1. Who we are and what this policy covers
Synergy Stack Solutions, referred to as "we," "us," or "our," provides cloud infrastructure implementation, business systems integration, identity and access management, device management, workflow automation, and ongoing infrastructure administration.
This policy explains how we collect, use, disclose, and retain personal information when you visit www.synergystacksolutions.com, submit an inquiry, schedule a meeting, communicate with us, or purchase our services. Personal information means information that identifies a person or can reasonably be linked to a person.
We also explain our role when we access personal information within a client's systems. Processing performed on a client's behalf is governed by that client's instructions, the applicable service agreement, and any data processing agreement. This policy does not replace those agreements or limit rights provided by applicable law.
2. Information we collect
The information involved depends on how you interact with us and the services a client authorizes.
| Category | Examples | Source |
|---|---|---|
| Business contact information | Name, work email, telephone number, company, and job title | You, your organization, or a business referral |
| Inquiry and scheduling information | Messages, meeting details, service interests, company size, and information about your technology environment | Forms, scheduling tools, emails, and conversations |
| Client and transaction records | Proposals, agreements, invoices, billing contacts, payment status, and project correspondence | You, your organization, and billing providers |
| Website technical information | IP address, browser and operating system, requested pages, referral information, timestamps, and security logs | Your browser or device and our hosting providers |
| Client service data | User directories, account identifiers, group memberships, access assignments, device identifiers, inventory, compliance status, configuration records, and activity or security logs | Client-authorized access to business systems |
| Content involved in a project | Files, email or collaboration content, workflow inputs and outputs, and records needed for an authorized migration, integration, or automation | Client systems and client-approved integrations |
We do not need passwords, recovery codes, payment card numbers, or sensitive employee records in a general inquiry. Please do not submit them through public forms or ordinary email. If a project requires sensitive information or administrative access, we arrange an appropriate method with the client.
We request access and information appropriate to the agreed scope. Administrative permissions may make additional information technically accessible. We limit our use of that information to authorized work and applicable legal requirements.
3. How we use information
We use personal information to:
- Respond to inquiries, evaluate service fit, prepare proposals, and arrange meetings.
- Deliver agreed implementation, integration, migration, automation, and administration services.
- Communicate about project progress, service changes, billing, and contractual obligations.
- Operate and secure our website and business systems, investigate misuse, and resolve technical problems.
- Maintain business records, meet legal obligations, and establish or defend legal claims.
- Send optional marketing communications when you subscribe or otherwise provide the consent required by applicable law.
Submitting a contact or intake form does not automatically subscribe you to a marketing mailing list. We use inquiry information to respond and handle the related business conversation. If that conversation becomes a client engagement, we also use relevant information to administer the engagement.
Where applicable law requires consent for a particular use, we obtain that consent. We provide notice and obtain any required consent before using information for a materially different purpose.
4. Information in client systems
Clients determine why their employee, customer, and other business information is processed. When we handle that information under their instructions, we generally act as a processor or service provider, as those terms apply under the relevant law and agreement. We separately determine how to handle our own inquiry, billing, and business relationship records.
Client-authorized work may require access to Microsoft 365, Google Workspace, Microsoft Entra ID, Okta, Intune, Jamf, or other approved platforms. Depending on scope, that access may involve employee accounts, device records, permissions, logs, and business content.
We use client service data to perform the agreed work. We do not use that data for our own advertising or sell it. We limit access by our personnel and approved providers to what is needed for their assigned work and require appropriate confidentiality and data-handling obligations.
If your information is held in a system belonging to our client, direct privacy requests to that organization first. If you contact us, we will coordinate with the client as appropriate. We do not independently change or delete client-controlled records without authorization or a legal requirement.
5. AI and workflow automation
An agreed project may use automation tools or AI services to process client-approved inputs and produce outputs. The data involved depends on the workflow and approved platform. It may include business records, messages, documents, or personal information supplied through the client's systems.
We identify the relevant providers and data flows with the client before enabling a workflow that sends client data to an external AI provider. We do not submit client personal information or confidential content to public AI tools for our own convenience without client authorization.
For AI workflows involving client personal information or confidential content, we use services and configurations whose applicable terms prohibit provider model training on those inputs and outputs, unless the client expressly authorizes a different arrangement and applicable law permits it. Provider retention, logging, and processing locations depend on the approved service and configuration. A restriction on training does not necessarily mean a provider retains no data.
This privacy policy is not blanket authorization to connect client systems to AI services. Any workflow that affects employment, eligibility, access, or another consequential decision requires specific scope and appropriate review arrangements with the client.
6. When we disclose information
We disclose personal information when needed for the purposes described in this policy, including to:
- Providers supporting website hosting and analytics, forms, appointment scheduling, communications, business recordkeeping, billing, and secure storage. Our current providers include Vercel (website hosting and analytics), Tally (forms), and Microsoft 365 (email).
- Client-approved cloud platforms, integration providers, and automation or AI services involved in an engagement.
- Approved contractors assisting with agreed work under confidentiality and appropriate data-handling obligations.
- Professional advisers, such as accountants, attorneys, or insurers, when needed for their services.
- Authorities or other parties when disclosure is required by law, or is legally permitted and necessary to investigate fraud, address security incidents, or protect legal rights.
- Parties involved in a merger, acquisition, or transfer of our business, subject to applicable confidentiality requirements and law.
