pair the extension and authorize a session. You choose the websites and the duration of each session; closing the session window ends the session at once; actions that pay, send, publish or delete stop and ask you first. You can remove the extension from your browser at any time, which deletes its key from your browser; pairing the extension again revokes the previous key on our side, and you can also ask us to revoke it by writing to info@softquantus.com. Your rights under Section 10 apply to this data.

14. AI services that answer you

SynapseX answers you with AI models. When you use the chat at chat.synapsex.ai, the desktop app or the SynapseX mobile app, we send what you give the assistant to the AI service that runs the model you use, so that it can generate the answer.

What is sent

Your messages, the files and photos you attach, the text of your dictation, the instructions and memories you save, and the earlier messages of the conversation that the model needs to answer in context. When you run an agent, a task or a document, the content you give it is sent in the same way.

Who receives it

• SoftQuantus — our servers receive the content first, store your conversation history (Section 7) and route the request to the model.
• Microsoft Azure AI services (Microsoft Ireland Operations Limited), in the European Union — runs most of the models offered in SynapseX.
• Amazon Web Services — runs some of the models offered in SynapseX.
• SynapseX models hosted by SoftQuantus — run on infrastructure that SoftQuantus operates.

These providers process the content on our instructions, only to run the model and return its answer, under contracts that give them no independent rights over it (Section 5). Where a provider processes it outside the European Economic Area, Section 6 applies.

Why

Only to generate the answer, run the task you asked for, and keep your conversation history so you can return to it. We do not use it for advertising, we do not sell it, and we do not use it to train or fine-tune models unless you opt in (Section 4).

Your choice

The SynapseX mobile app asks for your permission before it sends any of your content to these services, and sends nothing until you tap Allow. You can withdraw that permission at any time in the app under Settings > AI data sharing; from then on nothing more is sent until you allow it again. Withdrawing does not delete content already sent; you can delete conversations from the product, or your whole account (Section 7). If we change what is shared, or with whom, the app asks you again.

15. Contact

SoftQuantus innovative OÜ, Narva mnt 5, Kesklinna linnaosa, Tallinn 10117, Estonia. Privacy questions and requests: info@softquantus.com.