Privacy Policy
1) Who We Are (Data Controller)
Controller: iFRAME OE
Address: Kristalli 1, 45221 Ioannina, Greece
VAT: EL997861806
GEMI: 017053349000
Email: info@sinqlo.com
Phone: +30 26510 65744
When you use Sinqlo to process personal data about other people, such as clients, teammates or people you share with, we act as your processor under our Data Processing Agreement.
2) Scope
This policy applies to visitors and registered users of our Service. It covers data collected through our website, app pages, forms, and the integrations we use to operate the Service.
3) What Data We Collect
3.1 Account & Authentication Data
Google Sign-In (OAuth): When you sign in with Google, we receive your basic Google profile information (such as name, email, and profile photo) and a unique identifier, as authorized by you. We do not receive your Google password.
Credentials & Sessions: We store the tokens and IDs needed to keep your session secure.
3.2 Content You Upload
Logos and brand assets, filenames, metadata, and the settings you choose in the app.
3.3 Usage & Device Data
Web app (app.sinqlo.com): We use two cookieless analytics tools to understand how Sinqlo is used and to improve it:
- PostHog (hosted in the EU, Frankfurt) records the pages you visit, the buttons and links you click, where you click and scroll on a page (for heatmaps), a few key actions (signing up, creating a brand kit, starting a checkout), page-speed measurements, and your browser and device type. To tell visits apart without cookies, PostHog combines your IP address and browser details with a secret value that changes every day and turns them into a one-way code (a hash). This lets us see which steps one visitor took on the same day, for example from signing up to creating a brand kit. The next day you get a new code, and the codes can’t be turned back into your IP address. PostHog doesn’t store your IP address, doesn’t link these events to your name or email address, and doesn’t record your screen.
- Vercel Web Analytics counts page views without cookies and without storing your IP address.
Neither tool sets cookies or stores anything on your device. The only exception is a small note that remembers your choice if you turn analytics off or back on (see section 7.1). We don’t use Google Analytics, Microsoft Clarity or any advertising trackers in the app.
Marketing website (sinqlo.com): With your consent, Google Analytics 4 and Microsoft Clarity record page views, clicks, device and browser type, and approximate location derived from your IP address. Without consent, Google Analytics receives only cookieless, aggregate signals.
Technical logs: Error logs, performance metrics and diagnostic data used for reliability and security.
3.4 Support & Communications
Emails and support conversations, including any attachments you send us.
3.5 Billing Data
If you subscribe to a paid plan: name, company, email, billing address, VAT number and payment method (handled by Stripe; we never see your full card number), plus the invoices we issue.
4) Why We Use Your Data (Purposes & Legal Bases)
Provide the Service and your account (Contract performance): authentication, sessions, and saving and delivering logo assets.
Security and fraud prevention (Legitimate interests / Legal obligations): protect accounts, prevent abuse, and keep the Service intact.
Improve the Service through analytics: in the web app, our legitimate interest in understanding how Sinqlo is used so we can fix problems and improve it (GDPR Art. 6(1)(f)), using cookieless analytics only. You can object at any time by turning analytics off (see section 7.3). On sinqlo.com: your consent (see section 7.4).
Communicate with you (Contract / Legitimate interests / Consent): service updates, support responses, and important notices.
Legal compliance (Legal obligation): tax, accounting, and regulatory requirements.
5) Permissions and Licenses for Content You Upload
You are responsible for the logos and brand assets you upload to Sinqlo. Before you upload any file, you must hold all rights, permissions, and licenses needed to store, process, and share that file through the Service. This includes any rights held by clients, employers, or other third parties whose marks or assets appear in the file. Do not upload content you are not authorized to use. If you upload a logo on behalf of a client or company, you confirm that you have their permission to do so. You remain responsible for making sure that your use of Sinqlo, and the files you add to it, does not infringe anyone else’s intellectual property or other rights.
6) AI Agents
We do not use your logos, brand assets or any other content you upload to train AI models. This applies to every file you add to Sinqlo, including logos, variations, colors, fonts and notes. The AI Assistant runs on our own systems and does not send your files to outside AI providers.
7) Cookies & Similar Technologies
We use as few cookies as we can. The web app stores only what it needs to work, and its analytics are cookieless. Analytics cookies are used only on our marketing website, and only with your consent.
7.1 Strictly necessary (no consent needed)
- Sign-in session (browser storage set by Supabase): keeps you signed in, including after Google Sign-In.
