1. Data Controller

Synthera Pty Ltd (“Synthera”, “we”, “our”, “us”) is the data controller responsible for your personal data.

Address: Shop 6, 61 Market Street, Wollongong, NSW 2500, Australia
Email: ai@synthera.com.au
Phone: 0466 446 461

2. What Data We Collect

2.1 Contact Form Submissions

When you submit our contact form, we collect your name, email address, phone number, business name, and message content.

2.2 Voice Calls (AI Agent)

When you interact with our AI voice agent (Nova), your call may be recorded for quality assurance and service improvement. We may collect your name, email address, phone number, service interests, and any other information you provide during the call. Call recordings are processed by our voice AI provider Retell AI.

2.3 Calendar Bookings

When you book a consultation, we collect your name, email address, phone number, preferred date and time, and service interest. This information is used to create calendar invitations via Microsoft Outlook / Microsoft Graph API.

2.4 Customer-Connected Calendars (Google Calendar & Microsoft Outlook)

Synthera customers (businesses using our AI receptionist) can connect their own Google Calendar or Microsoft Outlook calendar from the dashboard at app.synthera.com.au/app/integrations. When they connect, Synthera receives a limited-purpose access token from Google or Microsoft (via OAuth 2.0) and uses it solely to operate the AI receptionist on the customer's behalf.

Google data we receive. When you connect Google Calendar, Synthera requests the https://www.googleapis.com/auth/calendar.events OAuth scope. This scope grants us permission to:

read events on your primary calendar (so the AI receptionist can check availability before offering a slot to a caller)
create new events on your primary calendar (so the AI receptionist can book appointments on your behalf)
update or delete events that the AI receptionist created (so customers can reschedule or cancel from the Synthera dashboard)

We additionally request openid, email, and profile so we can show you which Google account is connected on the Integrations screen.

Microsoft data we receive. When you connect Outlook, Synthera requests the equivalent Microsoft Graph scopes — Calendars.ReadWrite, Mail.Send, User.Read and offline_access — for the same purposes.

How we store and protect this data. OAuth access tokens and refresh tokens are stored encrypted at rest in our PostgreSQL database (hosted on Railway, Sydney region). Refresh tokens are never written to logs. Calendar event data is fetched on demand for the dashboard view and is not cached beyond the lifetime of the request. Caller details tied to AI-booked appointments (name, email, phone) are stored in our own bookings table for the duration set out in Section 6.

Limited Use commitment (Google). Synthera's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

sell Google user data to any third party
use Google user data for advertising
use Google user data to train, fine-tune, or evaluate AI/ML models
allow humans to read Google user data, except (a) with explicit consent from the affected user, (b) where necessary for security investigations or to comply with applicable law, or (c) where the data is aggregated and used for internal operations in line with the policy
transfer Google user data to anyone other than the named subprocessors in Section 5

How to revoke access. You can revoke Synthera's access to your Google or Outlook calendar at any time by clicking Disconnect on app.synthera.com.au/app/integrations. That immediately deletes our stored tokens for that provider and stops all calendar access. You can additionally revoke our app from your Google account at myaccount.google.com/permissions or from your Microsoft account at myapps.microsoft.com. To request deletion of any cached booking data, email ai@synthera.com.au.

2.5 Website Analytics

With your consent, we use Supabase-based logging to collect anonymised usage data such as pages visited, browser type, and referring URLs. This data helps us improve the website experience.

2.6 Cookies

We use cookies as described in Section 9 (Cookie Policy) below.

3. Legal Basis for Processing

We process your personal data under the following legal bases:

Consent: For analytics cookies, marketing cookies (YouTube embeds), and processing your contact form data. You can withdraw consent at any time.
Legitimate interest: For responding to enquiries, providing requested services, fraud prevention, and improving our services.
Contractual necessity: For processing data required to fulfil a service agreement or consultation booking.

4. How We Use Your Data

We use your personal data to:

Respond to your enquiries and provide requested information
Schedule and manage consultation bookings
Deliver and improve our AI services
Send relevant follow-up communications (with your consent)
Analyse website usage to improve user experience
Comply with legal obligations

5. Third-Party Processors

We may share personal data with trusted third-party service providers who assist us in operating our business. These include:

Cloud hosting and infrastructure providers — To host our website, databases, and application services
AI and voice processing providers — To power our AI voice agents and chatbot services
Email delivery providers — To send transactional emails such as contact form confirmations and invoices
Calendar and scheduling providers — Google LLC (Google Calendar API, when a user connects Google Calendar) and Microsoft Corporation (Microsoft Graph / Outlook, when a user connects Outlook). Data shared is limited to the events the AI receptionist needs to read or write on the connected calendar.
Messaging platform providers — To facilitate customer communication via messaging services such as WhatsApp
Analytics providers — To collect anonymised website usage data and improve our services
Embedded content providers — To display video and other media content on our website (loaded only with your consent)

Each provider is selected for its security standards and is contractually bound to handle your data securely and only for the purposes we specify. We do not sell your personal data to any third party. For a full list of our current processors, you may contact us at ai@synthera.com.au.

6. Data Retention

Contact form submissions: Retained for up to 24 months, then deleted unless an ongoing business relationship exists.
Call recordings: Retained for up to 90 days for quality assurance, then automatically deleted.
Calendar bookings: Retained for the duration of the business relationship plus 12 months.
Analytics data: Retained for up to 12 months in aggregated, anonymised form.
Cookie consent preferences: Stored for 12 months, after which you will be re-prompted.

7. Your Rights

Under applicable data protection laws (including the Australian Privacy Act 1988 and, where applicable, the EU General Data Protection Regulation), you have the right to:

Access — Request a copy of the personal data we hold about you
Rectification — Request correction of inaccurate or incomplete data
Erasure — Request deletion of your personal data (“right to be forgotten”)
Portability — Request your data in a structured, machine-readable format
Objection — Object to processing based on legitimate interest
Restrict processing — Request that we limit how we use your data
Withdraw consent — Withdraw consent at any time without affecting prior lawful processing

To exercise any of these rights, email us at ai@synthera.com.au. We will respond within 30 days.

8. Call Recording Disclosure

Calls to Synthera may be recorded for quality assurance, training, and service improvement purposes. Our AI voice agent will inform you at the start of each call that the call may be recorded. If you do not wish to be recorded, you may end the call at any time and contact us via email or our contact form instead.

9. Cookie Policy

We use the following categories of cookies on our website:

9.1 Necessary Cookies

These cookies are essential for the website to function and cannot be disabled. They include the cookie consent preference cookie (synthera_consent).

9.2 Analytics Cookies

With your consent, we load Supabase-based analytics scripts that help us understand how visitors use our website. These scripts collect anonymised data about page views and interactions.

9.3 Marketing Cookies

With your consent, we embed YouTube videos which may set third-party cookies. These cookies may be used by Google to serve personalised advertising.

You can manage your cookie preferences at any time by clearing your browser cookies and revisiting our website, which will re-display the cookie consent banner.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS), secure hosting infrastructure, and access controls.

11. International Transfers

Some of our third-party processors may be located outside Australia. Where data is transferred internationally, we ensure appropriate safeguards are in place, including contractual protections that meet applicable data protection standards.

12. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Email: ai@synthera.com.au
Phone: 0466 446 461
Address: Shop 6, 61 Market Street, Wollongong, NSW 2500, Australia
ABN: 27 696 117 101 | ACN: 696 117 101

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.