Your data stays yours. By contract.
Data Controller
The data controller for the S0 platform is Mooncyan, LLC ("SyncZero", "we", "us"), a Delaware limited liability company.
Privacy contact: [email protected]. Data Protection Officer: not currently appointed; the privacy inbox reaches the responsible team directly.
This Policy explains how we collect, use, store, and share personal information when you use the S0 website and web application (the "Service"), and the rights you have. By using the Service you acknowledge this Policy. If a separate agreement signed with an enterprise customer provides otherwise, that agreement prevails for the matters it covers.
Information We Collect
Email address, name, and avatar used at registration and login. Passwords are stored only in irreversible hashed form; we cannot view your original password.
When you log in with a provider such as GitHub, we receive the public nickname, email address, and avatar the provider supplies, used only to create and access your account.
Organization name, membership, roles, and permission configuration.
Business objects, materials, memory, session content, files, and execution records that you and your organization create in the Service. This data belongs to you; we process it only as a processor on your instructions (see Terms of Service §04 and the Data Sovereignty page).
Transaction amounts, plan, and payment status. We do not store full card numbers — card data is handled exclusively by our PCI-DSS-compliant payment processor, Waffo Pancake (see §05).
IP address, device and browser type, time zone, pages and features used, operation logs, and session duration. Execution trace records within this data also power the audit features the Service provides to you.
Emails, tickets, and feedback you send us, and any details you submit through website forms.
We do not actively collect sensitive personal information. If Customer Data contains personal information, you or your organization are responsible for having the authority to process it; we process it only on your documented instructions.
How We Use Information
Legal basis: performance of a contract.
Legal basis: performance of a contract.
Legal basis: contract / legitimate interests.
Legal basis: legitimate interests.
Legal basis: legitimate interests.
Legal basis: legitimate interests.
Legal basis: legal obligation.
Legal basis: your consent. See §09.
We may aggregate or de-identify data for statistical analysis; such data no longer identifies any individual.
Cookies and Tracking
You can adjust cookie preferences in your browser settings. If we add third-party analytics tools, we name them here and link to their own privacy policies.
Sign-in state and core functionality. Cannot be disabled.
Preferences such as language and display settings. Can be disabled.
Anonymous usage statistics that help us improve the product. Can be disabled.
Sharing and Disclosure
We do not sell your personal information, including as "sale" is defined under laws such as the CCPA. We share information only in these circumstances:
- Service providers. Cloud hosting, payment, support, and analytics vendors bound by confidentiality obligations. Payment card data is processed exclusively by Waffo Pancake, our PCI-DSS-compliant payment processor, and is never stored on our servers.
- Legal and regulatory requirements. Where required by law, court order, or a lawful request from a competent authority.
- Business transfers. In a merger, acquisition, or similar transaction, with prior notice and continued protection obligations.
- With your consent. For any other purpose you explicitly approve in advance.
Data Security
- Encryption in transit (TLS/HTTPS).
- Passwords and comparable secrets stored hashed or encrypted.
- Access control on least-privilege principles; staff are bound by confidentiality obligations.
- Regular security audits and vulnerability scanning.
If a security incident affects your rights, we will notify you and the relevant regulator within 72 hours of discovery where the law requires it. Keep your account credentials safe and do not share them.
Retention
Kept while your account is active; deleted or anonymized within 90 days after account deletion.
Kept as required by tax and accounting law, typically 5 years.
Kept for 2 years, then securely deleted.
Kept for 12 months, then securely deleted.
Kept while your account is active; deleted within 90 days after account deletion, unless you request earlier deletion.
Your Rights
To exercise any of the following rights, contact us at [email protected]. We respond within 30 calendar days.
- Be informed — know what data we collect and how we use it.
- Access — obtain a copy of your personal information.
- Rectification — correct inaccurate or incomplete information.
- Erasure — request deletion of your data under applicable conditions.
- Restriction — pause processing in certain circumstances.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests or for marketing.
- Withdraw consent — withdraw consent-based processing at any time.
If you believe we have not handled your request properly, you have the right to complain to your local data protection authority.
Marketing Communications
With your consent, we may send product news and related marketing by email. You can opt out at any time via the unsubscribe link in any marketing email, your account settings, or by contacting us. Opting out does not affect service-essential notices such as billing and security alerts.
International Transfers
Our servers and vendors may be located in multiple countries. Where personal information is transferred across borders, we protect it through data processing agreements incorporating appropriate safeguards, such as EU Standard Contractual Clauses, and we transfer only to recipients offering an equivalent level of protection.
Children
The Service is intended for users aged 16 and above. We do not knowingly collect information from anyone below that age. If you believe a child has provided us information, contact us and we will delete it promptly.
Third-Party Links and Services
The Service may contain links to, or integrations with, third-party services. This Policy covers only information we collect directly; we are not responsible for third-party data practices. Review their policies before use.
Changes to This Policy
For material changes, we will notify you at least 15 days in advance via an in-product notice or your registered email, and update the date at the top of this page. Continued use after the effective date constitutes acceptance.