Privacy Policy
Effective date: November 4, 2026
This Privacy Policy explains how Synapse Code(owned and operated by Sole
Proprietor
Valentyn Morozov, Ukraine), with website
https://www.synapse-code.io/ (the “Site”), collects, uses, discloses, and
safeguards
information about visitors, prospects, and business contacts.
1) Who we are (Controller)
-
Controller: Sole Proprietor Valentyn Morozov,
Ukraine
-
Registered address: 9 Saliutna St, Apt 30, Kyiv, 02000, Ukraine
- Contact email for privacy: info@synapse-code.io
- EU/UK representative (if applicable): (not appointed)
- Data Protection Officer (if appointed): (not appointed)
2) Scope
This Policy applies to personal data we collect through the Site (e.g., contact forms, newsletter
sign‑ups, recruitment pages) and from standard marketing activities (e.g., events, referrals,
LinkedIn outreach). If we provide custom software or integration services to a client,
processing of client data is governed by our service contracts and any applicable Data
Processing Agreement (DPA), not this Policy.
3) What we collect
a) Information you provide
- Contact form submissions (name, work email, company, phone, message)
- Newsletter subscriptions (email, preferences)
- Meeting bookings (name, email, availability)
- Careers applications (CV/resume, links, cover letter, eligibility information)
- Any other information you choose to provide
b) Information collected automatically
- Device and usage data (IP address, browser type/version, device IDs, pages viewed,
timestamps, referral URLs)
- Cookies and similar technologies (see Cookies below)
- Interaction data when you open a short link on the Site (see Short links and link analytics below)
c) Information from third parties
- Business contact data from partners or public/professional sources (e.g., LinkedIn)
- Analytics/advertising partners’ aggregated reports (non-identifying)
We do not knowingly collect special category data via the Site (e.g., health, biometrics,
religious
beliefs).
4) Purposes and legal bases (GDPR/UK GDPR)
We process personal data only where a legal basis applies:
- To respond to inquiries, book meetings, and provide proposals —
Legitimate Interests (to operate and grow our B2B services) and/or
Contract if you request pre‑contractual steps.
- To send newsletters or marketing — Consent (where
required). You may opt out at any time via unsubscribe links or by emailing us.
- To improve the Site and services (analytics, security, debugging) —
Legitimate Interests.
- To redirect short links, count openings, estimate unique reach, and detect
automated or abusive traffic — Legitimate Interests (to
measure the performance of links we publish and keep them free from fraud and bots).
You can object to this processing at any time (see Your rights).
- To comply with law — Legal Obligation (e.g.,
accounting, record‑keeping).
Where we rely on consent, you can withdraw it at any time without
affecting prior processing.
5) Cookies & similar technologies
We use cookies and comparable technologies to:
- Remember preferences and improve Site functionality
- Perform analytics and measure traffic/performance (only after consent, where required)
- (Optional) Support advertising/retargeting (only after consent)
When you first visit, we present a cookie notice if non‑essential cookies are used. You
can manage preferences at any time via your browser settings and/or our cookie banner.
For details, see our Cookie Notice (link in footer).
We use Cloudflare Turnstile, a security service that verifies visitors are
human and protects our forms from bots and spam, operating in invisible mode (no visual
challenge or interaction required). Turnstile may process device and browser signals (e.g.,
IP address, browser characteristics) to perform this verification. See Cloudflare's
Turnstile Privacy Addendum
for details on how this data is handled.
6) Short links and link analytics
When you open one of our short links (addresses beginning with /s/), we
process limited technical data to perform the redirect, compute opening statistics, and
detect automated or abusive traffic. We do not use cookies, local storage, or browser-side
scripts for this, and we do not use third-party trackers on short links.
What we record for each request:
- the date and time of the request;
- the identifier of the short link;
- a classification of the request (for example, a regular opening, a browser prefetch, a
link-preview bot, or other automated traffic);
- for regular openings, a pseudonymous visitor identifier (see below).
