Privacy Policy

Preamble

SYLEN SAS (hereinafter "Sylen", "we" or "our") attaches the greatest importance to the protection of your personal data. This Privacy Policy (hereinafter the "PP") describes transparently how we collect, use, share and retain your data in connection with the website sylen.ai and the application app.sylen.ai.

It applies to three categories of persons:

• business clients subscribing to Sylen services, and their users;
• visitors to the website sylen.ai;
• callers whose communications are processed by the AI agent configured by a Sylen client.

01Controller

The controller of the data collected through the website sylen.ai and the application app.sylen.ai is:

SYLEN SAS is not subject to the obligation to appoint a Data Protection Officer within the meaning of Article 37 GDPR. GDPR questions are handled by a dedicated contact point (contact@sylen.ai). SYLEN SAS will reassess the need to appoint an independent DPO if its activity changes in a way that could make this mandatory under Article 37.1.b GDPR.

02Allocation of roles

Depending on the nature of the data concerned, Sylen acts either as controller or as processor:

For data processed as a processor, the terms are governed by the Data Processing Agreement (DPA), which forms an integral part of the Terms and Conditions of Sale and is accepted by the Client upon subscription.

03Data collected

3.1 Client Account data

• Identity: last name, first name, job title
• Business contact details: email, phone number
• Company information: company name, address, SIRET, VAT
• Billing data: billing address, Stripe Customer identifier (full banking data is never accessible to Sylen; it is managed by Stripe)
• Login credentials: email, hashed password, 2FA token
• Technical logs: IP address, login date/time, browser, activity log

3.2 Service-related data

• Agent configuration: system prompt, selected voice, time slots, business rules, integrations
• Phone numbers assigned to the Client
• Calendar (if the integration is enabled): events and availability slots

3.3 Call-related data

• Metadata: caller's number, timestamp, duration, status (answered/missed/transferred)
• Text transcript of the conversation (exchanges between the AI and the caller)
• Automatic summary and detected intent (e.g., appointment booking, information request)
• Caller's name as given orally, and contact details where applicable
• Appointments created by the agent
• Appointment text messages sent to the caller who accepted them during the call: number, text, date, status

3.4 Browsing data (sylen.ai website)

• IP address, browser type, operating system, pages viewed, length of visit
• Cookie and tracker data (see the Cookie Policy)

3.5 Affiliate program

• For the affiliate program: identification and billing data of affiliates, affiliate code associated with a subscription, recorded clicks with encrypted fingerprints of the IP address and browser (see the "Affiliate program" section below).

3.6 Special categories of data

Sylen does not intentionally collect or process any sensitive data within the meaning of Article 9 GDPR (health, opinions, religion, sex life, etc.). The Client is contractually bound, under the Terms and Conditions of Sale, not to configure its agent to collect this type of data from callers.

Healthcare professionals. As Sylen is not a certified health data host, healthcare professional accounts benefit from enhanced minimization: the agent collects only administrative information, no transcript or audio recording is retained, either by Sylen or by the voice provider, and the content of past calls, messages and appointments is erased after 30 days.

04Purposes and legal bases

05Technical processors

Sylen uses technical processors to provide the Service. Each processor is bound by a data processing agreement compliant with Article 28 GDPR.

Affiliates in the affiliate program do not receive any personally identifiable data about clients. Our technical providers (hosting, payment, emails) are involved in the program as they are in the rest of the service.

The tools specific to Sylen's commercial prospecting are not used for the Service: they are listed separately, in section 13.

The up-to-date list of processors is available on request at contact@sylen.ai. Any substantial change (addition of a new processor processing Client data) is notified to clients by email with reasonable prior notice.

06Transfers outside the European Union

6.1 Service data is stored in the European Union: Supabase database in Ireland, application run by Vercel in Paris, Railway voice server in the Netherlands, calls on most numbers processed by Twilio in Ireland. However, some processing takes place outside the EEA, mainly in the United States: the voice engine (ElevenLabs), which processes call audio and produces the transcript and the agent's response; text analysis (OpenAI), which in particular writes the summary of each call; sending of text messages and calls on certain numbers (Twilio); sending of emails (Resend). The U.S. companies that operate Vercel, Railway and Twilio, and the Singaporean company that operates Supabase, may also access the data for operational and support purposes. Telegram, established outside the European Union, receives only the internal alerts described in §5.

