This notice explains how Cybernetic Labs Ltd processes personal data when you use the SynkVault product platform, including tenant data management, knowledge graph processing, and AI-powered features.
1. Who we are
Cybernetic Labs Ltd ("we", "SynkVault"), registered in England & Wales, provides the SynkVault knowledge platform.
Our two roles:
- Controller — for your account data, billing, and our own operations.
- Processor — for content your organisation uploads (documents, knowledge bases, conversations). Your organisation is the controller of that content; its use is governed by our Data Processing Agreement. Direct content-related requests to your organisation's administrator.
2. What we collect
| Category | Data | Source |
|---|---|---|
| Account | Name, email, organisation membership, role, authentication identifiers, TOTP MFA enrolment | You / your org admin (Supabase Auth) |
| Content | Documents, knowledge-base entries, graph entities, search indexes, conversation history — may contain personal data your org uploads | Your organisation (processor role) |
| Billing | Subscription details, billing address, payment metadata (card data handled by Stripe, never stored by us) | You / Stripe |
| Usage & telemetry | Performance and error telemetry, server logs | Automatic (New Relic, EU ingest) |
| Extension capture | Page selections and URLs you explicitly capture via the SynkVault Chrome extension | You |
| Geolocation | Approximate location from IP address | Automatic (ipinfo.io) |
3. Why we process it (purposes & lawful bases)
| Purpose | Data | Lawful basis |
|---|---|---|
| Provide the service (auth, storage, search, graph) | Account, content | Contract (Art. 6(1)(b)) |
| AI features (classification, extraction, summarisation, chat) | Content | Contract |
| Billing and subscription management | Billing | Contract / legal obligation |
| Security, abuse prevention, service integrity | Account, telemetry | Legitimate interest |
| Performance monitoring | Telemetry | Legitimate interest |
4. AI processing disclosure
Content you submit may be processed by third-party AI providers to deliver AI features:
- LLM providers: OpenAI, Google (Gemini), Anthropic, OpenRouter (an aggregator routing to third-party model hosts).
- OCR: Google Document AI, pinned to the
euprocessing location.
We do not use your content to train our own models.
5. Where your data lives
| Store | Location | Data |
|---|---|---|
| Supabase (Postgres + Vault) | UK (London, eu-west-2) |
Account, billing, org config, secrets |
| SurrealDB Cloud | Ireland (aws-euw1) |
Content, graph, search, conversations |
GCP (europe-west2) |
UK (London) | Compute, transient processing |
Transfers outside the UK/EEA occur only to the AI providers in §4 and service providers in §6, under appropriate safeguards.
6. Who we share it with
We share personal data with the following categories of service provider: Supabase, SurrealDB, Google Cloud, OpenAI, Google Gemini, Anthropic, OpenRouter, New Relic, Stripe, ipinfo.io, Langfuse. We do not sell personal data.
7. How long we keep it
- Content in trash: purged according to your organisation's configured trash-retention period.
- Account/org data: deleted on organisation deletion, which removes the organisation record and its dedicated tenant database namespace.
- Backups: Supabase daily managed backups; deleted data persists until backup expiry.
8. Your rights
You have UK/EU GDPR rights: access, rectification, erasure, restriction, portability, objection, and complaint to the ICO (ico.org.uk) or your local supervisory authority.
How to exercise them: contact your organisation administrator, who can action account deletion directly, or contact us using the details in §12.
9. Security
TLS 1.2+ in transit, encryption at rest, row-level tenant isolation, per-organisation database namespaces, optional TOTP MFA, hardened infrastructure (further detail is set out in Annex II to our Data Processing Agreement).
10. Cookies & similar technologies
We use strictly necessary cookies for authentication and session management.
11. Changes to this notice
We will post updates here with a new version number and date. Material changes will be notified to your organisation administrator.
12. Contact us
For privacy questions or to exercise your rights, contact Cybernetic Labs Ltd at legal@cyberneticlabs.io. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.