Privacy policy

Who we are and our role

InfoQast is operated by Syntetiq Limited, a private limited company registered in Scotland under company number SC827265. Its registered office is 146 Newhaven Road, Edinburgh, United Kingdom, EH6 4PZ.

Syntetiq Limited is the controller for account administration, admission, service security, abuse prevention, support, and its own business records. For agency workspace and client-brand content that we process only on the agency's documented instructions, Syntetiq Limited acts as the agency's processor under the Data Processing Addendum. The agency remains responsible for its controller obligations to its staff, clients, and other data subjects.

Information we process

Account and admission data: name, email address, authentication and verification records, optional two-factor settings, access requests, invitations, legal-consent versions, workspace memberships, and role or grant information.

Workspace data: agency and client-brand profiles, briefs, sources, drafts, comments, approvals, campaigns, schedules, media, connected-channel identifiers, available metrics, and the actions recorded in the workspace audit trail.

Connection data: encrypted social-network or AI-provider credentials supplied by an authorised workspace administrator; OAuth client identifiers, approved MCP scopes, consent and revocation timestamps, short-lived token records, rate-limit and idempotency outcomes, and CLI connection state.

Service and support data: IP address and bounded security metadata, operational and error logs, support messages and attachments, notification delivery events, and aggregate usage or cost estimates. We do not use third-party advertising trackers and do not sell personal data.

Purposes and lawful bases

Contract and steps requested before contract: create and secure your account, provide the tenant-scoped workflow, execute instructions, deliver support, and administer the Open Beta relationship.

Legitimate interests: protect tenant isolation, prevent abuse and fraud, diagnose reliability, maintain a proportionate audit trail, improve the service from aggregate operational evidence, and establish or defend legal claims. We balance these interests against the rights of affected people and minimise the information used.

Legal obligation: keep or disclose records where UK law requires it. Consent: send optional marketing communications or use another feature that expressly asks for consent; consent can be withdrawn without affecting earlier lawful processing.

Where we act as a processor for workspace content, the agency determines the applicable lawful basis and gives us documented instructions through the service and Data Processing Addendum.

Developer connections, MCP, and CLI

Developer access is optional and disabled unless the required account, workspace preview, commercial, and global controls permit it. OAuth uses Authorization Code with S256 PKCE. MCP access tokens are access-only, expire after 15 minutes, and do not include refresh or offline access during Open Beta.

When you authorise a supported client, we disclose the result of the tool you invoke to that client. A result can include visible workspace or brand names, approval-queue content, bounded performance information, or a reviewable draft created from your brief. The MCP v1 interface cannot approve, schedule, publish, delete, administer users, export a workspace, or reveal social or AI credentials.

Draft generation may send your brief and selected workspace context to the AI provider configured for that workspace and may consume that workspace's BYO usage. You must be authorised by the agency and relevant client brand to send that information to the chosen client and configured provider.

ChatGPT, Claude, and other compatible clients process information they receive under the account, contract, and privacy terms you have with them. They may act as your separate provider; their inclusion here does not imply endorsement or directory listing. Revoking InfoQast access does not delete copies already received by that provider.

Who receives information

We disclose information only as needed to operate the service: infrastructure and encrypted-backup providers; transactional email and bounded error-monitoring providers; professional advisers; connected social networks; the AI provider configured by the workspace; and the MCP or CLI client deliberately authorised by the user.

A workspace administrator chooses social and AI connections. An individual chooses whether to authorise a developer client and which disclosed scopes to allow. We may disclose information to a court, regulator, law-enforcement body, or other recipient where law requires it or where necessary to protect legal rights.

Current core operations use London-hosted infrastructure, a transactional email provider, and client-side encrypted off-site backup storage. Optional network, AI, and developer-client recipients are used only when an authorised customer enables them. Contact support for the current recipient and subprocessor record relevant to your workspace.

Location and international transfers

The primary hosted service runs in London, United Kingdom. A connected social network, configured AI provider, transactional service, or user-selected developer client may process information outside the UK.

Where Syntetiq Limited initiates a restricted transfer, it relies on an applicable UK adequacy regulation or an appropriate contractual safeguard, such as the UK International Data Transfer Agreement or UK Addendum, together with the required data-protection test. If a customer independently selects and contracts with a provider, the customer remains responsible for its own transfer assessment and instructions. A transfer that lacks an applicable basis must not be enabled.

Retention and deletion

Account and active workspace information is retained while needed to provide the service. Account or workspace deletion starts the product's audited deletion workflow; operational history is anonymised where it must remain, and storage objects are removed through the durable deletion process and encrypted-backup rotation.

MCP access tokens expire after 15 minutes. Expired or revoked token rows become eligible for cleanup after 24 hours; Open Beta issues no MCP refresh token. Developer consent remains until the user revokes it or access is disabled. Security and workspace audit records retain bounded identifiers and outcomes, but not OAuth secrets or access tokens.

Open Beta retention controls minimise unverified support data after 7 days, access-request data after 90, 180, or 365 days depending on its state, terminal notification evidence after 180 days, and ordinary support history retained after account deletion after 365 days. Legal-hold, security-incident, tax, regulatory, and dispute records may be retained longer where necessary and access remains restricted.

Security and tenant boundaries

Workspaces are isolated per agency and brand access is checked within the workspace. Credentials are encrypted at rest, OAuth secrets are never shown in connection inventory or audit output, and the confidential remote-client secret is displayed only once to an authorised operator. The CLI stores its current credential in a local file restricted to the current operating-system user.

No internet service can guarantee absolute security. If you believe an account, token, or workspace is at risk, revoke the connection where available and contact support promptly.

Your choices and rights

You can inspect and revoke your developer clients under Settings → Developer access, disconnect configured providers, change membership through an administrator, unsubscribe from optional marketing, and request access, correction, export, restriction, objection, or deletion where the applicable data-protection law provides that right.

Rights depend on the lawful basis and whether Syntetiq Limited is controller or processor. For workspace content controlled by an agency, we may route the request to that agency and assist it. We may need to verify identity and may retain information that law or a valid legal hold requires us to keep.

You have the right to object to processing based on legitimate interests. We will stop unless we demonstrate compelling legitimate grounds or need the information for legal claims. You may complain to the UK Information Commissioner's Office or another competent supervisory authority.

Changes and contact

Material changes receive a new policy version and, where required, must be accepted before continued product access. Earlier consent evidence remains append-only so the accepted text can be identified.

Contact Syntetiq Limited through the InfoQast support service, through your existing business contact, or by post at the registered office above. Do not send passwords, OAuth tokens, private keys, or AI-provider credentials in a support message.