1. Introduction

Scopes ("we", "us", "our") respects your privacy. Scopes is operated by Syntropicon and is the data controller for personal data processed through the Scopes platform at scopes.syntrocon.com.

This Privacy Policy explains how we collect, use, store, and protect your information when you use our website and project management tools. It applies to registered users and to visitors who browse our public pages.

For contractual terms governing use of the service, see our Terms of Service.

2. Information We Collect

We collect the following categories of personal and project data to provide and improve our service:

• Account information: Your name, email address, optional phone number, and password hash when you register with email and password.
• Google sign-in: If you sign in with Google, we receive your name, email address, and profile image from Google. OAuth tokens are stored in our database to maintain the connection.
• Workspace and membership: Workspace names and your role (for example, owner or member) within workspaces you create or join.
• Project data: Project names, schedules, tasks, dependencies, calendars, resources, assignments, costs, bill-of-quantities fields, baselines, and related configuration you enter or import into the platform. This data is stored in our database to provide the service.
• AI assistant: Conversation titles, messages, tool inputs and outputs, and metadata associated with the in-app AI assistant when you use it. Prompts may include project context (such as project name and ID) to help the assistant respond.
• Email flows: Temporary verification and password-reset tokens associated with your email address.
• Technical data: Your IP address is processed transiently in server memory for rate limiting and abuse prevention. It is not stored in our application database. Server or host logs may retain IP addresses for up to 90 days.
• Analytics (with consent): If you accept analytics cookies, Google Analytics 4 collects page views, device and browser information, and similar usage data via _ga and _ga_* cookies.

3. File Import and AI Attachments

When you import or attach files:

• CSV and Excel import: Files you upload for project import are processed to create or update tasks and related data in your project. Import file contents are not stored long-term in our database after processing.
• AI assistant attachments: Files you attach to an AI conversation may be held temporarily in server memory so the assistant can read or process them. These temporary files are deleted shortly after the request completes.
• Export: When you export a project, the generated file is delivered to your browser; we do not retain export files on our servers after delivery.

4. Third-Party Services

Scopes uses third-party services to deliver the platform:

• Google sign-in: Authentication via Google OAuth, subject to Google's privacy policy.
• Google Analytics: Website usage analytics, loaded only after you accept analytics cookies. See Section 8 below.
• AI providers: When you use the AI assistant, your messages and relevant project context may be sent to third-party AI providers (such as Google Gemini) to generate responses. Do not include confidential information in prompts unless you accept that it will be processed by those providers under their terms.

You are responsible for reviewing each provider's terms and privacy policy. For questions about how a provider handles your data, contact that provider directly.

5. Legal Bases and Retention

We process your data on the following legal bases (as applicable under GDPR and similar laws):

• Contract performance: To provide the service, store your projects, manage your account and workspaces, and send transactional emails.
• Legitimate interest: Security, abuse prevention (rate limiting), and service reliability.
• Consent: Google Analytics cookies. You may withdraw consent at any time by adjusting cookie preferences.

Retention periods:

• Account and workspace data: while your account is active.
• Project data: while your account or the relevant workspace exists. Deleting a workspace removes its projects and associated data.
• AI conversation history: until you delete the conversation, the associated project or workspace, or your account.
• Import and AI attachment files in server memory: deleted shortly after processing, typically within minutes.
• Verification tokens: until used or expired.
• Server and host logs: up to 90 days.
• Database backups: up to 30 days.
• Third-party provider data: per the relevant provider's terms.

6. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erasure ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability, where applicable.
• Withdraw consent at any time (without affecting prior lawful processing).
• Lodge a complaint with a supervisory authority, such as the CNPD in Portugal or the ANPD in Brazil.

Account deletion: You can delete your account at any time via Account Settings. This removes your user profile, owned workspaces (and all projects, tasks, resources, and AI conversations within them), sessions, and linked OAuth accounts from our database. If you are a member—but not the owner—of a workspace, your membership is removed but the workspace and its projects remain for other members. Emails already sent, server logs, and backups may be retained for the periods stated above.

Data export: You can export individual projects to CSV from within the app. For a broader copy of your data, contact us.

To exercise your rights, email [email protected]. We respond within one month (GDPR) or 30 days (LGPD), where applicable.

7. Cookies

We use cookies to help improve your experience on scopes.syntrocon.com. This section forms part of this Privacy Policy and covers cookies between your device and our site.

Third-party services integrated with Scopes may also use cookies under their own policies. This section does not describe those third-party cookies in detail.

If you refuse our cookies through your browser or cookie settings, some features or services may not work as intended.

What is a cookie? A cookie is a small piece of data stored on your device when you visit a site. It typically contains information about the site, a unique identifier, and an expiry period. Cookies can enable core features (such as sign-in), remember settings, or measure how a site is used.

First-party and third-party cookies. Cookies set by scopes.syntrocon.com are first-party cookies. Cookies set by external services are third-party cookies and may be used across sites that use the same service.

Essential cookies (no consent required) are necessary to provide the Services, including sign-in, security, and saving your cookie choices. These include the auth_token authentication session cookie and cc_cookie (your consent choices).

Performance cookies (consent required) help us understand how visitors use the site. We use Google Analytics 4 via _ga and _ga_* cookies, loaded only after you accept analytics cookies. See Google's privacy policy. You can opt out at https://tools.google.com/dlpage/gaoptout.

We do not use advertising or targeting cookies.

How to control cookies. You can accept or reject non-essential cookies via the cookie settings link in the site footer. Essential cookies cannot be switched off while you use the Services. You can also manage cookies in your browser settings; see your browser's help pages for instructions.

We may update this cookies section from time to time. Check the effective date at the top of this Privacy Policy when you use the site.

8. Age Requirements

By accessing the Services, you confirm that you're at least 18 years old and meet the minimum age of digital consent in your country. If you are not old enough to consent to our Terms of Service in your country, your parent or guardian must agree to this Privacy Policy and our Terms of Service on your behalf.

Please ask your parent or guardian to read these terms with you. If you're a parent or legal guardian, and you allow your teenager to use the Services, then these terms also apply to you and you're responsible for your teenager's activity on the Services. No assurances are made as to the suitability of the Services for you.

9. Security and Breaches

We use HTTPS encryption and password hashing to protect data in transit and at rest. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

If we become aware of a personal data breach likely to affect your rights, we will notify you and relevant authorities as required by applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated effective date at the top of this page and, where appropriate, by email or in-app notice. Continued use after changes take effect constitutes acceptance of the updated policy.

11. Contact

Data controller: Syntropicon (operating the Scopes brand)
Privacy contact: [email protected]