Data Processing Agreement

"Customer" means the person or organisation using Synapse, who decides why and how personal data in their workspace is used (a "Data Fiduciary" or controller). "YTT Global" means YTT Global Services, which processes that data on the Customer's behalf (a "Data Processor"). "Customer Personal Data" means personal data about other people that the Customer stores in Synapse, such as contacts, leads, job applicants, clients and message recipients. "Data Protection Law" means the data-protection laws that apply to the processing, including India's Digital Personal Data Protection Act, 2023.

This agreement applies when YTT Global processes Customer Personal Data in providing Synapse. The Customer is responsible for having the right to collect and use that data, for giving any notices and obtaining any consents the law requires, and for the instructions it gives. The details of the processing are in Annex A.

YTT Global will process Customer Personal Data only to provide, secure, support and maintain Synapse for the Customer and only on the Customer's documented instructions, which are these terms, the Terms of Service and the Customer's use of the features of Synapse. If the law requires other processing, we will tell the Customer first unless the law forbids it. If we believe an instruction breaks Data Protection Law, we will say so.

YTT Global will make sure that the people who can access Customer Personal Data are bound by confidentiality and may use it only as needed to provide Synapse.

YTT Global uses appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful loss, alteration, disclosure or access. The measures in place today are listed in Annex B. We review them as Synapse develops.

The Customer authorises YTT Global to use the service providers listed in section 5 of our Privacy Policy as sub-processors. Those that can handle Customer Personal Data are: Supabase (database and file storage), Cloudflare (hosting, network delivery and DNS), Amazon Web Services (SES and SNS, delivering the email and SMS the Customer sends) and Groq (only when the Customer uses an AI feature on such data). Clerk handles only account holders' sign-in data and Sentry receives technical error details, not content.

We choose sub-processors whose own terms restrict how they may use the data they handle for us, and we remain responsible for them. Before adding or replacing a sub-processor that would handle Customer Personal Data, we will tell the Customer by email or in-app notice at least 14 days ahead. The Customer may object in writing to privacy@ytt.global; if we cannot resolve the objection, the Customer may stop using Synapse and ask us to delete its data.

People may ask the Customer to access, correct or erase their personal data, or to withdraw consent. YTT Global will reasonably help the Customer respond, using the tools in Synapse where they exist and otherwise by email request to privacy@ytt.global. If someone asks us directly about data we hold for a Customer, we will pass the request to the Customer rather than answer it ourselves, unless the law requires otherwise. The Customer remains responsible for responding.

If YTT Global becomes aware of a breach of security that leads to the loss, alteration or unauthorised disclosure of, or access to, Customer Personal Data, we will tell the Customer without undue delay, at the email address on its account, with the information we then have about what happened, what data is affected and what we are doing about it, and we will keep it updated as we learn more.

When the Customer stops using Synapse, or asks in writing, we will delete Customer Personal Data within 30 days, or return it on request within the 30 days after termination described in the Terms of Service, except where the law requires us to keep it longer. Copies in our infrastructure providers' backups are overwritten on their normal schedule.

Our sub-processors operate internationally, so Customer Personal Data may be processed outside the Customer's country, including in the United States. Where the law requires it, we make sure appropriate safeguards are in place, and we follow the cross-border transfer rules that apply to us.

On reasonable request, YTT Global will give the Customer the information reasonably needed to show that we are meeting this agreement, including written answers to reasonable security questionnaires. On-site audits are not available during the private beta.

This agreement is part of the Terms of Service, and the limits and exclusions of liability in the Terms apply to it. It is governed by the same law and courts as the Terms (the State of Georgia, United States), and nothing in it removes any right the Customer has under Data Protection Law that cannot be limited.

For data-protection questions or to ask for a signed copy of this agreement, write to privacy@ytt.global.

• Encryption in transit (TLS); our infrastructure providers encrypt stored data at rest.
• Each workspace's data is separated from every other workspace's, using database row-level security as a backstop and checks in the application.
• Access to data limited to people who need it; sign-in through a specialist provider, with additional verification available for accounts.
• An audit log of actions taken in each workspace.
• Rate limiting on the public, unauthenticated parts of the service.
• Error monitoring that is designed not to include content.
• Backups held by our database provider.