Privacy Policy

Version française : Politique de Confidentialité

Last updated: October 17, 2026

This Privacy Policy explains how Woby Web Maroc (“Synapse”, “we”, “us”) collects, uses, stores, protects and otherwise processes information when you access or use the Synapse platform.

Synapse is a cloud software platform (SaaS) offering customer relationship management (CRM), business management, data management, workflow, automation, reporting and third-party integration features.

By using Synapse, you acknowledge that you have read and understood this Privacy Policy.

1. Information we collect

Depending on the features you use, Synapse may collect and process different categories of information.

1.1 Account information

When you create or use a Synapse account, we may collect information such as your name, email address, organization details, authentication information and other information needed to create and manage your account.

1.2 Information you provide

You may provide information to Synapse while using the Service, including customer information, contact details, business information, notes, tasks, documents, files, messages, records, commercial data, configuration information and any other content you choose to store or process through Synapse.

1.3 Technical information

We may automatically collect technical information needed to operate and secure the Service, including IP address, browser type, device type, operating system, login information, timestamps, application logs, error information and security-related events.

1.4 Usage information

We may collect information about how you interact with Synapse, including the features used, actions taken, pages or resources viewed, and technical events generated while using the Service.

2. Google integrations

Synapse offers separate integrations with different Google services. Google services are not automatically connected to your Synapse account: you choose which Google integrations you want to use.

Each Google integration is enabled separately. When you choose to connect a specific Google service, Synapse starts Google’s OAuth authorization process for that integration. The permissions requested from Google depend on the integration and the feature it provides.

This means that connecting one Google service does not automatically give Synapse access to any other Google service.

3. Google user data we may access

Depending on the integrations you choose to enable, Synapse may access information made available through Google APIs, including, where applicable:

• Google account information: account identity and email address needed to identify the connected account.
• Google Analytics data: accounts, properties, reporting information, metrics, dimensions and other information required by the Analytics integration.
• Google Search Console data: properties, search performance information and other information required by the Search Console integration.
• Gmail data (if the Gmail integration is enabled): messages, message metadata, labels, attachments or other information required by the Gmail features used.
• Google Drive data (if the Drive integration is enabled): files, file metadata and other information required by the Drive features used.
• Google Calendar data (if the Calendar integration is enabled): calendars, events, event information and other information required by the Calendar integration.
• Google Contacts data (if the Contacts integration is enabled): contact details and other information needed for contact-related features.
• Other Google service data, where a corresponding Synapse integration is available and you explicitly choose to enable it.

The information actually accessed depends on the Google integration selected and the permissions shown during Google’s OAuth authorization process.

4. How Google authorization works

When you choose to connect a Google service, you are redirected to Google’s authorization screen, where Google displays the permissions requested by Synapse. Synapse only receives the requested Google permissions after your explicit authorization through Google’s OAuth process.

Each integration only requests the permissions needed for its associated feature. Synapse does not request access to Google services for potential future features: permissions are requested when you enable the corresponding integration and used to provide the associated feature.

5. Use of Google user data

Google user data is used to provide the Google integration and related features that you explicitly choose to use. Depending on the integration, this data may be used to:

• connect and authenticate a Google service with your Synapse account;
• retrieve information from the connected Google service;
• display Google information within Synapse;
• import information into Synapse at your request;
• synchronize information between Synapse and the connected Google service;
• generate reports, dashboards or analyses you have requested;
• perform actions through the connected Google service that you explicitly request;
• maintain and operate the relevant integration;
• resolve technical issues affecting the integration;
• protect the security and integrity of the integration.

We do not sell Google user data. We do not use Google user data for advertising purposes, including personalized advertising or retargeting. We do not use Google user data to make creditworthiness, lending, insurance or other financial eligibility decisions.

6. Google API Services User Data Policy

Synapse’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements applicable to sensitive and restricted scopes.

We limit the use of Google user data to providing or improving user-facing features that are visible and relevant to the corresponding Synapse integration. This data is not sold, rented or transferred to advertising platforms, data brokers or information resellers, nor used to serve advertising, including personalized or retargeting advertising.

