This draft reflects how Daedalus Labs intends to handle personal and customer data across the Syntak suite. It must be reviewed by qualified counsel before being treated as final legal notice.
What this notice covers
This notice explains how Syntak, a subsidiary of Daedalus Labs handles information across the Syntak Suite: Syntak Connect, Syntak Learning, Syntak GRC, Syntak Intel, Syntak Code Security, and the Syntak website at syntak.io. Product experiences may present additional in-app notices where a workflow needs more specific detail.
Information we collect
Depending on which Syntak app you use, we may process:
- Account and profile data such as name, work email, organization, role, and authentication details.
- Security-program content you or your organization submit—for example policy acknowledgments, training completions, GRC records, intel sources, scan configuration, findings, or agent/tool broker requests.
- Contact and access requests on syntak.io, including name, work email, company, selected products, team size / user count, optional message, consent, and request identifiers.
- Technical and security telemetry needed to operate services reliably— such as request metadata, authentication events, audit logs, and abuse-prevention signals.
How we use information
- Provide and operate the Syntak applications your organization uses.
- Enforce security controls such as access decisions, guardrails, approvals, audit trails, and policy acknowledgment evidence.
- Respond to early-access or support requests and improve product reliability.
- Detect abuse, investigate incidents, and meet legal or contractual obligations.
We do not sell personal information or use Syntak customer content for third-party advertising.
How this applies by product
Connect processes broker requests, policy and guardrail decisions, approval outcomes, and related audit records.
Learning processes learner accounts, assigned curriculum, policy acknowledgments, and completion evidence.
GRC processes governance, risk, control, ownership, and evidence records maintained by your organization.
Intel processes team membership, followed sources, research activity, reports, and integration settings.
Code Security processes project configuration, scan inputs/results, SBOMs, findings, waivers, CI gate outcomes, and audit history.
syntak.io processes contact and access-request form submissions and limited technical request data for delivery and abuse prevention.
Legal basis and choices
Where applicable, we process information to perform a contract, pursue legitimate interests in operating secure services, comply with law, or—especially for marketing-site requests—with your consent. You may withdraw consent or ask us to stop outreach at any time.
Storage and retention
Syntak suite data is hosted in AWS with encryption in transit and at rest. Retention depends on the product and record type: security-program and customer workspace data generally remain for as long as the organization needs the service (or as required by agreement), while marketing-site lead records are configured to expire after 180 days unless needed for an active conversation or legal obligation. Operational logs use shorter defined retention where practical.
Service providers and transfers
We use Amazon Web Services to host and operate Syntak applications and this site, including storage, compute, networking, and transactional messaging. Data may be processed in the United States. We will update this notice before adding analytics, advertising, or other subprocessors that materially change this flow.
Cookies and similar technologies
Syntak apps may use essential cookies or local storage for authentication and session integrity. This site does not use advertising cookies or cross-site tracking; it only stores your selected color theme in local storage. Essential network and abuse-prevention mechanisms may process technical request data without storing a marketing cookie in your browser.
Your rights
Depending on where you live and your relationship to a customer organization, you may ask to access, correct, delete, restrict, or obtain a copy of your personal information, or object to certain processing. Organization-administered workspace data may require the request to go through your employer’s Syntak administrators. You may also have the right to complain to a local data protection authority.
Contact us
For privacy questions or requests about any Syntak app, email hello@syntak.io. We may need to verify your identity and organizational affiliation before completing a request.
Changes to this notice
We will post updates here and change the effective date when our practices materially change.