SynSight ERP

1. Who We Are

SynSight ERP ("SynSight", "the Service") is a cloud-based garment manufacturing platform developed and operated by Syntera Labs (Pty) Ltd ("Syntera Labs", "we", "us"), a private company registered in South Africa (registration number 2026/348010/07), with its registered office at 24 Cradock Avenue, Rosebank, Johannesburg, Gauteng, 2196.

This policy explains what personal information SynSight processes, why, who else handles it, how long we keep it, and the rights you have. It applies to the app at app.synsighterp.com, the website at synsighterp.com, and the emails the Service sends. It is written to meet the Protection of Personal Information Act, 2013 (POPIA) and, for users in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR and UK GDPR).

Our Information Officer under POPIA can be reached at [email protected].

2. Our Role and Yours

For your own account (your name, email address, sign-in and security records) and for billing, Syntera Labs is the responsible party under POPIA and the controller under the GDPR.

For the business records your organisation enters into SynSight, including the names and details of your staff, operators, suppliers and buyers, your organisation is the responsible party (controller) and Syntera Labs is the operator (processor) under POPIA sections 20 and 21 and GDPR article 28. As operator we process that information only to provide SynSight as your organisation instructs, keep it confidential, secure it, and return or delete it when the service ends. A data processing agreement is available on request.

A person whose details are held by a SynSight customer should send requests about them to that customer first; we will help the customer answer them.

3. Information We Collect

• Account information: name, work email address, role, and a one-way hash of your password (never the password itself).
• Security information: your two-step verification settings and hashed backup codes; for each sign-in session, the IP address, browser and device description, and when it was used; failed sign-in attempts, used to stop password guessing.
• Organisation information: organisation name, address, contact details, plan and subscription status.
• Business records you enter: styles, bills of materials, costing, suppliers, purchase orders and goods received, stock, production orders and their lifecycle, cutting and bundles, line and output figures, operators and attendance, quality inspections, shipments and documents. Some of this is personal information about your staff, operators and contacts.
• Activity records: barcode scans (who scanned which code and when), the questions asked of SynScout with its answers, and integration posting logs.
• Communications: messages you send to support.

We do not collect payment card details. We do not use analytics, advertising or tracking tools, and we do not build profiles of you. The phone scanner reads barcodes on your device; camera images are not sent to us.

4. How We Use It, and Our Legal Basis

• To provide the Service you or your organisation signed up for: accounts, workspaces and every feature you use. Basis: performance of our contract with your organisation.
• To keep accounts and the Service secure: two-step verification, detecting new devices, blocking repeated failed sign-ins, and telling people from bots on sign-in pages. Basis: our legitimate interest in security, and our legal duty to secure personal information (POPIA section 19).
• To send service email: verification, invitations, password resets, security notices, alerts and subscription notices. Basis: contract and legitimate interest.
• To answer support requests and fix faults. Basis: contract and legitimate interest.
• To keep billing and tax records. Basis: legal obligation.

We do not sell personal information, use it for advertising, or send marketing email without your consent. No decision with legal or similarly significant effect on anyone is made by automated means alone (POPIA section 71, GDPR article 22).

5. SynScout, Our AI Assistant

SynScout answers questions and writes a daily briefing from your organisation’s own records. To do this we send Anthropic, PBC (United States), the provider of the Claude models, only what the request needs: the question, the page it was asked from, the person’s role, and the records SynScout reads to answer it, such as orders, steps, output, stock or shipments.

Anthropic processes this under its commercial terms, which do not allow it to train its models on this data, and it does not use it for any other purpose. SynScout reads only and changes nothing. Questions and answers are kept in your organisation’s SynScout log so administrators can see what was asked. Organisations that do not want this can simply not use SynScout; nothing else in SynSight depends on it.