7. Human access to Google user data

Access to Google user data by Synapse staff or contractors is limited to situations where such access is necessary for legitimate operational purposes and permitted by applicable law and Google’s policies, including:

• technical support you have requested;
• investigating security incidents;
• investigating abuse of the Service;
• resolving technical issues;
• complying with legal obligations.

Such access is subject to appropriate controls and limited to the information reasonably necessary for the purpose concerned.

8. Information received from other sources

Depending on the features you use, Synapse may receive information from other third-party services that you choose to connect to your account. This information is processed according to the feature enabled, the permissions granted, the terms of the applicable third-party service and this Privacy Policy.

9. Shopify app

When a merchant connects their Shopify store to their Synapse instance, Synapse accesses, through the Shopify APIs and only after the merchant’s explicit authorization, the following categories of data:

• Orders: order contents, amounts, statuses, and the associated shipping and billing information;
• Products: the store catalog (products, variants, prices, inventory and descriptive information);
• Customers: the merchant’s customer records, which may include name, email address, phone number, addresses and purchase history.

9.1 Purpose

This data is used solely to provide the merchant with the features they request in their Synapse instance: display, custom screens, dashboards, reports and analyses of their business.

9.2 No storage by default

By default, Synapse does not store Shopify data: it is read from Shopify at the moment it is displayed. It is stored only if the merchant expressly requests storage, for use or display in screens they have requested. It is then kept in the merchant’s instance, solely for that purpose.

9.3 Merchant control

The merchant remains in control of the data in their instance. Deleting a screen deletes the Shopify data stored for that screen. Disconnecting Shopify stops any new data retrieval; data already stored at the merchant’s request remains in their instance, under their control, until they delete it.

9.4 Privacy requests sent by Shopify

Synapse handles the privacy requests that Shopify sends to it automatically:

• Customer data access request: we provide the merchant with the data we hold about that customer;
• Customer data erasure request: we delete that customer’s data;
• App uninstallation: Shopify sends us an erasure request 48 hours after the app is uninstalled, and we then delete the data of the store concerned.

These requests are completed within 30 days of receipt, except where the law requires us to retain certain data.

9.5 Roles

For the data of their store’s customers, the merchant acts as the data controller and Woby Web Maroc acts as a data processor on the merchant’s instructions. Customers of a store who wish to exercise their rights are invited to contact the merchant first; we assist the merchant in responding to their requests.

9.6 No sale, no advertising

We do not sell data obtained through Shopify and do not use it for advertising purposes. It is shared only with service providers strictly necessary to operate the Service, under the conditions described in the “Information sharing” section.

10. How we use information

In addition to the purposes specifically described for Google user data and Shopify data, Synapse may use information to:

• provide and operate the Service;
• create and manage user accounts;
• provide customer support;
• process subscriptions and payments;
• maintain and improve Synapse;
• monitor system performance and reliability;
• detect and prevent fraud, abuse and unauthorized access;
• protect the security of users and the Service;
• communicate with users about their account and the Service;
• comply with applicable legal obligations.

11. Information storage

Information processed by Synapse may be stored on infrastructure operated by Synapse or by service providers acting on our behalf. Platform data is hosted in France by OVHcloud (see section 22). Depending on the feature used, information obtained through Google integrations may be stored temporarily or durably to provide features such as synchronization, reporting, dashboards, search, history, caching or other features you request.

We keep information only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal, security, operational and contractual requirements.

12. Data security

We implement reasonable technical and organizational measures designed to protect the information processed by Synapse against unauthorized access, alteration, disclosure, loss or destruction, including access controls, authentication mechanisms, encryption in transit, monitoring, logging, backups and security procedures.

No online service can guarantee absolute security. You are responsible for protecting your account credentials and the devices used to access Synapse.

13. Information sharing

We do not sell personal information or Google user data. We may share information with service providers that process it on our behalf when necessary to operate Synapse (hosting, infrastructure, databases, security, monitoring, communications, email delivery, payments, customer support or other technical services). These providers only have access to the information reasonably necessary to perform their tasks.

