Privacy policy

Synthcraft Web & Automation (hereafter «we»), operated by Atilla Firat BOZDOGAN, Chemin de Pierrefleur 37, 1004 Lausanne (VD), is the controller for the personal data collected through the platform app.synthcraft.dev and its subdomains. Contact: info@synthcraft.dev

When our agents answer the patients, clients or prospects of a business that uses our services — a medical practice, for example —, that business is the controller of their data. We then act as a processor, solely on its instructions and to provide it with the service. To exercise your rights over that data, preferably contact that business; if you write to us, we forward your request to it without delay.

We collect the following categories of data:

• Identification data: name, email address (when registering or getting in touch).
• Billing data: handled directly by Stripe; we have no access to card details.
• Conversation data: messages exchanged with the AI agents deployed for our clients (SMEs).
• Call data: recordings, transcripts and summaries of calls handled by the voice agent, appointment and callback requests.
• Technical data: IP address, browser type, pages visited, server logs.

Depending on the business called, a conversation may reveal sensitive data within the meaning of the FADP, in particular health-related data. Section 7 sets out the rules that apply to it.

• Providing the service (performance of the contract).
• Billing and subscription management (legal obligation / performance of the contract).
• Improving the platform and preventing fraud (legitimate interest).
• Sending transactional messages — quota limits, appointment confirmations (legitimate interest).

We neither sell nor rent any data, we do no advertising profiling, and no data is used to train AI models, neither by us nor by our providers.

To provide the service we rely on specialised providers, each bound by a data processing agreement and by contractual confidentiality commitments. They operate in the following categories:

• Hosting — database and application (European Union).
• Language model — generating the agent’s answers, written and spoken.
• Telephony and SMS — the voice agent’s lines, confirmations and reminders.
• Speech processing — call transcription and speech synthesis.
• Transactional email — notifications and quota alerts.
• Calendar — availability and appointment booking.
• Payment — Stripe, PCI-DSS certified. We neither see nor store your card details.

The named and up-to-date list of these providers is in the data processing annex of the terms of use, and you can obtain it at any time by writing to info@synthcraft.dev. If you are a client, you are notified of any change 30 days in advance and may cancel free of charge if you refuse it.

Some of our processors are established outside the European Economic Area (EEA) and Switzerland, notably in the United States. When your personal data is transferred to those countries, we make sure the transfer is covered by appropriate safeguards in accordance with Chapter V of the GDPR and the Swiss Federal Act on Data Protection (revFADP):

• the Standard Contractual Clauses (SCC) adopted by the European Commission, supplemented where applicable by the clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC);
• certification under the EU–US Data Privacy Framework (DPF) and its Swiss extension, where the processor participates in it;
• a data processing agreement concluded with each processor.

As of today, the database and the application are hosted in the European Union (Frankfurt region). Language model, telephony and SMS, speech processing, transactional email and calendar services are provided by processors established in the United States. The detail per provider is in the data processing annex of the terms of use.

You can obtain a copy of the safeguards in place by contacting us at info@synthcraft.dev.

Calls handled by the voice agent are recorded and transcribed, so the business called can check what was said and call the person back. The agent announces this in its opening sentence, before any exchange, in accordance with art. 179ter of the Swiss Criminal Code. Anyone who does not wish to be recorded can end the call and reach the business through another channel.

Recordings are kept for 90 days, then deleted. Summaries and transcripts are kept for the duration of the relevant business’s subscription. Neither recordings nor transcripts are used to train models.

Many of our clients are practices and health centres. Their patients’ data is handled under the following rules:

• It is processed only on behalf of the practice, on its instructions, and never for our own purposes.
• Where the practice is bound by professional secrecy (art. 321 of the Swiss Criminal Code), we act as an auxiliary bound by the same secrecy, as does anyone we authorise to access that data.
• No patient data is disclosed to a third party without the practice’s instruction, unless the law requires it.
• Each institution can sign a confidentiality agreement with us that sets out these commitments in detail and makes them enforceable; simply ask at info@synthcraft.dev.

We apply the following technical and organisational measures:

• Encryption: all communications are encrypted in transit (TLS); data is encrypted at rest by the hosting provider.
• Access secrets: passwords our clients entrust to us (a mailbox, for example) are additionally encrypted by us (AES-256-GCM), with a key kept outside the database.
• Isolation: each client is isolated at database level; an account can technically read only its own business’s data.
• Restricted access: only the operator holds administrator access, and opens the content of a call or conversation only to answer a client’s request, handle an incident or meet a legal obligation.
• Minimisation: we collect only the data the service needs, and call recordings are deleted automatically after 90 days.

In the event of a data security breach, we inform the client businesses concerned without delay, and at the latest within 48 hours; where the breach is likely to result in a high risk for the people concerned, it is reported to the Federal Data Protection and Information Commissioner (art. 24 FADP), and the people concerned are informed where the law requires it.

Account data is kept for the duration of the subscription and up to 30 days after it ends, unless a legal obligation requires otherwise. During that period the client business can request an export of its data; the data is then deleted. Technical logs are deleted after 90 days.

Under the Swiss FADP (and the GDPR where it applies), you have the rights of access, rectification, erasure, portability and objection, as well as the right to withdraw any consent given at any time. To exercise them, contact us at info@synthcraft.dev. We answer free of charge, within 30 days.

If you believe your data is not being processed lawfully, you can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or, in the European Union, with the supervisory authority of your country.

We use only the cookies strictly necessary for the platform to work (authentication session). No advertising or third-party tracking cookies are set.

We reserve the right to change this policy. In the event of a substantial change, we will inform you by email or through the dashboard.