6.2 These transfers are governed by the safeguards provided for in Articles 44 to 46 GDPR, indicated for each processor in the table in section 05, namely:

• the Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914);
• the EU-U.S. Data Privacy Framework where the processor is certified;
• additional technical and organizational measures (TLS encryption in transit, encryption at rest, strict access controls).

6.3 A copy of the applicable safeguards (standard contractual clauses, certification references) can be obtained on simple request at contact@sylen.ai.

07Retention periods

Sylen applies a retention policy that differs according to the nature of the data. A daily cron job automates deletions and anonymizations.

7.1 Deletion after termination

After the Contract has effectively been terminated:

• 30 days: export period available to the Client (complete download of the data from the personal space);
• thereafter: automatic deletion of transcripts, messages, appointments, integrations and settings, and anonymization of calls;
• billing data and data subject to legal obligations are retained for the period required by law.

08Data security

Sylen implements appropriate technical and organizational measures to protect your data against any unauthorized access, alteration or destruction:

• Encryption in transit (TLS 1.2+) for all website, application and API communications;
• Encryption at rest of data stored in the database;
• Strong authentication: hashed passwords (bcrypt), two-factor authentication (2FA) available on all accounts;
• Strict access controls with Row Level Security (RLS) at the database level;
• HMAC tokens for authenticating real-time WebSocket connections;
• Security headers: HSTS, X-Frame-Options, X-Content-Type-Options, Content-Security-Policy;
• Rate limiting on sensitive endpoints;
• Daily automatic backups of the database;
• Monitoring and logging of administrator access;
• Internal awareness training on data protection.

8.1 Breach notification

In the event of a data breach likely to result in a risk to the rights and freedoms of the data subjects, Sylen undertakes to:

• notify the CNIL (the French data protection authority) within 72 hours in accordance with Article 33 GDPR;
• inform the data subjects as soon as possible when the risk is high (Article 34 GDPR).

09Your rights

In accordance with Articles 15 to 22 GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): obtain confirmation that data concerning you is being processed and obtain a copy of it
• Right to rectification (Art. 16): correct inaccurate or incomplete data
• Right to erasure / "right to be forgotten" (Art. 17): request the deletion of your data under the conditions provided by law
• Right to restriction of processing (Art. 18): temporarily suspend the processing
• Right to data portability (Art. 20): receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller
• Right to object (Art. 21): object to the processing on grounds relating to your particular situation, in particular with regard to commercial prospecting
• Right to withdraw your consent at any time, where the processing is based on consent
• Right to set post-mortem directives regarding the fate of your data after your death

Exercising these rights is free of charge. Sylen may request proof of identity in the event of reasonable doubt as to the identity of the requester, in accordance with Article 12 GDPR.

10How to exercise your rights

Several channels are available to you to exercise your rights:

• From your client account app.sylen.ai:
  • Modification of your personal information via the Profile page
  • Complete export of your data via the Export my data function in your client account (ZIP format, right to data portability, Article 20 GDPR)
  • Deletion of your account via the Profile → Delete my account page
• By email: contact@sylen.ai, specifying the subject of your request
• By postal mail: SYLEN SAS - GDPR Officer - 31 rue de Turique, 54000 Nancy, France

10.1 Specific case: callers' rights

For callers whose conversations were processed by an AI agent of a Sylen Client, requests to exercise rights must be addressed first to the Client who collected the data (the controller). Sylen, as processor, will forward any request received to the Client concerned as soon as possible and will assist it in handling the request.

11Cookies and trackers

The use of cookies and trackers on sylen.ai and app.sylen.ai is described in detail in the Cookie Policy.

You can change your preferences at any time via the "Manage cookies" link in the footer.

11.1 Anonymous audience measurement of sylen.ai (cookieless, without consent)

The sylen.ai website counts its visits with an internal counter that we operate ourselves. It does not set any cookie and does not write anything to your browser.