_GRECAPTCHA(Google reCAPTCHA Enterprise): protects sign-up, sign-in and forms from bots.- Cookie notice (
sinqlo-cookie-consent, browser storage): remembers that you’ve seen our cookie notice. - Analytics choice (
sinqlo-analytics-off, browser storage, and__ph_opt_in_out_<ID>, browser storage set by PostHog): saved only if you turn analytics off or back on, so we respect your choice on your next visit.
7.2 Cookieless analytics in the web app
PostHog and Vercel Web Analytics (see section 3.3) don’t set cookies or store anything on your device, apart from the analytics choice in section 7.1. PostHog recognises a visit for one day using the daily code described in section 3.3.
7.3 Turning off analytics in the web app
You can turn off PostHog analytics at any time with Turn off analytics in the cookie notice or in the app’s footer, and turn it back on the same way. If your browser sends a Global Privacy Control signal, we treat it as a request to turn analytics off and don’t load PostHog at all.
7.4 Analytics, sinqlo.com only (with your consent)
_ga,_ga_<ID>(Google Analytics 4): distinguish visitors and sessions. Up to 14 months._clck,_clsk(Microsoft Clarity): show how pages are used, such as clicks and scrolling. Up to 1 year.
You can accept or reject analytics cookies in the banner on sinqlo.com and change your choice at any time from the footer. Rejecting them doesn’t affect the app. See our Cookie Policy for details.
8) Who Processes Your Data for Us
We use the service providers below to run Sinqlo. Each one processes personal data only on our instructions and under a data processing agreement (DPA). Where a provider is outside the European Economic Area, transfers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Supabase Inc. | Database, user accounts, file storage, server functions | Account details, uploaded logos and files, usage records | EU (Stockholm, Sweden) |
| PostHog Inc. | Product analytics for the Sinqlo web app (cookieless) | Pages visited, clicks, key actions, browser and device type, a daily one-way visitor code (no IP address, name or email stored) | EU (Frankfurt, Germany) |
| Vercel Inc. | Hosts the Sinqlo web app; privacy-friendly, cookieless page analytics | IP address (not stored by analytics), pages visited | USA / global edge network |
| Stripe Payments Europe Ltd. | Payment processing and subscriptions | Name, email, billing address, payment method, VAT number | EU / USA |
| Elorus (Elorus S.A.) | Issues invoices and submits them to the Greek tax authority (AADE myDATA) | Name, company, billing address, VAT number, invoice amounts | EU (Greece) |
| Resend Inc. | Sends account and service emails | Email address, name, email content | USA |
| Kit (ConvertKit LLC) | Newsletter, only if you opted in | Email address, first and last name | USA |
| Google LLC (reCAPTCHA Enterprise) | Protects sign-up and sign-in from bots | IP address, browser and device signals | USA |
| Google LLC (Google Analytics 4) and Microsoft (Clarity) | Analytics on our marketing website sinqlo.com. Analytics cookies and Clarity load only with your consent; without it, Google Analytics receives only cookieless, aggregate signals | Cookie identifiers, pages visited, interactions | USA |
Google Sign-In: If you sign in with Google, Google may act as a processor or controller for the OAuth flow, according to Google’s terms and your Google settings.
Connectors (Studio plan and up): If you connect Notion, Slack or Google Drive, we send the brand assets you choose to that service. When one of those assets changes, we automatically send the updated version until you disconnect. Anyone with access to the destination, such as members of a Slack channel or a shared Notion page, can see what we send. We store the access tokens needed for each connection and delete them when you disconnect or delete your account. Those services handle the data under their own privacy policies.
Google user data: Sinqlo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Figma plugin: The Sinqlo plugin for Figma signs in to your Sinqlo account and loads your logos and colors into the Figma file you’re working in. Assets you place in a Figma file are then stored by Figma under its own terms.
MCP server / AI agents: If you or a teammate create an API key and connect it to an AI tool (such as Claude, Cursor or Windsurf), that tool can read all brands in your account: logos, colors, fonts, guidelines, notes, share links and basic account usage (plan, logo count, storage). Logo download links it receives expire after one hour. The connection is read-only: it cannot change or delete anything in your library. We store API keys only in hashed form, and you can revoke a key at any time in Settings → API Keys. Once data reaches a tool you connect, its use is governed by that tool’s own terms and privacy policy, not this one. Some AI tools may use what you send them to train their models; check their settings.
Sharing your brand kits: You can share a logo or brand kit as a link, by email or as a QR code. Anyone with the link, or anyone who scans the QR code, can view the assets you chose to share, unless you protect them with an access code.
Share view notifications: When someone views a logo you shared, we notify you. If the viewer is signed in to Sinqlo, the notification includes their email address. Anonymous viewers appear as “Someone”.
