Privacy Policy

Who we are

Sylas is operated by Zephony Software Private Limited (“Sylas”, “we”, “us”, or “our”). This policy applies to the Sylas desktop application, website, customer dashboard, and related services.

Questions or privacy requests can be sent to support@getsylas.com.

Information we collect

Account and organization information

We process your name, email address, authentication details, organization and workspace membership, roles, permissions, devices, session records, and preferences so we can provide and secure your account.

Workspace and assistant information

We store the company files, their versions and drafts, comments, suggestions, permissions, and operational records needed to provide backup, sync, collaboration, and review. Assistant requests may include prompts, selected attachments, and the minimum workspace context needed to answer or perform the requested action.

Payments, support, and service records

We process plan, subscription, invoice, payment-status, support, security, and audit records. Payment providers process payment-card details under their own privacy policies; Sylas does not store complete card numbers.

Website and product analytics

We may collect device and browser information, approximate location derived from network information, referral data, pages and features used, app version, and reliability events. Product analytics exclude file contents, file names, paths, and prompts. Where enabled, session replay is privacy-masked: text, inputs, media, canvas content, network bodies, and console output are excluded. On the website, optional analytics remain off unless the current published policy permits a specific collection mode and your privacy choice allows it. An unknown or unavailable policy keeps collection off. Masked session replay has a separate choice and never starts from general analytics permission alone. You can object, withdraw, or later change either choice without sending earlier activity. The installed application separately keeps product analytics, masked session replay, and content-free reliability reports off until you explicitly turn them on. A content-free assistant failure report contains only a stable error code, the broad kind of failed step, app version, operating-system family, and whether a retry succeeded. It never contains prompts, file names, paths, file contents, workspace or conversation details, tool-call identifiers, account identifiers, raw errors, or desktop diagnostic logs. Operational logs needed for security, authentication, billing, auditability, and service reliability do not depend on this optional control.

This product includes GeoLite2 data created by MaxMind. Learn more at MaxMind.

Google account and Workspace data

If you sign in with Google, we receive the identity information needed to authenticate you, such as your Google account identifier, email address, email-verification status, name, and profile image when available.

If you separately connect a Google Workspace service, Sylas requests only the permissions shown on Google’s consent screen for the feature you choose. Depending on the plugin, this may include Gmail messages and attachments, Drive files and metadata, Calendar events and calendars, Docs or Sheets content, contacts, or directory information.

• Access and use. We use Google data only to provide the visible sign-in, search, read, draft, edit, export, and assistant features you request.
• Storage. Google plugin credentials are stored in protected operating-system storage on your device. Data read through a plugin may be held locally for the feature you request or become workspace content only when you deliberately save it there.
• Sharing. We do not sell Google user data or use it for advertising. When a requested assistant feature needs model processing, the minimum necessary context may be sent to our contracted model provider solely to produce that result. We do not permit Google user data to be used to train general-purpose models.
• Control and deletion. Disconnecting a Google service revokes its grant where Google supports revocation and removes the stored credential. You can also remove Sylas from your Google Account permissions. Contact us to request deletion of account data or other data associated with your use of Sylas.

Sylas’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How we use information

• Provide authentication, workspaces, collaboration, assistant features, integrations, billing, downloads, and support.
• Protect accounts, enforce permissions, investigate misuse, prevent fraud, and preserve auditability.
• Maintain reliability, diagnose failures, understand feature adoption, and improve Sylas without using customer content for advertising.
• Answer assistant requests. We never use your content to train AI models, and our AI providers process it under terms that do not allow them to train on it. Those providers may keep a request for a limited time to detect abuse before deleting it.
• Meet legal obligations and enforce our agreements.

Customer references

As described in our Terms of Service, we display an organization’s name and logo on Sylas-controlled websites and marketing materials only after an authorized representative gives us separate written permission, and only to identify it as a Sylas customer. This makes the organization’s identity public, but never includes customer content, confidential information, or the identity of an individual user.

An organization may withdraw this permission by emailing support@getsylas.com. Quotes, testimonials, case studies, screenshots, usage details, claimed results, and personal names or likenesses are published only with separate permission.

When we share information

We share information only as needed with:

• Service providers that host infrastructure, deliver email, process payments, or process AI requests for Sylas under contract. We run our own product analytics rather than sending it to an analytics company.
• Your organization and its authorized users, according to workspace permissions and the collaboration actions you take.
• Government authorities or other parties when required by law, necessary to protect rights and safety, or connected to a corporate transaction subject to appropriate safeguards.

We do not sell personal information.

Retention and deletion

Operational logs are kept for 30 days, content-free reliability reports for 90 days, product analytics for 12 months, and privacy-masked session replay for 30 days. Desktop diagnostic files stay on the device, are limited to 30 days and 20 MB, and are not uploaded automatically.

We keep information for as long as needed to provide the service, maintain security and audit integrity, resolve disputes, and meet legal obligations. Retention depends on the data and why we hold it. Workspace data remains until the workspace is deleted or the applicable account relationship ends, subject to backups, fraud-prevention records, legal requirements, and records that must remain to prevent deleted identities from being reused.

Activity records, such as sign-ins and permission changes, include the IP address and browser details they came from. We keep those details for 12 months, then remove them from the record.

When you delete your account, we immediately remove your email address, name, photo, and sign-in links, end your sessions, and delete the workspaces you own. Comments and other contributions you made in workspaces owned by others stay part of that workspace’s history, shown as from a deleted user. Encrypted backups expire on a rolling schedule, and deleted information can remain in them until they do, for up to one year.

To get a copy of your account data, or to request correction, restriction, objection, or deletion where applicable, email support@getsylas.com. We respond within one month and may need to verify your identity first. Content in a shared workspace is controlled by the organization that owns it, so users should contact their workspace owner, and we will help the owner respond.

Security and international processing

We use access controls, encryption in transit, protected credential storage, permission checks, audit records, and operational safeguards designed to protect information. No system is completely secure, so we cannot guarantee absolute security.

Sylas and its service providers may process information in countries other than yours. Where required, we use contractual and other safeguards for international transfers.

Children and changes to this policy

Sylas is a business service and is not directed to children under 18. We may update this policy as the service or law changes. We will post the updated date here and provide additional notice when a material change requires it.