• What is counted. The page viewed, the domain name of the site you came from, the type of device (computer, mobile or tablet), the country and, if you arrive from an ad, the link's utm_source, utm_medium, utm_campaign, utm_content and utm_term parameters (never a click identifier such as gclid). Clicks on a phone number and on a sign-up button are counted without any information about the person clicking.
• What is never retained. Your IP address and your browser. They are used, in memory and for the duration of the request, to calculate a visitor identifier valid for a single day (HMAC-SHA-256 with a secret key changed every day). It cannot be recalculated without the key or linked from one day to the next, and is used only to avoid counting the same visit twice in the same day.
• Periods. Every hour, visits older than 24 hours are reduced to totals per day and per page, and the daily identifier is erased. Totals are retained for a maximum of 25 months.
• Legal basis and limits. Sylen's legitimate interest (Article 6.1.f GDPR) in knowing the traffic of its website and the effectiveness of its ads. The measurement serves only Sylen's website, on its own behalf; it is not cross-referenced with any other data, is not transmitted to any third party for that third party's own purposes, and does not track anyone from one site to another. Under these conditions, it falls within the audience measurements exempt from consent under the CNIL guidelines (deliberation no. 2020-091 of September 17, 2020).
• Objecting to it. If your browser sends "Do Not Track" (DNT) or "Global Privacy Control", your visit is not counted. You can also write to contact@sylen.ai. As the retained data no longer makes it possible to identify a person, we cannot find or erase a specific visit.

11.2 Audience measurement with Google Analytics 4 (with your consent)

This is a different measurement, separate from the previous one: Google Analytics 4 sets cookies and is only active if you accept the "Audience measurement" category in the banner. The details are in the Cookie Policy.

12Affiliate program

Sylen offers independent professionals (the "affiliates") the opportunity to recommend its service and to be paid a bonus for each new client they bring in. This program involves three categories of persons: affiliates, visitors who arrive through an affiliate's link, and clients whose subscription is attributed to an affiliate.

12.1 If you are an affiliate

We process your identity (name or company name, legal representative), your contact details, your SIRET number, your VAT regime, your bank account details and the last characters of your IBAN, the media you use, proof of your acceptance of the contract (version, date, time, IP address, browser), your statements and your invoices. We process them to manage the program, assign you a code and a link, calculate and pay your bonuses, issue invoices in your name (self-billing), and comply with our accounting and tax obligations (reporting of fees, social security due diligence). Legal bases: performance of the affiliate contract and our legal obligations. For these purposes, your data is transmitted to our hosting, payment and email providers, and to the tax authorities or social security bodies where required by law. Retention periods: the term of the contract plus five (5) years for the contract, its proof of acceptance and your correspondence; ten (10) years for invoices, statements and accounting records; your bank account details are deleted at the end of the contract, after the last payment.

12.2 If you arrive through an affiliate's link

An affiliate's link contains that affiliate's code. Here is exactly what we do with this code.

• With your consent: a cookie. If you have accepted the "Partners and affiliation" purpose on sylen.ai, we set a cookie named sylen_aff (domain .sylen.ai, set by our servers) that contains the affiliate's code for ninety (90) days. It is used to attribute any subscription you take out to the affiliate who recommended Sylen to you and to grant you the 10% first-year discount. Its legal basis is your consent (Article 82 of the French law of January 6, 1978 and Article 6.1.a GDPR). It is optional and can be refused separately from other cookies.
• Without your consent: no cookie. We set nothing and use of the site does not change. The code from the link you just opened is only carried over in the address of the pages of the current visit, to prefill the "Partner code" field when you subscribe. It is not written anywhere on your device, and you can change or delete it.
• The code you enter. A partner code entered when subscribing is data you send us through a form, not a tracker: it works whether you have accepted or refused the cookie, and it takes precedence over any link.
• No tracking by IP address or fingerprint for attribution. We use neither your IP address nor a fingerprint of your browser or device to decide which affiliate a subscription is attributed to.
• Withdrawing your consent. At any time, with "Manage cookies" in the footer of sylen.ai. The cookie is then no longer read; you can also delete it in your browser, and it erases itself after 90 days.

