Skip to content
Sygnyfy
Start free trial

Sygnyfy Data Processing Addendum

The terms under which IC5 Labs processes personal data in Sygnyfy on behalf of its customers.

Draft. This document is under legal review and isn't in effect yet. Questions? Email support@ic5labs.com.

This Data Processing Addendum ("DPA") forms part of the Sygnyfy Terms of Service or other written agreement for Sygnyfy, formerly ProductLab (the "Agreement") between IC5 Labs, Inc. ("IC5 Labs") and the customer organization that agreed to it ("Customer"). It applies automatically when IC5 Labs processes Customer Personal Data subject to Data Protection Laws. Customers who need a countersigned copy can request one at privacy@ic5labs.com.

1. Definitions

  • Data Protection Laws: all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act ("CCPA").
  • Customer Personal Data: personal data in Customer Data (as defined in the Agreement) that IC5 Labs processes on Customer's behalf.
  • Subprocessor: a third party IC5 Labs engages to process Customer Personal Data.
  • Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
  • "Controller", "processor", "data subject", "personal data", "processing", and "supervisory authority" have the meanings given in the GDPR. "Service provider" has the meaning given in the CCPA.

2. Roles and instructions

  • Customer is the controller of Customer Personal Data and IC5 Labs is its processor (and, under the CCPA, its service provider).
  • IC5 Labs processes Customer Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's use and configuration of Sygnyfy are those instructions. IC5 Labs will tell Customer if it believes an instruction violates Data Protection Laws.
  • Customer is responsible for the lawfulness of the Customer Personal Data it provides, including giving any notices and obtaining any consents needed to record, transcribe, and upload conversations.
  • The details of processing are in Annex 1.

3. CCPA

IC5 Labs will not sell or share Customer Personal Data, or retain, use, or disclose it outside the direct business relationship with Customer or for any purpose other than providing Sygnyfy, except as the CCPA allows. IC5 Labs will not combine it with personal data from other sources except as the CCPA allows, and will tell Customer if it can no longer meet its CCPA obligations.

4. IC5 Labs personnel

IC5 Labs ensures that everyone authorized to process Customer Personal Data is bound by confidentiality, and limits access to those who need it to provide, support, or secure Sygnyfy.

5. Security

IC5 Labs implements the technical and organizational measures in Annex 2, and may update them as long as overall protection does not decrease.

6. AI processing

When Customer uses Sygnyfy's AI features, IC5 Labs replaces personal data in the text with placeholders before the text is sent to an AI model, and restores the real values after the response returns. The mapping is kept only in Sygnyfy's database. Detection of people and organizations in Customer's Sygnyfy records is exact; detection of other names is best effort. IC5 Labs does not use Customer Personal Data to train AI models.

7. Subprocessors

  • Customer authorizes IC5 Labs to engage the Subprocessors listed at ic5labs.com/productlab/legal/subprocessors.
  • IC5 Labs imposes data protection terms on each Subprocessor that are at least as protective as this DPA, and remains responsible for their performance.
  • IC5 Labs will give at least 30 days' notice of a new Subprocessor by updating the list and emailing every Customer that has asked for notices at privacy@ic5labs.com. Customer may object on reasonable data protection grounds within that period. If the parties can't resolve the objection, Customer may end the affected service and receive a prorated refund of prepaid fees for the unused period.

8. Data subject requests

Sygnyfy lets Customer access, correct, export, and delete Customer Personal Data. If IC5 Labs receives a request from a data subject about Customer Personal Data, it will refer the person to Customer and won't respond itself unless Customer authorizes it. IC5 Labs will provide reasonable help with requests Customer can't fulfil using Sygnyfy.

9. Security Incidents

IC5 Labs will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident. The notice will describe the incident, the data and data subjects affected as far as known, the likely consequences, and the measures taken or proposed, and IC5 Labs will update it as more becomes known. Notifying Customer is not an admission of fault.

