Privacy policy

Last updated: 18 October 2026

We use your email address to provide your Syntopy account, verify access and keep the service secure. Registering does not subscribe you to marketing. For privacy questions or account-deletion requests, contact [email protected].

Who is responsible

Wassim Jabi, operating Syntopy at syntopy.io, is the controller responsible for the personal information described in this policy. Contact: [email protected]. This policy covers the Syntopy website and its hosted applications, including TopologicLab, TopologicJourney and TopologicExplore.

Information we handle

• Account information: your email address, account identifier, email-verification status and information needed to authenticate your account. Auth0, part of Okta, handles account registration, passwords and verification. The analysis apps do not receive your password.
• Access and technical information: IP addresses, browser and device information, requested pages, request times, login outcomes and security events processed by our authentication, security and hosting services.
• Information you submit: messages sent to us and any details you include in uploaded floor plans, building models, filenames or analysis requests. Models can contain personal or confidential information; submit only information you are authorised to use.

Why we use it

We use account and submitted information to provide the account and analysis services you request, respond to enquiries and resolve problems. Where this processing is necessary to provide an agreed service, our lawful basis is performance of a contract or steps taken at your request before entering one.

We process necessary access and security information on the basis of legitimate interests: operating a reliable service, preventing misuse, diagnosing faults and protecting accounts and infrastructure. We also process information where necessary to meet a legal obligation. If we offer optional marketing, it will have a separate opt-in; account registration alone is not marketing consent.

Who receives information

We use Auth0/Okta for identity and verification, Cloudflare for access control, traffic delivery and security, and hosting and email providers to operate the service and handle correspondence. These providers process information needed for their roles. Uploaded analysis requests pass through the hosted service and its delivery infrastructure. If you choose a different analysis-service URL in an app, your models are sent to that service, whose privacy arrangements you should check.

We may disclose information when required by law or where necessary to investigate abuse or protect legal rights. Syntopy does not sell account email addresses.

Where information is processed

Our service providers operate internationally, so information may be processed outside the UK or your country. The applicable arrangements depend on the provider and service configuration. Provider data-processing terms describe their transfer safeguards, including contractual safeguards where applicable. Contact us for information about the arrangements relevant to your account. See Okta's privacy information and Cloudflare's privacy information.

How long information is kept

Account information is kept while your account is maintained and as needed to provide access. You can request account deletion by email. Information needed for an unresolved security incident, dispute or legal obligation may need to be retained after closure; it is limited to that purpose. Technical and authentication logs are retained according to the relevant service settings and the time needed for security, troubleshooting and legal requirements. Contact us for the retention information relevant to a particular record.

TopologicLab and TopologicJourney process uploaded geometry in temporary files and bounded, in-memory working caches, rather than providing a permanent model-storage service. Temporary import files are removed after import; cached working geometry is removed when evicted or the service restarts. Exported results you download remain under your control. Authentication logs, infrastructure logs, correspondence and account records have separate retention from the analysis cache.

TopologicExplore stores indexed model geometry and analysis results in temporary server workspace files. Uploaded IFC files are removed after import. Workspaces are deleted when you choose Clear workspace, after one hour without workspace activity while the service is running, or during normal service shutdown. Following an unexpected interruption, expired temporary workspaces are removed by the next service cleanup. This is not permanent model storage. The browser stores a temporary workspace access identifier in session storage.

Cookies and browser storage

Authentication and security services use cookies or similar storage to maintain sign-in, complete verification and protect requests. Blocking these can prevent access to the apps. These functions are necessary for the account access you request. This policy and its footer links do not add advertising or analytics trackers. Browser settings let you inspect and remove stored data; you can also log out of Cloudflare Access.

Your choices and rights

Providing an email address is required to create an account and use protected apps. You can browse public pages without registering. Depending on the applicable law and processing, you can request access, correction, deletion, restriction or a portable copy of your personal information. We may need to verify your identity before acting.

You have the right to object to processing based on legitimate interests. Contact [email protected] to exercise this right or ask about your information. If optional marketing is introduced, you may withdraw that consent at any time.

We do not use account information to make solely automated decisions with legal or similarly significant effects. Automated login rules enforce access eligibility; contact us if you believe access has been refused incorrectly.

You can complain to the UK Information Commissioner's Office, or your relevant local data-protection authority. You may contact us first, but do not have to do so.

Changes

We will update this page when our practices change and revise the date above. Material changes affecting account users will be brought to their attention where appropriate.