We will never sell your personal information to third parties.
This commitment does not prevent us from providing information to service providers when needed to handle an inquiry or deliver agreed services, as described above. Those disclosures must remain consistent with the no-sale commitment.
Where providers process information on our behalf, we require appropriate contractual protections. Platforms that a client contracts with directly also operate under that client's agreements with them.
7. Cookies, embedded tools, and browser signals
Our website and providers may use cookies or similar technologies to deliver pages, support forms and scheduling, maintain preferences, and prevent abuse. Hosting providers may process technical logs even when cookies are disabled. We use Vercel Web Analytics to understand page visits in aggregate. It does not use cookies or track you across other websites.
Embedded tools can receive information such as your IP address and browser details when they load, and additional information when you submit a form or book a meeting. Their privacy notices explain their processing. External websites reached through links have their own privacy policies.
You can manage cookies through your browser settings. Blocking some technologies may affect forms, scheduling, or other functions. Where consent is required for nonessential technologies, we obtain it before those technologies operate and provide a way to change that choice.
Do Not Track. There is no common standard for how websites should respond to browser Do Not Track signals, so we do not respond to them. We do not track visitors across other websites.
Third-party tracking. We do not use advertising cookies or let advertising networks track you through our website. Our form provider (Tally) and our scheduling provider run their tools from their own servers. Tally processes form submissions on our behalf and stores them in the European Union. When you use these tools, the providers may collect information such as your IP address and browser details and may use cookies or similar technologies, as described in their own privacy policies. Apart from these tools, we do not allow other parties to collect information about your online activities over time or across other websites through our website.
Global Privacy Control. We will never sell your personal information to third parties. Where applicable law requires recognition of an opt-out preference signal, such as Global Privacy Control, we honor that signal. It does not prevent processing needed to respond to an inquiry, provide a requested service, or secure the website.
8. Retention and deletion
We retain personal information for the period reasonably needed for its purpose, taking account of the relationship, sensitivity, contractual requirements, and applicable law.
| Record category | Retention criteria |
|---|---|
| Inquiries and meeting records | Time needed to respond, handle related discussions, and maintain relevant correspondence |
| Agreements, invoices, and billing records | Time needed for the engagement and applicable accounting, tax, dispute, or other legal requirements |
| Project documentation and administrative records | Time needed to deliver and administer the work, complete handoff, and meet agreed obligations |
| Temporary client exports and working copies | Time needed for the authorized task and agreed validation or handoff, subject to required retention |
| Website and security logs | Time needed for operations, abuse prevention, and incident investigation |
| Marketing records | Until you unsubscribe or the information is no longer needed; limited suppression records may remain to honor your choice |
When information is no longer needed, we delete it or remove identifying details. Some copies may remain in backups until the applicable backup cycle expires. We restrict continued use of retained backup data and information held for legal obligations or disputes.
At the end of an engagement, we handle client information and administrative access according to the service agreement, client instructions, and applicable law. Client platform records remain subject to the client's and platform provider's retention settings.
9. Security
We use administrative and technical safeguards appropriate to the information and work involved. These include restricting administrative access, using multifactor authentication where supported, using secure methods to exchange sensitive information, and reviewing access when assignments or engagements end.
No system or transmission method provides absolute security. If an incident affects personal information, we investigate and provide notices required by applicable law and our contractual obligations.
10. Your choices and privacy requests
You may ask us to review, correct, or delete personal information we hold about you through the contact method in section 13. You can also unsubscribe from optional marketing emails using the link provided or by contacting us. We may continue sending communications needed for an active engagement or transaction.
Depending on your location, the law's applicability, and the information involved, you may have rights to access or receive a copy of your information, correct inaccuracies, request deletion, restrict or object to certain processing, withdraw consent, or opt out of certain disclosures or automated processing. Some laws also provide an appeal process or a right to complain to a regulator.
We handle requests within applicable legal deadlines and explain any lawful limitation or refusal. Where an appeal right applies, you can submit an appeal through the same contact method. We do not penalize you for exercising applicable privacy rights.
We may ask for information needed to verify your identity or an authorized agent's authority. We use verification information for that purpose and avoid requesting unnecessary sensitive records. You do not need to create an account to make a request. Some records may need to remain for legal obligations, security, contractual performance, or legal claims.
The California Consumer Privacy Act and other privacy laws apply according to their statutory scope and exemptions. This policy does not assume that every right under those laws applies to every interaction. Requests concerning information held on a client's behalf follow the process in section 4.
11. Processing locations and children
Our business and service providers may process information in the United States and other countries where the approved services operate. Privacy laws may differ between countries. Where applicable law requires safeguards for international transfers, we use the required safeguards. This policy does not promise that all information remains in the United States.
Our website and services are intended for business audiences. We do not knowingly collect personal information from children under 13 through our public website. If you believe a child has submitted information, contact us so we can investigate and take appropriate action. Information in a client's systems is handled under the applicable client agreement and legal requirements.
12. Changes to this policy
We may update this policy when our practices, services, or legal obligations change. We post the revised policy with its effective date. For material changes, we provide additional notice where required, such as a prominent website notice or a message to affected clients. We obtain consent where applicable law requires it.
13. Contact us
For privacy questions or requests, email privacy@synergystacksolutions.com or use our contact page. Identify your message as a privacy request and describe the information or interaction involved. Do not include passwords or other sensitive credentials.