We may also disclose information when required by law, regulation, legal process or government request, or when reasonably necessary to protect the rights, property, safety or users of Synapse.

14. Google user data and sharing with third parties

Google user data is not transferred to third parties for advertising, marketing, data brokerage or other unrelated commercial purposes. It may be processed by service providers acting on behalf of Synapse only where necessary to provide the relevant feature, maintain the Service, protect security or comply with applicable legal obligations, and subject to applicable Google policies. We do not sell or rent Google user data to third parties.

15. Third-party services

Synapse may integrate with third-party services, including Google, Shopify and other technology providers. Your use of a third-party service remains subject to that provider’s own terms and privacy policies. Synapse is not responsible for the privacy practices, availability, security or operation of third-party services.

16. Revoking Google access

You can revoke Synapse’s access to a connected Google service at any time through the security and permission settings of your Google account. Synapse may also offer a feature to disconnect a Google integration directly from the Service.

Disconnecting or revoking a Google integration prevents Synapse from obtaining new information from that Google service through the revoked authorization. Information already synchronized or stored in Synapse may be retained in accordance with the retention and deletion rules described in this Policy, unless you request its deletion or the law requires otherwise.

17. Data retention

We retain personal data and User Content for as long as reasonably necessary to provide the Service, maintain your account, provide the integrations you request, comply with legal obligations, resolve disputes, enforce our agreements, maintain security and prevent fraud or abuse.

Google user data obtained through an integration is retained only for as long as reasonably necessary for the relevant Synapse feature, or as otherwise permitted or required by applicable law and Google’s policies. Shopify data is subject to the specific rules described in section 9. When information is no longer needed, we may delete or anonymize it, subject to applicable legal, security, backup and operational requirements.

18. Account deletion

You can request the deletion of your Synapse account and associated personal information through the account deletion feature available in Synapse, where applicable, or by contacting us using the details below.

When an account is deleted, we take reasonable steps to delete the associated personal information and User Content in accordance with our retention and deletion procedures. Some information may be retained where required by law, where necessary to resolve disputes, enforce agreements, prevent fraud or abuse, maintain security, or while it temporarily remains in secure backup systems until the applicable retention period expires.

Revoking access to a Google account and deleting a Synapse account are separate actions. You can revoke Google authorization directly from your Google account settings.

19. Your privacy rights

Depending on your location and applicable law, you may have rights regarding your personal data, including the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal data;
• request restriction of certain processing;
• object to certain processing;
• request portability of certain information;
• withdraw your consent where processing is based on consent.

To exercise these rights, please contact us using the details below.

20. Cookies and similar technologies

Synapse may use cookies and similar technologies necessary to authenticate users, maintain sessions, remember preferences, protect the Service and maintain security. Where required by applicable law, Synapse will ask for your consent before using non-essential cookies or similar technologies.

21. Children’s privacy

Synapse is intended for professional use and is not designed for children. We do not knowingly collect personal data from children where such collection is prohibited by applicable law.

22. Hosting and international data transfers

Synapse platform data is hosted in France, in OVHcloud data centers (the Gravelines site or another site located in France), within the European Union.

Woby Web Maroc, which operates Synapse, is established in Morocco and is not established in the European Union. Members of our team may access data from Morocco where necessary to operate, maintain, secure or support the Service, within the limits described in this Policy.

Third-party services you choose to connect (for example Google or Shopify) may process data in other countries under their own terms. Where required by applicable law, we implement appropriate safeguards for international transfers of personal data.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Synapse, our services, our data processing practices, legal requirements or our third-party integrations. When changes are material, we will take reasonable steps to inform affected users and, where required, obtain any necessary consent.

The date at the top of this Policy is the effective date of the current version. If there is any discrepancy between this English version and the French version, the French version prevails.

24. Contact us

For any questions about this Privacy Policy, your personal data, or Synapse’s processing of Google user data or Shopify data, contact us:

Woby Web Maroc
ICE number: 002390168000049
RC: 28307
Résidence Nasr 46, Avenue Moulay Rachid
Martil (Morocco)
Email: contact@synaptic-crm.com

Last updated: October 17, 2026