Privacy policy

At SYB we protect your information like it's our own. This policy explains what data we collect, what we use it for, and what rights you have over it.

1. Data we collect

• Account: email, name, language, country of residence.
• Business plan: questionnaire answers, idea, industry, capital, financial projections, roadmap and anything you upload to the workspace (tasks, employees, customers, expenses, investments, debts).
• Your customers' data: if you use bookings, the sales log or the database, you will store third-party information (name, phone, email, appointments, purchases). That data is yours and theirs: we only store and process it to provide the service. See section 11.
• Product usage: copilot messages, generated reports, competition analyses, basic navigation events for diagnostics.
• Phone: if you install the app and accept notifications, we store a device identifier so we can deliver them. It is not your phone number.
• Payments: card data NEVER touches our servers. The payment processor you choose handles it, and it is PCI-DSS compliant.

2. Encryption

All sensitive information (answers, reports, workspace, copilot conversations, competition analyses) is encrypted at the application layer with AES-256-GCM before being written to the database. The master key never lives in the database — even if someone dumps it, the data is unreadable without the key.

3. What we use your data for

• To provide the service (generate reports, manage your workspace, respond with the copilot).
• To process your subscription and prevent fraud.
• To improve the product (aggregated, anonymized metrics; never individualized content).
• To send essential notifications (plan changes, payment failures, legal updates). Marketing only if you opt in.

4. Artificial intelligence

When you talk to the copilot, generate a report, create content or use any AI feature, SYB sends the model provider the business data that request needs (for example sales, products, customers and what you type). We never send your passwords or payment details. We use their commercial APIs, not the free consumer versions: they are different products and handle data differently.

Today our main provider is DeepSeek (Hangzhou DeepSeek Artificial Intelligence, China). If it is unavailable, or for specific tasks, a request may go to OpenAI (US), Anthropic (US) or Moonshot AI (Kimi, China). To turn audio into text we use Groq or OpenAI (US). Each applies its own data-usage terms, which we do not control: that is why we send the minimum a feature needs.

We ask for your permission first. When you create your account (or the first time you sign in, if you signed up with Google or Apple) we ask whether you accept your data being processed this way. Until you accept, none of your data goes to any AI. You can withdraw permission anytime in Settings → Data: the rest of SYB (bookings, sales, stock, finances, team) keeps working without sending anything to any model.

5. Who we share with

These are the services involved. Some always act; others only if you turn on the matching feature.

• Always: hosting (Vercel, US), database (Supabase), transactional email (Resend), error monitoring (Sentry), and a rate-limiting service (Upstash) that sees IP addresses to stop abuse.
• AI providers: see section 4.
• If you enable phone notifications: Google Firebase, which delivers the alert to your device.
• If you enable WhatsApp booking confirmations:Meta receives your customer's phone number and the message text. That is the only way WhatsApp can deliver it.
• If you connect your ad account: Meta, to read your campaign metrics.
• If you pay for a plan: on the web, Paddle (which charges as a reseller); on your phone, Apple's App Store or Google Play. Your card details never go through our servers.
• If you use Chats video calls: LiveKit, which carries the call's audio and video.
• Authorities: only when compelled by a valid legal order.
• Never do we sell or rent your data.

6. Retention and deletion

While your account is active we keep your information. You can delete it yourself anytime from Settings → Data → Delete my account (on the web and in the app), or by emailing syb.app.meta@gmail.com from your account address: we erase it in full within 30 days, except records the law requires us to retain (billing, tax).

Keep anything you want first: each Database section exports right away as Excel, CSV or PDF, and you can request a copy of everything together in Settings → Data, which reaches your inbox within 2 days. Deletion cannot be undone. See the step by step.

7. Your rights

You have the right to access, correct, export or delete your data, and to object to specific processing. To exercise them, email us at syb.app.meta@gmail.com. We respond within 30 calendar days at most.

SYB processes personal data under Argentina's Personal Data Protection Law 25,326. The Agency for Access to Public Information (AAIP), as the supervisory authority, handles complaints and claims for breaches of data-protection rules. Data subjects may exercise the right of access free of charge at intervals of no less than six months (sec. 14(3), Law 25,326).

8. International transfer

Nearly all of our infrastructure sits outside Argentina: the US and the EU for hosting, database and email, and China in the case of one of the AI providers. Using SYB means your data travels to those countries.

9. Changes

If we update this policy we notify you by email before applying substantive changes and update the date at the bottom of the document.

10. Data controller and contact

The data controller is Agustin Ignacio Roldan, who operates the Start Your Business (SYB) service. For any privacy question email syb.app.meta@gmail.com.

11. Your customers' data

This part matters and is easy to miss. When you store customers, appointments or sales, you are holding data about other people, and towards them the responsible party is you, not SYB: we are the tool that stores it on your behalf and under your instructions.

Concretely, it is on you to:

• Have a legitimate reason to store that data, and tell your customers you do.
• Have their consent before sending them WhatsApp or email messages from SYB.
• Respond if one of them asks to see, correct or delete their data — you can do it from the Database, without asking us.

On our side: that data is encrypted just like yours, we never use it for anything other than providing the service, and it is deleted when you delete your account.

12. Prospects and your Gmail account

Prospects finds businesses that could be your customers on Google Maps (through the official Google Places API) and on their public websites. From Google we only store each place's identifier; everything else is requested again when needed.

If you connect your Gmail account, SYB asks for a single permission: send email on your behalf (gmail.send). We use it only to send, from your own account, the Prospects messages you approved or set to automatic, within the daily limit you chose. SYB does not read, store or analyze the email in your inbox, does not use that permission for anything else, does not share anything it gets from Google with anyone, and does not use it for advertising or to train AI models. We store the access Google grants encrypted, and you can remove it anytime from Prospects → Sending → “Disconnect” or from your Google account.

SYB's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Every Prospects email says who sends it and includes a link to stop receiving messages from that business. Anyone who asks is removed from that business's list for good.

13. Other accounts you can connect

They connect only if you ask, and you can disconnect them anytime from SYB or from each service's account. We store the access they grant encrypted and read what's needed to show you your data in SYB. We don't sell it or use it for advertising.

• Meta (Facebook, Instagram and WhatsApp): reply to your customers' messages from SYB, read your posts and ads with their numbers and, if you ask, pause them or change their budget.
• Google Calendar: add events to your calendar (calendar.events) and see which times are busy (calendar.freebusy) so nothing gets proposed on top of something else.
• Google Ads: read your campaigns and their numbers and, if you ask, create paused campaigns (adwords).
• YouTube: read your videos and their numbers (youtube.readonly). By connecting it you accept the YouTube Terms of Service, and the Google Privacy Policy applies. You can remove the permission from your Google account security settings.
• TikTok: read your campaigns, your videos and their numbers.

What comes from those accounts goes through our AI providers only when you use a feature that needs it, such as the Copilot or the Chats analyzer.