Privacy Policy

Version 1.4 · Effective August 2, 2026

Billy lives in your messages, so we take what you share with it seriously. This policy explains what we collect, why, who it goes to, how long we keep it, and the control you have. The short version: we collect what is needed to run Billy for you, we do not sell your data, we do not train AI models on it, and you can disconnect or delete at any time.

1. Who is responsible

Synka Labs Inc. ("Synka Labs", "we", "us"), a US company with offices in Stockholm, Sweden, is the data controller for personal data processed through Billy: our website, messaging experience and related features (the "Service").

2. Information we collect

• Account and identity. Your phone number, your email address, or both. They are how Billy identifies you and delivers messages, together with your name if you share it. If you sign in with Google, Google gives us your verified email address and name; we use them only to identify your account, and we do not keep a Google sign-in token.
• Messages. The conversations you have with Billy, including text, voice notes and attachments you send.
• Memory. The trackers, facts and context Billy builds from your conversations so it stays useful over time.
• Connected service data. If you connect Google, the mail, calendar and file data covered by the permissions you grant. Section 14 sets out exactly which permissions Billy asks for and why.
• Technical data. IP address, timestamps and error logs, used to keep the Service reliable and to limit abuse.

We do not collect payment data, and we do not buy personal data from other companies.

3. How we use your information

To run Billy: understand your request, retrieve what is needed, compose a reply or carry out the action you asked for, keep your habits and watches running, send the proactive updates you have turned on, and remember context so Billy stays useful over time. Technical data is used for security and rate limiting.

We do not sell your personal data and we do not use it for advertising.

4. Automated decisions and AI

Billy is an AI assistant, so most of what it does is automated. It interprets your messages, chooses which tools to use, drafts replies, and carries out the actions you ask for.

Billy asks you to confirm before doing something that is hard to undo, such as sending an email on your behalf. It does not make decisions that produce legal effects concerning you, or effects of similar significance. Billy can be wrong or incomplete, so review anything important before relying on it. If you want a person to look at something Billy did, contact us and we will review it.

5. Cookies and tracking

Billy sets one cookie, which keeps you signed in to the web app. It is strictly necessary for the Service to work and carries no tracking identifier.

We use no advertising cookies, no tracking pixels and no cross-site trackers, and we do not follow you across other websites. Because we set no non-essential cookies, there is no cookie banner to click through.

6. How we share your information

We do not sell your personal data. We share it with the service providers needed to run Billy, each under a contract limiting what they may do with it:

• Anthropic. The AI model behind Billy's reasoning and replies. Receives your messages and, when your request needs it, content retrieved from your connected services.
• Render. Application hosting and the managed database, in the EU (Frankfurt region).
• Google. The source of your connected Gmail, Calendar and Drive data, Maps for place and route lookups, and the identity check when you sign in with Google.
• Linq. The iMessage gateway that delivers messages between you and Billy.
• Voyage AI. Embeddings used for Billy's memory.
• Exa, SerpApi, Browserbase and API-Sports. Web search, structured lookups, page rendering and live scores. These receive query terms, not your connected service data.
• Vercel. Hosting for this website. It handles server logs only and does not touch Service data.

We also disclose personal data where the law requires it, for example in response to a valid request from a public authority, and where necessary to protect the rights, safety or property of our users or the public.

If you connect your own tools to Billy, data you direct to them is sent on your instruction and is governed by their terms.

7. Analytics and advertising

This website carries no analytics, no advertising technology and no third-party trackers. We do not share personal data for cross-context behavioural advertising, and we do not sell personal data as those terms are used in US state privacy laws.

8. How long we keep it

Data is pruned automatically once it passes a declared window, enforced by a daily retention job:

• Expired login codes, magic links, sessions and connection state: 1 to 7 days.
• Operational and diagnostic records: 14 to 90 days.
• Conversation history and the memory built from it: kept so Billy can remember context, up to 2 years, or sooner if you ask.

If you delete your account we delete your personal data within 30 days, except where we must keep something longer for legal or security reasons.

9. International transfers

Your data at rest is hosted in the EU (Frankfurt). Some of our providers are based in the United States. Where data leaves the EEA we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or Data Privacy Framework certification.

10. Your rights

You can ask us at any time to:

• Access or export your data. We provide a copy as a JSON export.
• Delete your account and the data associated with it.
• Correct your data, or withdraw a connection by disconnecting a service, which revokes Billy's access immediately.

Depending on where you live you may also object to or restrict processing. Deletion removes your data from Billy's systems. Copies that a provider saw while delivering a feature cannot always be recalled, and security audit records may be kept where the law permits.

To exercise a right, text Billy or email privacy@synka.ai. We respond within 30 days. You can also complain to your local data protection authority, which in Sweden is the Integritetsskyddsmyndigheten (IMY).

11. Legal bases

Where the GDPR applies we process your data to perform our contract with you (running the Service), on your consent (for example when you connect Google), to comply with legal obligations, and for our legitimate interests in keeping the Service secure.

12. Security

Connection tokens are encrypted at rest using AES-256-GCM. Session tokens are stored only as hashes. Traffic is encrypted in transit using TLS with HSTS. No system is perfectly secure, but we work to keep your data safe.

13. Security incidents

If we become aware of a security incident affecting your personal data, we investigate it, take steps to limit the impact, and notify you and the relevant supervisory authority where the law requires it.

14. Google user data

Billy asks only for the Google permissions covering sign-in and the services you switch on:

• Sign in with Google (openid, userinfo.email, userinfo.profile): to create or find your account when you choose Google sign-in, and to link your email to an existing account. Used only at sign-in; nothing from this permission is retained beyond your verified email address and name.
• Gmail (gmail.readonly, gmail.send): to read your mail so Billy can answer questions about it and act on it, and to send the mail you ask it to send.
• Gmail triage (gmail.modify): asked for separately, only when you first ask Billy to organize your mail - to mark a message read or unread, or to archive it, when you ask. Billy never deletes your mail.
• Calendar (calendar.readonly, calendar.events): to read your schedule and create or update the events you ask for.
• Drive (drive.readonly): to read files so Billy can answer questions about them.

Limited Use

Billy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google user data is used only to provide the assistant features you prompt, meaning reading, answering and acting on your mail, calendar and files in response to your requests.
• We do not sell it, use it for advertising, or transfer it to anyone other than the service providers needed to run the feature (section 6), each bound to equivalent protection.
• We do not use it to train generalized or non-personalized AI or machine learning models.
• Humans do not read your Google data, except with your affirmative agreement, for security, or where the law requires it.
• Google content is fetched per request to answer or act on what you asked. Where it appears in Billy's reply it becomes part of your conversation history and is kept under the window in Section 8, used only for the assistant features you prompt — never sold, never used for advertising or to train models, and never shared beyond the providers in Section 6. You can delete it at any time by asking.

15. Children

Billy is not for children. The Service is intended for people 18 and older, and we do not knowingly collect data from anyone under that age.

16. Links to other sites

Billy can return links to sites we do not control, and you may connect third-party services to it. This policy does not cover those sites and services, and their own policies apply.

17. Changes

We will update this policy as Billy evolves. If a change is material we will tell you before it takes effect, for example with a message from Billy or a notice on our site.

18. Contact

Synka Labs Inc. (a US company; offices in Stockholm, Sweden). Questions about privacy? Text Billy, or email privacy@synka.ai.