How the visitor identifier works. To estimate how many different visitors
opened a link, we use a one-way pseudonymous identifier derived from your IP address and browser
characteristics. Raw IP addresses and User-Agent headers are not stored in our short-link
analytics records. The identifier is specific to each link, so we cannot follow you from one
link to another. It is pseudonymous, not anonymous: it lets us recognise repeated openings of the same
link from the same browser and network within the 90-day period below. Unique-visitor figures are
estimates, not counts of individual people.
Retention.
- Visitor identifiers are permanently erased after no more than 90 days.
- Interaction records and aggregate statistics (link ID, timestamp, request classification,
and daily visit counts) contain no IP address, User-Agent, or personal identifiers. They are anonymous
telemetry retained indefinitely for historical performance analytics.
Short-link tracking operates without cookies and does not store personal data alongside
analytics. Our hosting and network providers may still process IP addresses transiently to
deliver and protect the connection, as described in Information collected
automatically above.
Your choices. This processing is based on our legitimate interests. You
have the right to object to it and to ask us to erase your identifier before the 90 days
are over. Because the identifier cannot be reversed to your IP address, we need the short
link, your IP address and your browser's User-Agent to find it: with those, we can
recompute the identifier and erase it immediately. Contact us at
info@synapse-code.io and we will help where we
reasonably can. We do not sell this data, do not use it for advertising, and do not
combine it with other data to identify you.
7) Disclosures of personal data
We share information only with:
- Service providers/processors assisting IT hosting, security (including
Cloudflare, for bot/spam protection via Turnstile), analytics, CRM/marketing, applicant
tracking, or communications (bound by contract to protect data and use it solely on our
instructions)
- Professional advisers (legal, accounting, insurers)
- Authorities when required by law or to protect rights, safety, and
security
- Business transfers in connection with a merger, acquisition, or asset
sale (subject to appropriate safeguards)
We do not sell your personal data. We do not allow processors to use your data for their
own unrelated purposes.
8) International transfers
If we transfer personal data outside the EEA/UK (e.g., to cloud providers), we rely on an
adequacy decision or appropriate safeguards such as the EU Standard Contractual
Clauses (SCCs) and the UK International Data Transfer Addendum.
Copies of relevant safeguards are available upon request, subject to redactions.
9) Data retention
We retain personal data only as long as necessary for the purposes described above, including
to meet legal, accounting, or reporting obligations. Typical retention periods:
- Marketing contacts: until you unsubscribe or we detect inactivity for 24 months
- Contact form inquiries and sales records: 2–6 years, depending on jurisdictional
requirements
- Recruitment records: 12–24 months (longer if hired, per HR records policies)
- Short link visitor identifiers: no longer than 90 days
- Short link interaction records (without identifiers): kept indefinitely as anonymous
statistics
10) Security
We implement reasonable technical and organizational measures to protect personal data,
including access controls, encryption in transit, and vendor due diligence. No method of
transmission or storage is 100% secure; we cannot guarantee absolute security.
11) Your rights (EEA/UK residents)
Subject to conditions and exemptions under GDPR/UK GDPR, you may:
- Access your personal data
- Correct inaccurate or incomplete data
- Delete your data (erasure)
- Restrict or object to processing
- Port your data (data portability)
- Withdraw consent where processing is based on consent
- Lodge a complaint with your local supervisory authority
To exercise rights, contact us at info@synapse-code.io. We may request verification of
identity and will respond within the time limits set by law.
12) California and other U.S. state privacy rights (if applicable)
If you are a California resident, the CPRA may grant rights to know, delete, correct, and opt
out of “sharing”/“selling” (we do not sell personal data). Similar rights may apply in other
states. To exercise, contact info@synapse-code.io and indicate your jurisdiction.
13) Children’s privacy
The Site is not intended for children under 16. We do not knowingly collect personal data
from children. If you believe a child has provided data, contact us to delete it.
14) Changes to this Policy
We may update this Policy from time to time. The updated version will be indicated by an
updated “Effective date” and will be effective when posted on the Site.
15) Contact us
Questions, requests, or complaints about this Policy or our practices can be sent to
info@synapse-code.io or by mail at: 9 Saliutna St, Apt 30, Kyiv, 02000, Ukraine.