SyncSpotPrivacy policy
Last updated: Thursday, 29-Oct-2026
Who operates SyncSpot
SyncSpot is operated by Silvia Pellegrino, who is the data controller for personal data processed through syncspot.eu. For privacy questions and requests, contact silvia@syncspot.eu. For product support, contact hello@syncspot.eu.
What we collect
Waitlist information is described below. During the beta, accounts contain a name, email address, password hash and optional profile photo or avatar. Sessions contain an internal account identifier, expiry and technical information such as IP address and browser details. Trips contain membership, per-trip names, origins, flights, shared plans, links and uploaded files. Flight searches involve selected origins and destinations, travel dates and traveller counts. Password reset links and beta invitation credentials control account access.
Waitlist and invitation permission
When waitlist registration opens, joining will not create an account or guarantee beta access. We will collect your email address, invitation permission and its timestamp/version, subscription state, invitation history and technical token hashes. Invitation permission will be required to join. A separate, optional checkbox, unticked by default, will let you agree to short surveys or interviews to help shape SyncSpot. Declining research contact will not affect your invitation. Both purposes rely on consent. After a new signup, save your private preferences link to turn either permission off or back on independently while the link is valid. If you lose it, contact hello@syncspot.eu or silvia@syncspot.eu. Duplicate submissions do not replace your original link. Invitation messages will also provide an unsubscribe route. We will not send newsletters or an automatic signup confirmation. Unconverted invitation records will be retained for up to 365 days from signup, or until you unsubscribe; converted invitation records will be removed 30 days after registration. Research permission and the contact details needed for that purpose will remain active after account registration or withdrawal of invitation permission, unless you withdraw research permission separately. Research permission expires 12 months after the last research contact, or 12 months after signup if no contact has occurred. Withdrawing either permission does not delete an independent account. Invitation withdrawal removes the invitation record and related invitation data. To prevent an anonymous resubmission from silently reactivating it, we retain a keyed hash of the email address until 365 days after the original signup. This suppression record cannot be used to send email and is used only to honour your withdrawal. We separately retain your email address, private link hash, creation date and expiry date for up to 365 days from signup so you can manage or restore your permissions. This preferences record is not permission to contact you, even when both options are off. It expires automatically and is removed if you request erasure. Existing research-only preferences links remain valid until their recorded expiry. Restoring a permission records fresh consent; it does not resend an invitation or restart the original invitation retention period. Use your original private link or contact us if you want to join again.
Protecting the waitlist
Cloudflare Turnstile verifies waitlist submissions and processes technical browser information and the request IP address to prevent abuse. Dedicated rate limits use a keyed, rotating hash of the IP address and time window; the counters do not store raw IP addresses or email addresses and expire within a day. Functional verification may use Cloudflare’s technical cookies. A successful new signup records an anonymous analytics event without an email address, invitation token or subscriber identifier.
Services that process data
Vercel hosts the website and Neon stores application data. Resend handles service emails, and Cloudflare supplies DNS and bot protection. Google Workspace handles email sent to our contact addresses. The documented hosting regions are Frankfurt for Vercel and Neon, and Ireland for Resend. PostHog EU provides limited analytics and Sentry EU processes scrubbed error reports. The planned beta also uses Cloudflare R2 for uploaded files and a flight data provider for searches. Flight searches send airport codes and dates from our server for a single-adult fare lookup; that request does not include account names, email addresses, uploaded files or the traveller’s IP address. Providers may process technical request information and operational records. When you follow a booking link, the booking partner processes information under its own privacy policy.
Retention and account deletion
You can request deletion in Account settings or contact us. Account deletion is blocked while a trip you administer still has other joined travellers, regardless of its dates. After deletion, your memberships and flights are removed. Shared content in surviving trips remains without personal attribution. External file and analytics erasure run through a durable background queue. Accounts are retained while you use the service, subject to deletion requests and any justified legal retention. The retention periods for beta accounts, sessions and uploaded files will be provided before beta registration opens. Analytics, error reports and backups may have separate retention periods; contact silvia@syncspot.eu for information about data relating to you.
Questions and data rights
Contact hello@syncspot.eu to request access, correction or erasure of your personal data, or to raise a privacy concern. Subject to the applicable conditions, you can request access, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. You also have rights concerning solely automated decisions that have legal or similarly significant effects, including applicable rights to human intervention and to contest a decision. Flight recommendations are suggestions for you to assess, not binding decisions. You may withdraw consent at any time without affecting earlier lawful processing. You can complain to the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or another competent supervisory authority.
Why we process personal data
We rely on consent for beta-invitation contact and, separately, optional surveys or interviews. For the planned beta, processing necessary to provide accounts, authentication, trips and requested service communications is based on performance of our contract with you. Our legitimate interests in security, rate limiting and error reporting are preventing abuse and operating a reliable service. Limited analytics help us understand and improve service usage. These purposes do not override any separate cookie or device-access consent requirement. You may object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing.
Minimum age
SyncSpot is intended for people aged 18 or over. Please do not create an account or join the waitlist if you are under 18. Contact hello@syncspot.eu if you believe we have collected information from a child.
International access and transfers
People outside the European Economic Area may use the website, and their information may be processed in our EEA-based systems. We apply the same GDPR protections regardless of your location, alongside any additional applicable local rights. EEA hosting does not rule out access or transfers by providers elsewhere. Where a transfer outside the EEA requires safeguards, these may include an applicable adequacy decision or standard contractual clauses. Contact silvia@syncspot.eu for information about your data or applicable safeguards. SyncSpot does not sell personal data.
Non-essential cookies and consent
We do not use analytics cookies, automatic click or form tracking, or session replay. Cookieless analytics still process the browser and request information described above. Cloudflare bot protection may use strictly necessary technical cookies. If we introduce non-essential cookies or similar technologies requiring consent, we will ask before enabling them and provide a way to decline or withdraw consent.