6. Who Else Handles Your Information

We use a small number of providers, each bound by a written agreement to process data only for the service named:

• Cloudflare, Inc. (United States, global network): hosting, database, network delivery, protection against attacks, and Turnstile, which checks that sign-in forms are used by people.
• Resend (United States): delivery of the service emails listed in section 4.
• Anthropic, PBC (United States): SynScout, as described in section 5.
• GoDaddy (United States): the [email protected] mailbox, for messages you send us.
• PayFast (South Africa): subscription payments. Card and bank details are entered on PayFast’s own pages and never reach us.
• SynLedger (Syntera Labs): only if your organisation connects it: supplier bills from goods received and sales invoices from dispatched shipments, with the supplier or buyer names on them, are posted to your SynLedger books.

We may also disclose information when the law, a court order or a regulator requires it, or to protect the rights and safety of people using the Service. If Syntera Labs or SynSight is sold or merged, personal information would pass to the new owner under this policy, and we would tell you first.

7. International Transfers

Cloudflare, Resend, Anthropic and GoDaddy process data in the United States and, for Cloudflare, in data centres around the world. Under POPIA section 72 and GDPR chapter V we transfer personal information outside South Africa or the European Economic Area only to providers bound by agreements that give it substantially the same protection, including the European Commission’s standard contractual clauses where the GDPR applies, and only what each service needs.

8. How We Protect It

• Passwords hashed with PBKDF2-SHA256 and a unique salt for every account.
• Two-step verification required on every account, with single-use backup codes.
• Sessions that end after 24 hours without use and after 30 days at most; an email when your account is used from a new device.
• Accounts locked after repeated failed sign-ins, and limits on attempts from one address.
• Encryption of all traffic in transit (TLS 1.2 or later) and integration secrets encrypted at rest.
• Each organisation’s records kept apart from every other organisation’s, and role-based access within it.

No system is perfectly secure. If personal information is accessed by someone without authority, we will tell the affected organisations and people, and the Information Regulator, as soon as reasonably possible, as POPIA section 22 requires, and the relevant supervisory authority within 72 hours where the GDPR applies.

9. How Long We Keep It

• Account and business records: for as long as your organisation uses SynSight.
• To close an organisation, an administrator writes to [email protected]; personal account details are then deleted within 30 days and business records within 90 days. Export what you need through Reports before closing.
• Sign-in session records: until the session ends or 30 days, whichever is first. Failed sign-in counters: minutes to hours.
• Database recovery copies kept by Cloudflare: up to 30 days, after which deleted data is gone.
• Billing and tax records: 5 years, as South African tax law requires.

You may ask for earlier deletion at [email protected], except where the law requires us to keep the record.

10. Your Rights

Under POPIA you may ask to know whether we hold your personal information and to see it, to have it corrected or deleted, and to object to its processing. You may also complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, inforegulator.org.za, [email protected].

If the GDPR or UK GDPR applies to you, you also have the rights to restrict processing, to receive your data in a portable format, and to withdraw any consent you gave, and you may complain to your local data protection authority.

To use any of these rights, write to our Information Officer at [email protected]. We will answer within 30 days and will not charge for a reasonable request. We may need to confirm who you are first.

11. Cookies and Local Storage

SynSight keeps your sign-in token in your browser’s local storage so you stay signed in; it is removed when you sign out. Cloudflare Turnstile, on the sign-in and registration pages, may set a strictly necessary cookie to tell people from bots. We use no advertising cookies, tracking pixels or third-party analytics, so no cookie banner is shown.

12. Children

SynSight is a business service for people aged 18 and over. We do not knowingly collect personal information about children; if you believe we have, tell us and we will delete it. Organisations are responsible for any information about minors they enter as employer records, which must be lawful in their country.

13. Changes to This Policy

We will post any change here with a new date. Where a change matters to you, we will email account holders at least 14 days before it takes effect.

14. Contact Us

Syntera Labs (Pty) Ltd, registration number 2026/348010/07
Registered office: 24 Cradock Avenue, Rosebank, Johannesburg, Gauteng, 2196, South Africa
Information Officer (registered with the Information Regulator, 2026-067698) and support: [email protected]
Website: synsighterp.com