Emails to your recipients: When you share by email, you give us the recipient’s email address, and we send them the link through our email provider (Resend). We use that address only to deliver your share. We don’t store it in Sinqlo afterwards, and we don’t track whether the email is opened. Resend keeps delivery logs for a limited time (see section 10). Make sure you have a reason to contact the people you send to.
Legal/Compliance: We may disclose information if required by law, regulation, or legal process, or to protect rights, safety, and security.
Business transfers: In a merger, acquisition, or sale of assets, your data may be transferred, with notice where the law requires it.
We do not sell your personal data and we do not use it for advertising.
9) Emails We Send
Service emails (account confirmation, password reset, receipts, invoices, payment problems, team invitations, subscription changes) are needed to run your account. You can’t opt out of them while your account is active.
Onboarding emails: In your first week, we may send up to two short emails to help you set up your first brand kit. They stop as soon as you upload a logo, and each one has a link to turn them off. Legal basis: our legitimate interest in helping you use the account you signed up for.
Newsletter: We only add you to our newsletter if you tick the box when you sign up, or subscribe later. Every newsletter has an unsubscribe link, and deleting your account also unsubscribes you. Legal basis: your consent.
No open tracking: Our emails don’t contain tracking images, and we don’t record whether you open them.
10) How Long We Keep Your Data
| Data | How long |
|---|---|
| Account, profile, logos, brand kits and uploaded files | Until you delete them or delete your account |
| Connected-service tokens (Google Drive, Notion, Slack, MCP) | Until you disconnect the service or delete your account |
| Database backups | Up to 7 days after deletion, then overwritten |
| Invoices and billing records | At least 5 years after the end of the financial year, as Greek tax law requires. These records are kept even after account deletion. |
| Security logs (sign-in and access attempts, IP addresses) | 90 days, then deleted automatically. After account deletion they are no longer linked to you, and they are deleted within 90 days. |
| Newsletter subscription | Until you unsubscribe or delete your account. Our newsletter provider then keeps your address on a suppression list only, so you aren’t added again by mistake. Email us to have it erased completely. |
| Support emails | 2 years after the conversation ends |
| Logs of emails we send (Resend) | Up to 30 days, set by our email provider |
| Share records (which logo was shared, when, and by whom) | Until you delete the share, the logo or your account |
| App usage analytics (PostHog) | 1 year, then deleted automatically |
| Marketing-site analytics (Google Analytics) | Event data: 2 months. User data: 14 months, reset each time you visit again. |
We may keep anonymized data, which can no longer identify you, for longer-term analytics and Service improvement.
11) Deleting Your Account
You can delete your account at any time from Profile → Delete Account. When you do:
- any active subscription is cancelled immediately;
- your profile, logos, brand kits, uploaded files, shares, team invitations, connected-service tokens and activity history are permanently deleted;
- you are unsubscribed from our newsletter.
We keep only what the law requires: invoices and billing records (see above), plus security logs that are no longer linked to your account.
12) International Data Transfers
We may transfer, store, and process information outside your country of residence. Where required, we rely on lawful transfer mechanisms, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, and apply appropriate safeguards.
13) Your Rights and How to Exercise Them
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data. You also have the right to data portability and the right to withdraw consent at any time.
- Delete your account: do it yourself in Profile → Delete Account.
- Download your logos and brand assets: use bulk export in your Profile.
- Any other request: email info@sinqlo.com from the address registered on your account. We may ask you to confirm your identity.
We reply within one month. If a request is complex we may extend this by up to two more months, and we will tell you why within the first month. Requests are free unless they are clearly unfounded or excessive.
If you’re unhappy with how we handle your data, you can complain to the Hellenic Data Protection Authority (www.dpa.gr, 1–3 Kifisias Ave, 115 23 Athens) or to the authority in your EU country.
14) Security and Data Breaches
We protect your data with encryption in transit (HTTPS) and at rest, access controls that keep each account’s data separate, hashed API keys, rate limiting and security logging.
If a personal data breach happens, we will notify the Hellenic Data Protection Authority within 72 hours of becoming aware of it, unless the breach is unlikely to put anyone at risk. If the breach is likely to put your rights and freedoms at high risk, we will also tell you directly, without undue delay, and explain what happened and what you can do.
15) Sinqlo Logo Finder (Chrome & Mozilla Plugin)
The Sinqlo Logo Finder extension runs entirely on your device. It does not collect, store, or transmit personal information, browsing history, or analytics data. The extension requests temporary access to the active webpage you are viewing (the activeTab and scripting permissions) for one purpose: to locate SVG logo code and copy it to your clipboard when you click the extension icon. It does not send your data or browsing activity to Sinqlo servers or share it with third parties.