// PRIVACY
This policy explains how Synost processes personal data on this Website under the GDPR and the French Data Protection Act (Loi Informatique et Libertés).
The controller is Thomas Filip Lochet, entrepreneur individuel (EI), trading under the name Synost, 42B rue Victor Hugo, 78330 Fontenay-le-Fleury, France. SIREN 935 212 381, SIRET 935 212 381 00013, registered with the RCS of Versailles. For complete company and hosting details, see our Legal Notice.
When you use the contact form, we process your name, company email address, selected service, message, and submission time. We use this information to respond to your request, assess a possible engagement, and send a confirmation email. Please do not include sensitive or confidential information that is not needed for your inquiry.
The contact form uses Cloudflare Turnstile to distinguish legitimate requests from automated abuse. Cloudflare may process browser signals and, when made available by our proxy, the requesting IP address. Synost uses the result to protect the form and does not retain the Turnstile token after verification. See Cloudflare’s Privacy Policy.
To protect the contact form from abuse, Synost temporarily derives HMAC-hashed identifiers from the requesting IP address and the email address entered in the form. These pseudonymous identifiers are used only to enforce short-lived rate limits of five attempts per ten minutes and three accepted submissions per hour.
The rate-limit records contain no raw IP address or email address. They are stored in our database, removed after their security window, and are not used for analytics, advertising or marketing. This processing is based on our legitimate interest in protecting the Website and preventing abuse.
The Website uses Rybbit, a privacy-focused analytics service, to understand how the Website is used and improve it. Rybbit is configured for cookieless analytics; its script and tracking requests are served through first-party paths on this Website and proxied to the Rybbit instance configured by Synost. We do not use this analytics service to serve advertising. More information is available in Rybbit’s Privacy Policy.
We process contact information to respond to your request and take steps at your request before a possible contract (Article 6(1)(b) GDPR), or, where that basis does not apply, on the basis of our legitimate interest in managing business inquiries (Article 6(1)(f)). We process security information on the basis of our legitimate interest in preventing abuse and protecting the Website. Audience measurement is based on legitimate interest only to the extent that the configuration and use of the tool meet the conditions for an exemption from consent under Article 82 of the French Data Protection Act; where consent is required, it will be requested before the relevant processing begins.
Access is limited to Synost and providers acting on its instructions where they need access to operate the Website, store contact inquiries, deliver email, provide security services, or provide analytics. These providers may include our hosting and database provider, SMTP/email provider, Cloudflare, and the Rybbit instance configured for the Website. Where personal data is transferred outside the European Economic Area, Synost uses a lawful transfer mechanism and appropriate safeguards required by Chapter V of the GDPR, such as an adequacy decision or standard contractual clauses where applicable.
Contact information and related correspondence are kept for as long as necessary to handle and follow up on your inquiry, and for longer only when needed for a resulting business relationship, a legal obligation, or the establishment, exercise, or defence of legal claims. We review information periodically and delete or anonymise it when it is no longer needed. Security and analytics data may be retained by the relevant provider according to its documented retention settings and policy.
Subject to the conditions and limits provided by law, you may request access to, rectification or erasure of your personal data, restriction of processing, or portability of data you provided. You may object to processing based on legitimate interests, and you may withdraw consent at any time where processing relies on consent. To exercise a right, email hello@synost.com. We may ask for information needed to verify your identity and will respond within the period required by the GDPR.
You can first contact Synost at hello@synost.com so that we can address your concern. You also have the right to lodge a complaint with the French supervisory authority, the Commission nationale de l’informatique et des libertés (CNIL), via cnil.fr.
The Website uses technologies that are necessary for security and operation. Rybbit is configured for cookieless audience measurement. Synost does not use advertising cookies or trackers. If we introduce an optional cookie or tracker for which consent is required under French law, we will not activate it before obtaining a valid choice and will provide a way to change that choice.
We do not use the information collected through this Website to make decisions based solely on automated processing that produce legal or similarly significant effects. We may update this policy when the Website, our processing activities, or applicable requirements change. The version published here is the current version; it was last updated on 27 August 2026.