10. Assistance

Taking into account the nature of processing and the information available to it, IC5 Labs will provide reasonable help with Customer's data protection impact assessments, consultations with supervisory authorities, and security obligations.

11. Deletion and return

Customer may export Customer Personal Data at any time from Settings, Data export, and for 30 days after the Agreement ends. When the owner deletes the organization, or 30 days after the Agreement ends, IC5 Labs deletes Customer Personal Data from production systems; backups age out within a further 30 days. IC5 Labs may keep data the law requires it to keep, protected by this DPA, and only for that purpose.

12. Audits

On written request, no more than once a year, IC5 Labs will answer a reasonable security questionnaire and provide information needed to demonstrate compliance with this DPA. If that is not enough to meet Customer's obligations under Data Protection Laws, or a supervisory authority requires it, Customer may audit IC5 Labs on 30 days' notice, during business hours, at its own cost, under confidentiality, and without access to other customers' data.

13. International transfers

Sygnyfy is hosted in the United States. To the extent Customer Personal Data subject to the GDPR, the UK GDPR, or Swiss law is transferred to IC5 Labs in a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by European Commission Decision 2021/914 ("SCCs"), Module Two (controller to processor), which are incorporated by reference, as follows:

  • Clause 7 (docking clause) applies.
  • Clause 9: option 2 (general written authorization), with the notice period in section 7 of this DPA.
  • Clause 11: the optional language does not apply.
  • Clauses 17 and 18: the law and courts of Ireland.
  • Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA. The competent supervisory authority is determined under Clause 13.
  • For UK transfers, the UK International Data Transfer Addendum (version B1.0) applies, with Table 1 to 3 completed by this DPA and either party able to end it as Table 4 allows.
  • For Swiss transfers, references to the GDPR mean the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

14. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the SCCs don't allow it. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data; if it conflicts with the SCCs, the SCCs control.

Annex 1: Details of processing

  • Data exporter: Customer, as identified in its Sygnyfy account. Contact: the organization owner.
  • Data importer: IC5 Labs, Inc., [Street address], Orlando, Florida, USA. Contact: privacy@ic5labs.com.
  • Subject matter and purpose: providing Sygnyfy: capturing customer conversations, finding customer evidence, managing needs, products, features, and releases, and the related AI features, support, and security.
  • Duration: the term of the Agreement plus the deletion periods in section 11.
  • Nature of processing: hosting, storage, transcription parsing, search, indexing, aliasing and AI analysis, email delivery on Customer's instruction, backup, and deletion.
  • Categories of data subjects: Customer's users; Customer's own customers, prospects, partners, and their employees whose information appears in Customer Data, including people who speak in uploaded conversations.
  • Categories of personal data: names, business contact details (email, phone, company, role), statements made in conversations, and other information Customer chooses to upload.
  • Special categories: none intended. Customer agrees not to upload them.
  • Frequency: continuous.

Annex 2: Technical and organizational measures

  • Tenant isolation: every business table carries the organization's identifier and is protected by Postgres row-level security. Cross-tenant tests run on every change.
  • Encryption: TLS 1.2 or higher in transit; AES-256 encryption at rest for the database and file storage.
  • Access control: role-based permissions inside Sygnyfy; production access limited to authorized IC5 Labs personnel with multi-factor authentication; secrets kept in the hosting provider's encrypted environment variables.
  • AI data minimization: personal data is aliased before any text reaches the AI gateway or a model (section 6).
  • Authentication: sign-in through WorkOS with email verification, bot protection, and optional multi-factor authentication.
  • Logging and monitoring: an audit trail of changes to records; error monitoring with personal data removed before reports leave Sygnyfy.
  • Resilience: managed database with point-in-time restore; workflow steps retried with idempotency keys.
  • Secure development: code review, automated tests, linting, and dependency updates on every change.
  • Vendor management: Subprocessors are reviewed before engagement and bound by data protection terms.
  • Deletion: organization data is permanently deleted 30 days after the owner deletes the organization.