GDPR / AVG, AI Act and NIS2 at Synomi

1. Two roles — who is in charge of what?

Under the GDPR (in the Netherlands: the AVG), Synomi acts in two roles:

• Controller — for your account data (name, email, company details, payment details, system logs). We collect, process and encrypt this data to be able to provide the service to you at all.
• Processor — for everything you enter into Synomi as part of your business (your clients’ details, invoices, documents, GPS routes). You are the controller of this data — we process it solely on your instructions. We look after it on your behalf and encrypt it too, but you are the one who manages it.

The agreement covering how we handle your data (verwerkersovereenkomst — a data processing agreement) is built into the Synomi Terms of Service (section 9) — you don’t need to sign a separate document.

2. Where does your data live?

• On our own server in a Dutch data centre — not in some anonymous cloud
• Company data is encrypted at rest, with a separate key for every company; connections are secured with SSL/TLS
• Regular backups and security updates
• No ads, no trackers, no selling data — not on the website and not in the mobile app

3. Your rights

Under the GDPR / AVG you have the right to: access your data, have it corrected or erased (“the right to be forgotten”), restrict its processing, take it with you (data portability), object, and withdraw your consent at any time.

How do you use these rights? Email hello@synomi.ai — that’s all it takes. You also have the right to lodge a complaint with the Dutch supervisory authority: the Autoriteit Persoonsgegevens.

4. Deleting your account

You can delete your account yourself, in the app (Profile → Delete account). You can also request deletion by email: write to support@synomi.ai from the email address linked to your account — before we start the procedure, we’ll confirm your request with a reply.

From that moment a 30-day grace period begins — during that time you can change your mind simply by logging in again. After 30 days your data is deleted permanently and irreversibly.

Before you delete, download your data (PDF/XML/Excel exports) — the obligation to keep your own accounting records for 7 years rests with you. Details: Privacy Policy, section 9.

5. Who do we share data with — and what data?

Only trusted sub-processors, only for the features you actually use — and only the data without which a given feature simply wouldn’t work:

• Mollie (payments) — the data needed to process your payment. We don’t store card details at all — Mollie alone handles those.
• Anthropic (AI features) — photos of receipts and invoices during OCR scanning, the text of voice commands (the transcript only — never the audio recording; speech is recognised on your device), and only those questions to Daisy that require external processing. Requests are not linked to any individual user, and Anthropic does not train models on your data.
• Google — only if you switch it on: with Google sign-in we receive your email and basic profile details from Google; with Google Calendar sync we add Synomi events (payment deadlines, appointments) to your calendar and read events back so we can display them.
• Apple — only if you switch it on: with Sign in with Apple we receive an identifier and — if you choose to share it — your email (which Apple may anonymise); iCloud calendar sync works just like Google’s.

Transfers outside the European Economic Area rely on Standard Contractual Clauses (SCC). We do not sell data. The full list and details: Privacy Policy, section 6.

6. Cookies

We use only essential technical cookies (logging in, security, preferences) — no analytics and no advertising cookies. Details: Privacy Policy, section 5.

7. Artificial intelligence at Synomi (AI Act)

From 2 August 2026 the EU's AI transparency rules (the AI Act) will apply across the Union — Synomi already meets these requirements today. At Synomi, artificial intelligence works in a few places: Daisy answers questions and suggests expense categories, Voice-to-Invoice turns your voice into an invoice, and OCR reads receipts and invoices from a photo.

Our overriding principle in every process is human in the loop — a human always has the final say, and everything requires your conscious approval. In practice:

• AI suggests — you decide. No AI feature makes decisions for you or issues documents on its own. OCR fills in a form that you check; Daisy suggests but never blocks; a voice invoice is a draft that you approve.
• You always know it's AI. Daisy doesn't pretend to be human — she is openly an AI assistant and introduces herself as one.
• A suggestion is not advice. Daisy's hints (e.g. "this expense may not be deductible") are pointers, not tax advice. Remember: every binding decision about your business is yours to make — on your own or together with your accountant.

Under the AI Act's classification, Synomi's features are limited-risk systems — none of them evaluates people or decides about credit, employment or anything of the kind. Which data is sent out for processing by the AI features (and that it is never linked to you) — see section 5.

8. Cybersecurity (NIS2 / Cyberbeveiligingswet)

NIS2 is the EU cybersecurity directive — implemented in the Netherlands as the Cyberbeveiligingswet, which will come into force on 15 August 2026. It directly covers medium and large organisations in key sectors. Synomi, as a small company, is not directly subject to it — and we say so openly, instead of pinning a fashionable label on ourselves.

There is another side, though: organisations covered by NIS2 must keep an eye on the security of their suppliers. If you or your client fall under NIS2 and need a supplier that won't be the weak link — here is what you'll find at Synomi:

• Our own server in the Netherlands — your data doesn't drift through other people's clouds.
• Encryption with a separate key for every company — one key never opens anyone else's data.
• Two-factor authentication (2FA) and backups.
• Zero trackers and a short list of sub-processors (section 5).

Supply-chain security questions? Write to us: support@synomi.ai.

9. Contact