Privacy notice

1. What we collect, and why

Waiting list. Your name, e-mail address, country, the property-management system you use, and roughly how many units you manage. All five are required: they decide whether InnSync can serve your operation today and which connection we build next, and without them there is nothing to put on the list. The legal basis is your consent, given by ticking the box on the form.

Design-partner call. When you book a call, the scheduling form collects your name, e-mail, the system you use, your country and the number of units, so the conversation starts from something real. The legal basis is your consent, and — once we are discussing a possible agreement — steps taken at your request before entering into a contract.

Technical data that travels with a submission. Every form we receive also carries the page you sent it from, how you arrived (campaign parameters such as utm_source, and click identifiers such as gclid, wbraid, gbraid and fbclid), your IP address and your browser's user agent. We use these to tell which channel a lead came from — that is advertising attribution, and where consent is required it happens only after you accept.

Newsletter. If — and only if — you tick the separate newsletter box, your e-mail address, name, country, system and portfolio size are also added as a contact in our Resend marketing audience, so the newsletter can be written for the operation you actually run. That is a decision of its own: joining the waiting list does not subscribe you, and every newsletter carries a one-click unsubscribe link. The legal basis is your consent.

Analytics and advertising. Where consent is required, these load only after you accept them in the banner, and not before. Declining costs you nothing on this site.

We take no decision about you by automated means, and we do not profile you.

2. Who else sees it

We do not sell personal data and we do not share it for anyone else's marketing. It reaches these processors, each only for the purpose named:

• Vercel — hosts this website.
• InnSync's own servers and database — where a waiting-list entry is stored.
• Resend — sends our e-mails, and holds the newsletter contact list if you subscribed.
• Cal.com — scheduling, when you book a call.
• Google — Google Calendar and Google Meet for the call itself; Google Analytics and Google Ads only with your consent.
• Meta — the Meta Pixel in your browser and the Meta Conversions API from our server, both only with your consent.
• OpenAI — its advertising measurement pixel, only with your consent.
• PostHog — product analytics, only with your consent. We do not record your screen on these pages.

3. Where it goes

We are established in Brazil, and the processors above operate in Brazil, the United States and the European Union. If you are in the European Economic Area or the United Kingdom, your data therefore leaves that area.

Brazil is not covered by a European adequacy decision, and we do not yet have standard contractual clauses in place for this flow. The transfer relies on your explicit consent under Article 49(1)(a) GDPR, and you are entitled to know the risk you are consenting to: outside the protection of an adequacy decision or contractual safeguards, your rights may be harder to enforce, and a Brazilian authority may have access rights a European one would not. That is precisely why the data set here is small and why nothing sensitive is asked for. Do not join the waiting list if that trade is not acceptable to you — write to us by e-mail instead; we will keep only that correspondence.

4. How long we keep it

Waiting-list entries: until you ask us to delete them, or twenty-four months after the last contact, whichever comes first. Scheduling records: for as long as Cal.com holds the booking, and in our own records for the same twenty-four months. A newsletter subscription lasts until you unsubscribe — the link is in every e-mail. A consent choice recorded in your browser lasts twelve months, after which we ask again.

5. Your rights

You can ask us for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, object to that use, or ask for it in a portable form. Where we rely on consent, you can withdraw it at any time — that does not undo what was lawful before you withdrew it. Write to contato@innsync.com.br and we will answer within thirty days.

If you are in the EEA or the UK, you may also complain to your national data protection authority.

6. Cookies

One cookie is strictly necessary and is set without asking: it records which region you are visiting from, and it exists only to decide whether we have to ask for consent at all. It lasts 24 hours.

A second cookie records your answer to the banner, and it is written only when you answer — accepting or rejecting. It lasts twelve months, after which we ask again. Its whole purpose is to keep us from ignoring what you already said.

Everything else is set only after you accept: Google Analytics and Google Ads, the Meta Pixel, the OpenAI advertising pixel and PostHog. Their own cookies are read by those companies and typically last up to two years. If you decline, or simply ignore the banner, none of them loads — and our server does not send anything to them either.

7. Data in the InnSync platform

Customer account data. When a business subscribes, we process the names, e-mail addresses and phone numbers of its team members, its company details and its usage of the platform, to provide the service, support it and bill for it. We are the controller of this data.

Guest data. Our customers put their own guests' data into the platform: names, contact details, reservation dates, messages and, where the customer enables it, check-in documents. For this data the customer is the controller and we act as its processor, only on the customer's instructions. Guests who want to exercise their rights should contact the property manager they booked with; we assist our customers in answering those requests.

Processors. Platform data is stored on servers in Brazil and reaches processors only for the purpose named: AI providers to draft replies, e-mail and messaging providers to deliver messages, and error-tracking and product-analytics tools to keep the service working. We do not sell personal data.

8. Payments

International software subscriptions are processed by the reseller and merchant of record identified at checkout: Dodo Payments for the Mexico/Colombia pilot, or Paddle for accounts on that provider. Payment details are entered directly with the selected provider and never reach InnSync. The provider shares the billing details needed to manage your subscription, such as name, e-mail address, country and invoice records. Its own privacy policy applies to the data it processes.

9. Changes to this notice

We may update this notice. Material changes are announced on this page and, for customers, by e-mail or in the platform before they take effect.

10. Contact

Data protection contact: Fernanda Cabral — contato@innsync.com.br. We answer within thirty days.