In addition, when you click on an affiliate link, we record the click with an encrypted (non-reversible) fingerprint of your IP address and browser, solely to produce click statistics and detect fraudulent clicks (legal basis: our legitimate interest in protecting the program against fraud). This fingerprint is never involved in the attribution of a subscription. These records are retained for thirteen (13) months.

12.3 If your subscription is attributed to an affiliate

We record that your subscription is attributed to that affiliate (means of attribution, dates of account creation and payments, plan), in order to calculate the affiliate's bonus, apply your discount and report to the affiliate. The affiliate never receives your name, your email address or your contact details: the affiliate only sees a sequence number, the plan and the sign-up date. To prevent self-referral and fraud, we compare, in encrypted form, your email address, your SIREN number, your business email domain and your card fingerprint with those of the affiliate (legal basis: our legitimate interest; you may object by writing to the address below). This data is retained for the duration of your relationship with Sylen, then for five (5) years as proof of the attribution of the bonus, and for ten (10) years for the related accounting records.

12.4 Your rights

For these processing operations, you have the rights described in the "Your rights" section: access, rectification, erasure, restriction, objection and, where the processing is based on a contract, portability. To exercise them, or to withdraw your consent, write to contact@sylen.ai. You may also lodge a complaint with the CNIL (cnil.fr/fr/plaintes).

13B2B commercial prospecting

Sylen prospects businesses to present its AI voice agent to them. This section concerns professionals contacted by Sylen who are not yet clients. It does not concern private individuals, nor our clients' callers.

13.1 The data we use

Only business data made public by the business or by an official register:

• the identity of the business: company name, trade name, SIREN, address, trade, date of creation;
• its published contact details: website, phone number and email address that the business itself displays (website, Google business profile, official directory), and the first name of the manager when it is published;
• a public signal that justifies the contact: a job posting for a reception or secretarial position, the creation of a business, a recent RGE qualification, or public reviews mentioning a phone that goes unanswered. The text of the reviews and the names of their authors are not retained: only the signal is.

We never take a contact from a job posting, and we do not buy contact lists. The first message states where the address used comes from.

13.2 Legal basis, contact and objection

The legal basis is Sylen's legitimate interest in presenting its service to professionals (Art. 6.1.f GDPR), for an offer related to their activity. Contact is made by email to the published business address, and sometimes by phone to the number published by the business.

You may object at any time, without giving reasons: through the unsubscribe link included in each email, by replying "stop" to one of our messages, by saying so on the phone, or by writing to contact@sylen.ai. The objection applies to the entire business (address, domain, SIREN, phone) and is checked before each sending and each call. To respect it permanently, we keep these identifiers in the form of encrypted fingerprints, without retaining them in plain text.

13.3 Retention period

A business that has been collected but never contacted is deleted 30 days after collection. A business that has been contacted is deleted 3 years after the last contact initiated by it (reply, completed call), failing which 3 years after collection. These deletions are automatic. A prospect who becomes a client is then subject to the Client Account rules.

13.4 Tools used for prospecting

These tools are used solely for Sylen's prospecting. They are separate from the Service processors (section 05) and do not receive any data from clients or their callers.

Where one of these providers is established outside the European Union, the transfer is governed as indicated in section 06.

14Complaint to the CNIL

If you believe that your rights are not being respected, you have the right to lodge a complaint with the French supervisory authority:

We encourage you to contact us first at contact@sylen.ai, which will allow us to address your concerns before any formal recourse.

15Minors

Sylen is a strictly professional (B2B) service. It is not intended for minors under 18 years of age, who cannot enter into a contract. If you become aware that a minor has provided personal data to Sylen, please contact us at contact@sylen.ai so that we can delete it.

16Changes to the policy

Sylen reserves the right to modify this Privacy Policy at any time, in particular to comply with legal, regulatory or technical changes.

Any substantial change is notified:

• to clients by email sent to the address provided in their Client Account, with 30 days prior notice before it takes effect;
• to visitors and callers by publication of the new version on this page, with the date updated.

Continued use of the services after publication of the changes constitutes tacit acceptance of the new version.

17Contact

For any question regarding this Privacy Policy or the processing of your personal data: