S
Sydael
← Back to sign in

Privacy Policy

Effective: 7 August 2026 · Version 2.1

This Privacy Policy explains how Sydael (“we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use the Sydael app and website. It applies to all users globally, with specific provisions for users in India, the European Economic Area (EEA), the United Kingdom, and California.

1. Who We Are

Sydael is an AI-powered goal coaching platform. Our contact for data and privacy matters is:

privacy@sydael.com
Grievance response: within 24 hours · Resolution: within 15 business days

2. AI Disclosure

Sydael Coach is an AI system, not a human. When you chat with Sydael Coach, your messages are processed by an AI model (Claude, by Anthropic, Inc.) and responses are generated automatically. This disclosure is required under the EU Artificial Intelligence Act (Art. 50), effective August 2026.

3. Data We Collect

CategoryWhatWhy
IdentityName, email (from Google OAuth)Account creation and identification
ProfileUniversity, course of studyPersonalise coaching experience
Goals & ProgressGoals, milestones, dates, statusCore service delivery
CoachingMessages with the AI coachGenerate coaching responses
WellbeingMood signals you logPersonalise coaching context
DevicePush notification tokensSend goal reminders
PaymentStripe customer ID, subscription statusManage billing (card details held by Stripe)
UsageIP address, pages visited, session durationSecurity, fraud prevention, service improvement

4. Legal Basis for Processing

  • Consent — you explicitly agree when you accept our Terms
  • Contract — processing necessary to provide the Service and your subscription
  • Legitimate interests — security, fraud prevention, service improvement
  • Legal obligation — compliance with applicable laws

5. Who We Share Data With

ProviderPurposeLocation
SupabaseDatabase & authenticationUSA / EU
AnthropicAI coaching responses (your messages)USA
StripePayment processingUSA
VercelApp hosting & CDNUSA / Global
ExpoMobile push notificationsUSA
GoogleOAuth sign-inUSA

We do not sell your personal data. For cross-border transfers, we rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete or anonymise your data within 30 days, except where we are required by law to retain billing records (typically 7 years for financial records).

Lapsed subscriptions: If your paid subscription is not renewed within 30 days of cancellation or payment failure, your personal data (goals, milestones, coaching history, mood signals, and profile) will be automatically deleted. We will notify you by email before this occurs so you have an opportunity to export or renew.

Billing records (transaction IDs, amounts, subscription status) are retained for up to 7 years as required by applicable financial and tax law, even after account deletion.

7. Security

  • All data transmitted over HTTPS (TLS)
  • Row-Level Security (RLS) — only you can access your own data in our database
  • Authentication via Google OAuth 2.0
  • Payment card details never stored by Sydael — held only by Stripe (PCI DSS Level 1)

8. Your Rights

🇮🇳 India — DPDP Act 2023

  • Right to access a summary of your data
  • Right to correct inaccurate or incomplete data
  • Right to erasure of your data
  • Right to grievance redressal (acknowledged within 24 hours, resolved within 15 business days)
  • Right to nominate a representative to exercise rights on your behalf

Sydael acts as a Data Fiduciary under the DPDP Act. Consent notices are available in English. Notices in other scheduled Indian languages are available upon request.

🇪🇺 EEA — GDPR

  • Right to access your personal data
  • Right to rectification of inaccurate data
  • Right to erasure (“right to be forgotten”)
  • Right to restrict processing
  • Right to data portability — receive your data in a machine-readable format (JSON) by emailing us
  • Right to object to processing based on legitimate interests
  • Right not to be subject to solely automated decision-making with significant effects — Sydael Coach does not make any automated decisions that produce legal or similarly significant effects on you
  • Right to withdraw consent at any time without affecting prior processing
  • Right to lodge a complaint with your local Data Protection Authority (DPA)

Sydael does not have a designated Data Protection Officer. We are not subject to mandatory DPO appointment at our current scale. Data protection inquiries are handled by our Grievance Officer at privacy@sydael.com.

🇺🇸 California — CCPA / CPRA

  • Right to know what personal information we collect, use, and disclose
  • Right to request deletion of your personal information
  • Right to correct inaccurate personal information
  • Right to limit use and disclosure of sensitive personal information
  • Right to opt out of the “sale” or “sharing” of personal information — we do not sell or share personal information for cross-context behavioural advertising
  • Right to non-discrimination for exercising your rights

To submit a “Do Not Sell or Share” request or to exercise any CCPA/CPRA right, email privacy@sydael.com with “California Privacy Request” in the subject line. We will respond within 45 calendar days.

To exercise any right, email privacy@sydael.com. We respond within 15 business days (30 days for EEA users, 45 days for California users, as required by applicable law).

Geographic availability: Sydael is currently available in India, the EEA, and the United States. The Service is not directed at users in the United Kingdom. If you are a UK resident, please do not use Sydael at this time.

9. Cookies

Sydael uses cookies and similar technologies solely for authentication (managing your login session via Supabase). We do not use advertising or tracking cookies. No cookie consent banner is shown because we only use strictly necessary cookies required for the Service to function.

10. Children & Age Requirement

Sydael is strictly for users aged 18 and over. We collect and verify your date of birth at account creation. If you are under 18, you may not use Sydael. If we become aware that a person under 18 has registered, we will immediately delete their account and all associated personal data. If you believe this has occurred, contact us at privacy@sydael.com.

11. Automated Decision-Making & Profiling

Sydael Coach uses AI to generate personalised coaching responses based on your goals, mood signals, and profile data. This constitutes automated processing but does not produce legal or similarly significant effects on you — no automated decisions are made that affect your rights, access to services, or legal position.

The AI system does not evaluate creditworthiness, insurance risk, or employment suitability. Its outputs are informational and motivational in nature only.

12. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33 / UK GDPR)
  • Notify affected users without undue delay if the breach is likely to result in a high risk to your rights and freedoms (GDPR Art. 34)
  • Notify affected Indian users as required under the DPDP Act 2023
  • Notify California residents as required under the California breach notification law (Cal. Civ. Code § 1798.82)

If you believe your account has been compromised, contact privacy@sydael.com immediately.

13. Changes to This Policy

We will notify you of material changes via the app and/or email with at least 14 days' notice before they take effect. The current version is always accessible at sydael.com/privacy.

14. Contact

For all privacy questions, data requests, or complaints:

Grievance Officer — Sydael
Email: privacy@sydael.com
Response: within 24 hours · Resolution: within 15 business days

Version 2.1 · 7 August 2026View full Terms of Service