Skip to content
Sygnyfy
Start free trial

Sygnyfy Privacy Policy

How Sygnyfy collects, uses, shares, and protects personal information, including how personal data is aliased before any AI call.

Draft. This document is under legal review and isn't in effect yet. Questions? Email support@ic5labs.com.

1. Who we are and what this policy covers

IC5 Labs, Inc. ("IC5 Labs", "we", "our", or "us") provides Sygnyfy (formerly ProductLab), a hosted service at productlab.ic5labs.com that helps product teams turn customer conversations into prioritized needs and releases.

This policy covers two kinds of personal information:

  • Account information about the people who use Sygnyfy: owners, admins, and members of an organization. For this information, IC5 Labs is the controller.
  • Customer Data that organizations put into Sygnyfy, such as transcripts, customer contacts, evidence, and needs. Customer Data often contains personal information about the people in those conversations. For Customer Data, the organization that uses Sygnyfy is the controller and IC5 Labs is its processor, acting only on its instructions under our Terms of Service and Data Processing Addendum.

If you are a customer of one of our customers and appear in a transcript they uploaded, please contact that organization first. We will help them respond to your request.

The ic5labs.com website and IC5 Labs' ServiceNow products are covered by the IC5 Labs Privacy Policy.

2. Information we collect

Account information

  • Sign-in: when you sign in with Google, GitHub, or Slack, that provider shares your name, email address, and profile photo with us through our identity provider, WorkOS. If you sign in with email, we receive your email address and verify it. We never receive your passwords.
  • Organization and role: the organizations you belong to, your role in each, and who invited you.
  • Billing: the plan, billing interval, number of users, subscription status, and invoice history. Paddle, our merchant of record, collects your payment details and billing address; we never receive your card number.
  • Support: what you send to support@ic5labs.com.

Customer Data

  • Conversations and transcripts, including the names of speakers and anything said in them.
  • Customer and contact records, such as company names, contact names, email addresses, and phone numbers.
  • Evidence, needs, personas, products, features, releases, and the activity history of changes to them.
  • Files you upload, such as transcripts and CSV imports.

Please don't put special categories of personal data (for example health, financial account, or government identity information) into Sygnyfy. It isn't designed for them.

Information collected automatically

  • Usage events: we record product events, such as "conversation analyzed" or "evidence accepted", with organization and user identifiers and counts. These events never include the content of your records.
  • Errors and performance: when something fails, we record technical details such as the page, browser, and stack trace. We remove request bodies, cookies, and personal data before error reports are sent.
  • Technical data: our hosting provider processes your IP address, browser type, and the pages you request to deliver the service and keep it secure, and keeps these in short-lived logs.

3. How we use information

We use personal information to:

  • Provide Sygnyfy, keep you signed in, and enforce your organization's roles and permissions.
  • Run the AI features your organization uses (see section 4).
  • Process subscriptions, trials, and seat changes with Paddle.
  • Send service emails: invitations, trial reminders, payment notices, AI allowance notices, and security messages. These aren't marketing and can't be turned off while you have an account.
  • Respond to support requests.
  • Understand, in aggregate, how Sygnyfy is used so we can improve it.
  • Protect the service, prevent abuse, and meet legal obligations.

We don't sell personal information, use it for advertising, or use Customer Data to train AI models.

4. AI and personal data

Sygnyfy's AI features (for example, finding evidence in a transcript or rewriting a need) send text to AI models made by Anthropic and, as a fallback, OpenAI, through Vercel's AI Gateway. Before any text leaves Sygnyfy:

  • Names of people and companies, email addresses, phone numbers, street addresses, profile links, card numbers, government ID numbers, and dates of birth are replaced with placeholders such as PERSON_1 or COMPANY_1.
  • The model sees only the placeholders. When the results return, Sygnyfy puts the real values back.
  • The mapping between placeholders and real values stays in Sygnyfy's database and is never sent to the gateway or a model.

Limits. Detection of people and organizations already in your Sygnyfy records is exact. Detection of other names is best effort, so an unusual name that isn't in your records could occasionally reach a model unaliased. Anthropic and OpenAI are used under their standard API terms, which prohibit training on API data. We haven't sought zero-data-retention agreements, so the providers may keep aliased text for a limited period for abuse monitoring.

AI output is always a suggestion. A person in your organization accepts or rejects it before it changes your records.

5. Who we share information with

  • Members of your organization see Customer Data according to their roles, and see each other's names, emails, and roles.
  • Subprocessors that host and run Sygnyfy for us, listed on our subprocessors page: Vercel (hosting, file storage, AI Gateway), Neon (database), WorkOS (sign-in), Paddle (payments), Resend (email), PostHog (product analytics), Sentry (error monitoring), Anthropic and OpenAI (AI models, aliased text only). Each is bound by a contract to protect the information and use it only to provide its service to us.
  • Legal and safety: when the law requires it, or to protect the rights, property, or safety of IC5 Labs, our customers, or others. Where allowed, we tell the affected organization first.
  • Business transfers: if IC5 Labs is involved in a merger, acquisition, or sale of assets, information may transfer as part of it, under this policy's protections.

6. Cookies

Sygnyfy uses only the cookies needed to run it:

  • pl_session: keeps you signed in. Expires after 14 days or when you sign out.
  • pl_oauth: protects the sign-in flow. Lasts 10 minutes.

We don't use advertising or third-party tracking cookies, and product analytics are recorded on our servers rather than in your browser. Paddle's checkout, which opens when you start a trial, may set its own cookies to process payment and prevent fraud, under Paddle's privacy policy.

7. How long we keep information

  • Customer Data is kept for as long as your organization keeps it. Transcripts are kept for the life of their record. When an admin deletes a record, it's removed. When the owner deletes the organization, access ends immediately and all Customer Data, including uploaded files, is permanently deleted after a 30-day grace period. Database backups age out within a further 30 days.
  • Account information is kept while you have an account, and deleted or anonymized within 30 days of your request after you leave every organization, except where we must keep it.
  • Billing records are kept by Paddle and by us as long as tax and accounting laws require, usually seven years.
  • Usage events are kept for up to two years, and error reports for up to 90 days.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict how we use it, and to withdraw consent. To use these rights for your account information, email privacy@ic5labs.com. We'll respond within 30 days and won't treat you differently for asking.

For Customer Data, contact the organization that controls it. Owners and admins can correct or delete records in Sygnyfy at any time and export everything from Settings, Data export.

You can also complain to your local data protection authority.

9. Where information is processed

Sygnyfy is hosted in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States. Where the law requires it, we rely on the European Commission's Standard Contractual Clauses, and the UK addendum to them, for these transfers, as described in our DPA.

10. Security

Sygnyfy separates organizations at the database level with row-level security, tested on every change. Data is encrypted in transit and at rest, access to production systems is limited and logged, and personal data is aliased before any AI call. Read more on our Security page. No system is perfectly secure; if we learn of a breach affecting your information, we'll notify you and your organization as the law requires.

11. Children

Sygnyfy is for businesses and isn't intended for anyone under 16. We don't knowingly collect personal information from children.

12. Changes to this policy

We may update this policy. We'll post the new version here with its effective date and, for material changes, email organization owners at least 30 days before they take effect.

13. Contact us

IC5 Labs, Inc.
[Street address]
Orlando, Florida
privacy@ic5labs.com